[DEP0040] DeprecationWarning: The `punycode` module is deprecated

[asarkar]

Description:
Emits the following warning during set-up and post set-up steps:

(node:2563) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

Task version:
5

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Repro steps:
N/A

Expected behavior:
No warnings.

Actual behavior:
Warning shown.

[aparnajyothi-y]

Hello @asarkar, Thank you for creating this issue and we will look into it :)

[aparnajyothi-y]

Hello @asarkar, thanks for reporting this!

We’ve investigated the issue and found the cause: we recently upgraded setup-java’s runtime from Node 20 → Node 24. As per this documentation from node js, starting with Node 24, any code that loads the built-in punycode
module triggers a [DEP0040] DeprecationWarning. One of our transitive dependencies, uri-js@4.4.1, imports punycode, which leads to this warning. Even though a userland version of punycode (2.3.1) is installed, Node resolves the core module name first, so the warning still appears.

Workaround:
You can suppress deprecation warnings in your workflow by setting:

env:
NODE_OPTIONS: --no-deprecation

We are also tracking options to remove or replace the uri-js dependency since it is no longer actively maintained. Until then, the warning can safely be ignored or suppressed as shown above.
please feel free to reach us if any further concerns or clarifications :)

[asarkar]

@aparnajyothi-y Suppressing a warning that comes from an unmaintained module is a potential security risk. Since setup-java is widely used, I’d recommend treating this issue as high priority. It would be much safer to remove the uri-js dependency altogether.

I’d appreciate if you could share a plan or timeline for replacing uri-js with an alternative.

[reneleonhardt]

If the abandoned uri-js still is so important, why not switch to a maintained fork?
https://github.com/andreinwald/uri-js-replace

• Solves "The punycode module is deprecated" warning in Node