@actions/artifact: [DEP0005] DeprecationWarning caused when used in @actions/download-artifact
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5.9k
- Forks
- 1.8k
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
@actions/artifact causes a Node.js DEP0005 deprecation warning in @actions/download-artifact
(node:2042) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Usenode --trace-deprecation ...to show where the warning was created)
To Reproduce
View logs of https://github.com/actions/download-artifact/actions/workflows/test.yml?query=branch%3Amain
Select the most recent run
- Build (ubuntu-latest)
- Job
Download artifact A
Scroll down toDEP0005
- Job
Note DEP0005 deprecation warning.
To Debug
Add the following to https://github.com/actions/download-artifact/actions/workflows/test.yml and run:
env:
NODE_OPTIONS: --trace-deprecation
(node:2063) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
at showFlaggedDeprecation (node:buffer:191:11)
at new Buffer (node:buffer:269:3)
at new UnzipStream (/home/runner/work/download-artifact/download-artifact/dist/index.js:110127:17)
at new Extract (/home/runner/work/download-artifact/download-artifact/dist/index.js:109833:24)
at Object.Extract (/home/runner/work/download-artifact/download-artifact/dist/index.js:109828:12)
at /home/runner/work/download-artifact/download-artifact/dist/index.js:2240:46
at new Promise (<anonymous>)
at /home/runner/work/download-artifact/download-artifact/dist/index.js:2221:16
at Generator.next (<anonymous>)
at fulfilled (/home/runner/work/download-artifact/download-artifact/dist/index.js:2150:58)
Add the following to https://github.com/actions/toolkit/blob/main/.github/workflows/artifact-tests.yml and run:
env:
NODE_OPTIONS: "--pending-deprecation --trace-deprecation"
(node:2215) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
at showFlaggedDeprecation (node:buffer:191:11)
at new Buffer (node:buffer:269:3)
at new UnzipStream (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/unzip-stream.js:47:17)
at new Extract (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/extract.js:15:24)
at Object.Extract (/home/runner/work/toolkit/toolkit/packages/artifact/node_modules/unzip-stream/lib/extract.js:10:12)
at /home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:118:46
at new Promise (<anonymous>)
at /home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:99:16
at Generator.next (<anonymous>)
at fulfilled (/home/runner/work/toolkit/toolkit/packages/artifact/lib/internal/download/download-artifact.js:28:58)
Expected behavior
Using @actions/artifact should not cause a Node.js DEP0005 deprecation warning to be displayed when used in a GitHub JavaScript Action such as @actions/download-artifact
Additional context
- This is related to issue https://github.com/actions/download-artifact/issues/381
This repo uses
https://github.com/actions/toolkit/blob/930c89072712a3aac52d74b23338f00bb0cfcb24/packages/artifact/package.json#L54
$ npm ls unzip-stream
@actions/artifact@2.3.3
└── unzip-stream@0.3.4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with packages/artifact/lib/internal/download/download-artifact.js and packages/artifact/package.json, then inspect the unzip-stream dependency that creates the Buffer() warning. Run the artifact workflow with NODE_OPTIONS set to --pending-deprecation --trace-deprecation to reproduce it. Done means the artifact tests and download-artifact workflow no longer emit DEP0005.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100