Node 22

[trombonekenny]

For funsies, I upgraded node in my container and ran master against it. It seemed to load OK, with a warning about punycode:

bash-5.2# node --version
v22.10.0
bash-5.2# make dev
[nodemon] 3.1.4
[nodemon] to restart at any time, enter `rs`
[nodemon] watching path(s): *.*
[nodemon] watching extensions: js,ts,json,sql
[nodemon] starting `yarn dev:no-watch`
(node:357540) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
    at node:punycode:3:9
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:399:7)
    at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:338:10)
    at loadBuiltinModule (node:internal/modules/helpers:114:7)
    at Function._load (node:internal/modules/cjs/loader:1100:17)
    at TracingChannel.traceSync (node:diagnostics_channel:315:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:218:24)
    at Module.<anonymous> (node:internal/modules/cjs/loader:1340:12)
    at Hook._require.Module.require (/PrairieLearn/node_modules/require-in-the-middle/index.js:188:39)
    at require (node:internal/modules/helpers:141:16) {
  code: 'DEP0040'
}
info: PrairieLearn server ready, press Control-C to quit
info: Go to https://localhost:443
^C[nodemon] still waiting for 9 sub-processes to finish...
make: *** [Makefile:22: dev] Error 130

bash-5.2# npm ls punycode
prairielearn@ /PrairieLearn
+-- @prairielearn/prairielearn@1.0.0 -> ./apps/prairielearn
| +-- fetch-cookie@3.0.1
| | `-- tough-cookie@4.1.4
| |   `-- punycode@2.3.1
| +-- jsdom@25.0.0
| | `-- whatwg-url@14.0.0
| |   `-- tr46@5.0.0
| |     `-- punycode@2.3.1 deduped
| `-- oauth-signature@1.5.0
|   `-- uri-js@3.0.2
|     `-- punycode@2.3.1 deduped
`-- eslint@8.57.0
  `-- ajv@6.12.6
    `-- uri-js@4.4.1
      `-- punycode@2.3.1 deduped

As Node 22 transitions into ACTIVE and more dependencies update to use it, this might be easily available to us. But there's no rush. Node 20 stays in MAINTENANCE mode until mid-2026.

[nwalters512]

npm ls punycode shows us the dependencies that are doing the right thing (using the userland alternative published to npm). Here's a more relevant command:

$ grep -E "(require|import).*punycode" --exclude "*.map" --exclude "*.min.js" --exclude "*.md" --exclude "*.d.ts" --exclude "*.html" -r node_modules
node_modules/gaxios/node_modules/whatwg-url/lib/url-state-machine.js:const punycode = require("punycode");
node_modules/psl/dist/psl.js:var Punycode = require('punycode');
node_modules/psl/index.js:var Punycode = require('punycode');
node_modules/whatwg-url/node_modules/tr46/index.js:const punycode = require("punycode/");
node_modules/oauth-signature/node_modules/uri-js/dist/esnext/schemes/mailto.js:import punycode from "punycode";
node_modules/oauth-signature/node_modules/uri-js/dist/esnext/uri.js:import punycode from "punycode";
node_modules/oauth-signature/node_modules/uri-js/src/schemes/mailto.ts:import punycode from "punycode";
node_modules/oauth-signature/node_modules/uri-js/src/uri.ts:import punycode from "punycode";
node_modules/core-js/modules/web.url.constructor.js:var toASCII = require('../internals/string-punycode-to-ascii');
node_modules/tr46/index.js:var punycode = require("punycode");
node_modules/uri-js/dist/esnext/schemes/mailto.js:import punycode from "punycode";
node_modules/uri-js/dist/esnext/uri.js:import punycode from "punycode";
node_modules/tough-cookie/lib/cookie.js:const punycode = require("punycode/");
node_modules/htmlhint/node_modules/whatwg-url/lib/url-state-machine.js:const punycode = require("punycode");
node_modules/openai/node_modules/whatwg-url/lib/url-state-machine.js:const punycode = require("punycode");
Binary file node_modules/@esbuild/darwin-arm64/bin/esbuild matches

Based on some manual investigation, there are at least two main blockers here:

• gaxios, a dependency of google-auth-library that uses an outdated version of node-fetch. This will be fixed by feat!: Upgrade to node-fetch v3 googleapis/gaxios#617, which is slated to be released soon: chore(main): release 7.0.0 googleapis/gaxios#657. We'll then have to wait for that to be consumed by google-auth-library.
• openai, which also uses an outdated version of node-fetch. There's an issue tracking this here: Node 22: DeprecationWarning: The punycode module is deprecated. openai/openai-node#1148. Switch from node-fetch to undici openai/openai-node#402 was opened to resolve this, but was closed based on "imminent plans to migrate to built-in fetch. There's no tracking issue for those imminent plans.

[mwest1066]

I see that Node 23 is now the "current" release: https://nodejs.org/en/about/previous-releases

Is it possible to jump straight to 23?

[nwalters512]

I'd need to hear a strong argument for why we should run a non-LTS version in prod.

[mwest1066]

Is it possible to jump straight to 23?

I'd need to hear a strong argument for why we should run a non-LTS version in prod.

Nevermind! I misread something elsewhere and thought that node had changed to doing LTS for every major release, not just the even-numbered ones, but this is not the case.

[nwalters512]

As of nodejs/node#56632, Node no longer emits deprecation warnings for punycode when it's loaded from node_modules. This was backported to Node in 22.14.0. I think we're now unblocked!

[trombonekenny]

Running 22.15.0 on my test container and everything seems OK so far.

[nwalters512]

Yep, Matt and I have been using 22 locally for some time now with no issues. We'll likely upgrade the container and prod this summer 🎉