Warning in Node v22: DeprecationWarning: The punycode module is deprecated.

[michaelbromley]

Describe the bug
When running a Vendure server instance with Node v22+, you will see the following warning logged:

(node:37868) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

Running with the --trace-deprecation flag yields:

❯ node --trace-deprecation ./dist/index.js
(node:36144) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
    at node:punycode:3:9
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:399:7)
    at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:338:10)
    at loadBuiltinModule (node:internal/modules/helpers:108:7)
    at Module._load (node:internal/modules/cjs/loader:1099:17)
    at TracingChannel.traceSync (node:diagnostics_channel:315:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
    at Module.require (node:internal/modules/cjs/loader:1339:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (C:\Development\temp\vendure-create-test-01\node_modules\whatwg-url\lib\url-state-machine.js:2:18)

We can see that the issue originates in the whatwg-url package, which is a dependency of node-fetch v2.x, which in turn is a dependency of several packages used in Vendure core packages:

That version of whatwg-url which imports the deprecated punycode module is outdated. Newer versions have removed that.

However, only the v3.x of node-fetch has updated to the newer whatwg-url version.

Why node-fetch v2.x?

The latest version of node-fetch is v3.3.2, and it does not use this outdated version of whatwg-url. So why don't packages just update to the latest node-fetch?

Basically because v3.x of node-fetch is ESM only. This has knock-on implications for any project that depends on it:

• Update node-fetch apollographql/apollo-server#7885

So right now there's no clear way around this warning in Node v22 until our upstream dependencies figure out how to deal with it.

Environment (please complete the following information):

• @vendure/core version: 3.0.4
• Nodejs version: 22
• Database (mysql/postgres etc): any