actions / actions/toolkit

@actions/artifact: [DEP0005] DeprecationWarning caused when used in @actions/download-artifact

Open
#2,003 9 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
5.9k
Forks
1.8k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

@actions/artifact causes a Node.js DEP0005 deprecation warning in @actions/download-artifact

(node:2042) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use node --trace-deprecation ... to show where the warning was created)

To Reproduce

View logs of https://github.com/actions/download-artifact/actions/workflows/test.yml?query=branch%3Amain

Select the most recent run

  • Build (ubuntu-latest)
    • Job Download artifact A
      Scroll down to DEP0005

Note DEP0005 deprecation warning.

To Debug

Add the following to https://github.com/actions/download-artifact/actions/workflows/test.yml and run:

env:
  NODE_OPTIONS: --trace-deprecation
(node:2063) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
    at showFlaggedDeprecation (node:buffer:191:11)
    at new Buffer (node:buffer:269:3)
    at new UnzipStream (/home/runner/work/download-artifact/download-artifact/dist/index.js:110127:17)
    at new Extract (/home/runner/work/download-artifact/download-artifact/dist/index.js:109833:24)
    at Object.Extract (/home/runner/work/download-artifact/download-artifact/dist/index.js:109828:12)
    at /home/runner/work/download-artifact/download-artifact/dist/index.js:2240:46
    at new Promise (<anonymous>)
    at /home/runner/work/download-artifact/download-artifact/dist/index.js:2221:16
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/download-artifact/download-artifact/dist/index.js:2150:58)

Add the following to https://github.com/actions/toolkit/blob/main/.github/workflows/artifact-tests.yml and run:

env:
  NODE_OPTIONS: "--pending-deprecation --trace-deprecation"
(node:2215) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
    at showFlaggedDeprecation (node:buffer:191:11)
    at new Buffer (node:buffer:269:3)
    at new UnzipStream (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/unzip-stream.js:47:17)
    at new Extract (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/extract.js:15:24)
    at Object.Extract (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/extract.js:10:12)
    at /home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:118:46
    at new Promise (<anonymous>)
    at /home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:99:16
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:28:58)

Expected behavior

Using @actions/artifact should not cause a Node.js DEP0005 deprecation warning to be displayed when used in a GitHub JavaScript Action such as @actions/download-artifact

Additional context

This repo uses
https://github.com/actions/toolkit/blob/930c89072712a3aac52d74b23338f00bb0cfcb24/packages/artifact/package.json#L54

$ npm ls unzip-stream
@actions/artifact@2.3.3
└── unzip-stream@0.3.4

https://www.npmjs.com/package/unzip-stream

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with packages/artifact/lib/internal/download/download-artifact.js and packages/artifact/package.json, then inspect the unzip-stream dependency that creates the Buffer() warning. Run the artifact workflow with NODE_OPTIONS set to --pending-deprecation --trace-deprecation to reproduce it. Done means the artifact tests and download-artifact workflow no longer emit DEP0005.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript
Domain
devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.