Fixed the punycode deprecation warning #3194
Conversation
WalkthroughThis pull request addresses the deprecation of the Changes
Assessment against linked issues
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: .coderabbit.yaml ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
Our Pull Request Approval ProcessThanks for contributing! Testing Your CodeRemember, your PRs won't be reviewed until these criteria are met:
Our policies make our code better. ReviewersDo not assign reviewers. Our Queue Monitors will review your PR and assign them.
Reviewing Your CodeYour reviewer(s) will have the following roles:
CONTRIBUTING.mdRead our CONTRIBUTING.md file. Most importantly:
Other
|
There was a problem hiding this comment.
Actionable comments posted: 2
🔭 Outside diff range comments (1)
package.json (1)
Verified: patch-package changes are required, but testing library change should be separated
The patches directory contains legitimate punycode-related fixes for multiple dependencies (psl, tr46, whatwg-url). The addition of
patch-packageandpostinstallscript is necessary for applying these fixes. However, the addition of@testing-library/domappears unrelated to the punycode fix and should be moved to a separate PR.🔗 Analysis chain
Line range hint
1-185: Address pipeline security warningThe PR workflow indicates that
package.jsonis a sensitive file requiring special approval. While the changes appear necessary for the punycode fix:
- The
patch-packageaddition is required for applying patches- The
postinstallscript is needed for automatic patch application- The
@testing-library/domaddition seems unrelated and should be removedPlease request the 'ignore-sensitive-files-pr' label from maintainers after removing the unrelated changes.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Verify that patches exist and contain only punycode-related changes if [ -d "patches" ]; then echo "Checking patches directory for punycode-related changes..." grep -r "require('punycode')" patches/ grep -r "require(\"punycode\")" patches/ else echo "Error: patches directory not found. Please ensure patches are committed." fiLength of output: 491
🧰 Tools
🪛 GitHub Actions: PR Workflow
[error] Unauthorized modification or deletion of sensitive file. Apply 'ignore-sensitive-files-pr' label to override.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (4)
package.json(3 hunks)patches/psl+1.9.0.patch(1 hunks)patches/tr46+2.1.0.patch(1 hunks)patches/whatwg-url+8.7.0.patch(1 hunks)
✅ Files skipped from review due to trivial changes (3)
- patches/tr46+2.1.0.patch
- patches/whatwg-url+8.7.0.patch
- patches/psl+1.9.0.patch
🧰 Additional context used
🪛 GitHub Actions: PR Workflow
package.json
[error] Unauthorized modification or deletion of sensitive file. Apply 'ignore-sensitive-files-pr' label to override.
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Analyse Code With CodeQL (javascript)
🔇 Additional comments (1)
package.json (1)
97-97: Document patches in READMEThe postinstall script will apply patches automatically, but for transparency and maintainability, please document:
- Which modules are being patched
- What changes are being made
- When we can remove these patches (i.e., when upstream modules fix the punycode deprecation)
🧰 Tools
🪛 GitHub Actions: PR Workflow
[error] Unauthorized modification or deletion of sensitive file. Apply 'ignore-sensitive-files-pr' label to override.
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
There was a problem hiding this comment.
- This isn't a long term solution.
- If we upgrade any of these packages we'll have to update the patches. There is a real risk of instability. We have tried this before and failed. It is too brittle.
- How can we use the latest versions of these packages that don't use
punycodewhich has been deprecated? We'll need to use the best solution limited to editing justpackage.json, with minimal updates to the codebase. We need to reduce thepunycoderisk without risking app stability
Node suggest us that import But I checked the latest versions of packages of our app are still using const If we need to update our package we can just update and update our patch using these 3 steps only -
Also we should raise an issue on these modules repo, once the issue is fixed we can remove our patches. |
|
We'll have to close the PR and issue. This was not the intended outcome. This is the responsibility of the package owners |
|
@palisadoes I checked tr46 has updated the require statement, we can update at least those packages which are updated. |
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## develop-postgres #3194 +/- ##
=====================================================
+ Coverage 19.77% 89.81% +70.04%
=====================================================
Files 306 329 +23
Lines 7763 8526 +763
Branches 1690 1913 +223
=====================================================
+ Hits 1535 7658 +6123
+ Misses 6132 636 -5496
- Partials 96 232 +136 ☔ View full report in Codecov by Sentry. |
|
|
@palisadoes we need to close the issue for now, I checked our codebase, we are using old require statement 
In first tree In second tree |
What kind of change does this PR introduce?
This PR will fix the punycode deprecation warning by following these step,
punycodepackage is used in following sub_modules -But Node.js official documentation suggest to switch to using the userland-provided Punycode.js module instead in this way
So we updated this
requirestatements insub_modulesand created its patch usingpatch-packageand added apost-installscript to apply these patch after installing modules usingnpm installthis will override the default behaviour ofsub_modules.We will be using this patch, and in future until these
sub_modulesrefactor their code, once it is done we will removepatch-packageand thesepatches, also if required we can add morepatchfor any othersub_modulewhich may create this warning in future.Issue Number:
Fixes #2862
Did you add tests for your changes?
N/A
Snapshots/Videos:
If relevant, did you update the documentation?
N/A
Summary
Does this PR introduce a breaking change?
No
Other information
Have you read the contributing guide?
Yes
Summary by CodeRabbit
Dependencies
patch-packageto manage package modifications@testing-library/domdependencyScripts
postinstallscript to apply package patches automaticallyPatches
punycodemodule in multiple dependencies to improve module resolutionLinting
patches/directory from linting processes