The Salesforce CLI outputs "DeprecationWarning: The punycode module is deprecated." after every sf command.

[catalandres]

Summary

Running the sf CLI under node v21.0.0 throws out the following warning:

(node:83047) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

Steps To Reproduce

• Upgrade node to v21.
• Run any sf command. For example, sf --version.

Expected result

@salesforce/cli/2.13.9 darwin-arm64 node-v21.0.0

Actual result

(node:83092) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
@salesforce/cli/2.13.9 darwin-arm64 node-v21.0.0

System Information

{
  "architecture": "darwin-arm64",
  "cliVersion": "@salesforce/cli/2.13.9",
  "nodeVersion": "node-v21.0.0",
  "osVersion": "Darwin 23.0.0",
  "rootPath": "/opt/homebrew/lib/node_modules/@salesforce/cli",
  "shell": "zsh",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 2.3.9 (core)",
    "@oclif/plugin-commands 2.2.28 (core)",
    "@oclif/plugin-help 5.2.20 (core)",
    "@oclif/plugin-not-found 2.4.3 (core)",
    "@oclif/plugin-plugins 3.9.1 (core)",
    "@oclif/plugin-search 0.0.23 (core)",
    "@oclif/plugin-update 3.2.4 (core)",
    "@oclif/plugin-version 2.0.1 (core)",
    "@oclif/plugin-warn-if-update-available 2.1.1 (core)",
    "@oclif/plugin-which 2.2.34 (core)",
    "@salesforce/cli 2.13.9 (core)",
    "apex 2.3.19 (core)",
    "auth 2.8.20 (core)",
    "data 2.5.16 (core)",
    "deploy-retrieve 1.19.0 (core)",
    "dev 1.2.0 (user)",
    "info 2.6.49 (core)",
    "limits 2.3.38 (core)",
    "login 1.2.35 (core)",
    "marketplace 0.3.0 (core)",
    "org 2.10.12 (core)",
    "schema 2.3.29 (core)",
    "settings 1.4.33 (core)",
    "sobject 0.2.11 (core)",
    "source 2.10.40 (core)",
    "telemetry 2.3.6 (core)",
    "templates 55.5.14 (core)",
    "trust 2.6.18 (core)",
    "user 2.3.36 (core)"
  ]
}

Additional information

Apparently, punycode has been deprecated starting with node v21.

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[git2gus]

This issue has been linked to a new work item: W-14355613

[cristiand391]

Hi @catalandres , we noticed this too a few days ago and tracked it down to 1 dep (whatwg-url):

➜  cli git:(9600617) NODE_OPTIONS='--trace-deprecation' sf config list
(node:67085) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
    at node:punycode:3:9
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:392:7)
    at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:328:10)
    at loadBuiltinModule (node:internal/modules/helpers:102:7)
    at Module._load (node:internal/modules/cjs/loader:995:17)
    at Module.require (node:internal/modules/cjs/loader:1229:19)
    at require (node:internal/modules/helpers:177:18)
    at Object.<anonymous> (/Users/cdominguez/.nvm/versions/node/v21.0.0/lib/node_modules/@salesforce/cli/node_modules/whatwg-url/lib/url-state
-machine.js:2:18)
    at Module._compile (node:internal/modules/cjs/loader:1369:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1427:10)

whatwg-url is used by node-fetch v2 (jsforce) and @octokit/request(templates/plugin-templates - via yeoman deps).

for node-fetch there's a PR to bump it but were waiting to get the jsforce test pipeline stable (node-fetch v3 is an ESM package, we'll have to do more changes probably): jsforce/jsforce#1356

for octokit deps we shared this with the IDEx team (they own templates), no ETA yet.

If you are using sf on node v21 and trying to parse CLI output, make sure to only parse stdout (node warning is sent to stderr).

[chechuan]

This question is bothering me. I searched the internet but couldn't find an answer

[RoboProgrammer69]

downgrade node to 20.9.0 version

[AmrMohamed001]

downgrade node to 20.9.0 version

this work👌

[cristiand391]

@RoboProgrammer69 @AmrMohamed001 are you all downgrading to node 20 because of the warning or are you getting an install error on v21?

[AmrMohamed001]

@RoboProgrammer69 @AmrMohamed001 are you all downgrading to node 20 because of the warning or are you getting an install error on v21?

Yes as this is unknown warning

[maion308]

solution that worked for me:
npm install punycode --save

and then in node_modules go to the directory tr46 > index.js

// Replace this:
const punycode = require('punycode');
// With this:
const punycode = require('punycode/');

basically just add a trailing forward slash

[cristiand391]

@maion308 this warning doesn't break any CLI functionality (if you are parsing CLI output you should always use stdout), why are you swapping the core punycode module?

[wcleveland]

@cristiand391 He's following the instructions provided by the readme for punycode.

⚠️ Note that userland modules don't hide core modules. For example, require('punycode') still imports the deprecated core module even if you executed npm install punycode. Use require('punycode/') to import userland modules rather than core modules.

[cristiand391]

please note that this is repo is for Salesforce CLI issues, I think some people is getting here when googling for that warning.

[BianorAraujo]

solution that worked for me: npm install punycode --save

and then in node_modules go to the directory tr46 > index.js

// Replace this: const punycode = require('punycode'); // With this: const punycode = require('punycode/');

basically just add a trailing forward slash

works like a charm!
thanks

[franciscoxaa]

I have de issue
node v21.1.0
pnpm 8.10.5
biome ^0.3.3

I run:

`$ biome format --write ./src

(node:30521) [DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead.
(Use node --trace-deprecation ... to show where the warning was created)`

Does anyone know how to solve it?

[gurleen-codes]

solution that worked for me: npm install punycode --save
and then in node_modules go to the directory tr46 > index.js
// Replace this: const punycode = require('punycode'); // With this: const punycode = require('punycode/');
basically just add a trailing forward slash

works like a charm! thanks

How did you access the directory tr46? all I see in node_modules is the 'punnycode' folder and the package-lock JSON file.

[catalandres]

@cristiand391 Sadly, this thread is getting polluted with comments that are relevant to other projects. I have renamed the issue to make it clear that this is relevant to our tool.

For what it's worth, there is a reasonable temporary solution to this — use nvm to ensure that the default global environment is v20, not v21. And once all the dependencies for @salesforce/cli are v21-compliant this will be a non-issue.

[cristiand391]

Locking this issue for a bit, if this warning is affecting scripts parsing Salesforce CLI output see this comment:
#2535 (comment)

[akalatksy]

downgrade node to 20.9.0 version

Or use --disable-warning DEP0040.
Probably not a solution to the punycode deprecation problem, but an alternative option to acheive the exact Expected result from OP problem (node-v21.0.0 without the warning).

The --disable-warning flag was added in node v21.3.0) and allows suppression of specific warnings.

PS. You can set this flag using the NODE_OPTIONS='--disable-warning DEP0040' environment varable.
While there may be a better or more correct way to configure this flag (I'd appreciate all the suggestions), but it worked perfectly for my needs: to remove this warning from the CI/CD logs.

[tggagne]

So is there an official fix coming for this or is there nothing sf cli can do here? At some point if we all stop upgrading node at v20.5.x, won't vscode or sf eventually require an upgrade?

[cristiand391]

@tggagne yes, we have 2 possible workarounds for this before node v22 gets promoted to LTS.

[nvuillam]

The warning is back :'(

[catalandres]

Does this have to do with having included Node v22 LTS in the binary packages starting this week?