"Deprecation Warning: 'punycode' Module Used by Supabase SDK Dependency (whatwg-url)"

[NatashaJWangui]

Bug report

Describe the bug

When running my backend application with Supabase (@supabase/supabase-js), I am encountering a deprecation warning related to the punycode module. Despite not using punycode directly in my project, it appears to be a transitive dependency introduced by whatwg-url, which is a dependency of @supabase/node-fetch (used in @supabase/supabase-js).

To Reproduce

Steps to reproduce the behavior,

1. Install the @supabase/supabase-js package.
2. Start the server with the command: npm start.
3. Observe the following deprecation warning in the console:
   "(node:5452) [DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead."
4. Running with --trace-deprecation reveals that the warning originates from whatwg-url: "(node:9548) [DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead.
   at node:punycode:3:9
   at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:399:7)
   at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:338:10)
   at loadBuiltinModule (node:internal/modules/helpers:108:7)
   at Module._load (node:internal/modules/cjs/loader:1099:17)
   at TracingChannel.traceSync (node:diagnostics_channel:315:14)
   at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
   at Module.require (node:internal/modules/cjs/loader:1339:12)
   at require (node:internal/modules/helpers:135:16)
   at Object. (T:\Projects\enin-ltd\backend\node_modules\whatwg-url\lib\url-state-machine.js:2:18)"

Root Cause

• The warning is caused by the whatwg-url module (version 5.0.0) which internally relies on the deprecated punycode module.
• whatwg-url is a transitive dependency of @supabase/node-fetch, which is used by @supabase/supabase-js.

Steps Taken

• I have tried updating @supabase/supabase-js and @supabase/node-fetch, but the deprecation warning persists.
• I attempted installing punycode manually, but the warning continues.

Expected behavior

The deprecation warning should not appear, or @supabase/supabase-js should not depend on deprecated modules like punycode.

Screenshots

1. 

2. 

System information

• OS: [Windows]
• Node.js version: v22.8.0
• Supabase SDK version: @supabase/supabase-js@2.48.0
• Dependency tree showing whatwg-url and punycode :
  └─┬ @supabase/supabase-js@2.48.0
  └─┬ @supabase/node-fetch@2.6.15
  └── whatwg-url@5.0.0

[kevinzunigacuellar]

Thanks for reporting this issue. I believe it would be better addressed in the @supabase/node-fetch package, as whatwg-url is one of its dependencies.

[jtomaszewski]

FYI, there's a fix awaiting merge: supabase/node-fetch#9 .

[mandarini]

Hi @NatashaJWangui ! Thank you very much for opening this issue.

Let's move the discussion here: #914