[DEP0005] DeprecationWarning: Buffer() is deprecated

[jpogran]

Hey @BlackDark / @jpogran - I've been tracking an annoying deprecation warning I've been seeing in the https://github.com/hashicorp/setup-terraform GitHub Action recently.

(node:1617) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

This is actually seen in the opening screenshot 😄.

Tracking this back, it's been this change that's cause the message:

• Inclusion of proxy-agent package.
• This in-turn uses pac-proxy-agent
• This in-turn uses get-uri.
• This in-turn uses ftp (phew!)
• The (very old) ftp package makes use of new Buffer(): FIXED: use Buffer.from(string) instead of Buffer(string) mscdex/node-ftp#230

Got there!

I wonder if there is an alternative to the proxy-agent package?

Originally posted by @magnetikonline in #11 (comment)

[magnetikonline]

Thanks @jpogran I figure there are two ways forward here:

• Make an attempt to get that ftp package PR merged and new release cut. Then update everything in the chain.
• Consider an alternative package that can handle HTTP_PROXY, something like https://github.com/gajus/global-agent might be a contender?

[magnetikonline]

Hey @jpogran - was able to deliver a fix here: #43

Basically swapping out the proxy-agent package with the child https-proxy-agent package. Achieves the same result, but removes much of the package chain - including the offending ftp package.

With this in place - can then bump js-releases within https://github.com/hashicorp/setup-terraform as a next/final step 👍