"new Buffer() is deprecated" issue after compile with ncc

[dungwinux]

After running ncc (powered by webpack), the output would include new Buffer(), which is deprecated since Node v10. As a result, Wafter would print warning out as error when starting server.

MIRAI Wafter 1.15.0+local
Copyright (c) 2018-2019 Vườn ươm A0. MIT License.
√ How can I help you ? · Start server
(node:3944) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

Wafter needs to either install polyfill or try to replace new Buffer() after running ncc.

[minhducsun2002]

How about stopping using the constructor syntax altogether? After all, using it poses security risks.

If you wish to replace all new Buffer() calls, there is an ESLint rule for that - no-buffer-constructor.

[dungwinux]

@minhducsun2002, the problem is, new Buffer() is a result after compiling using ncc.

[minhducsun2002]

This should be reported to the ncc maintainers themselves.

[dungwinux]

Well, this is rather the result of using Webpack. Perhaps some modules has new Buffer() and Webpack has added all of those into code.

[dungwinux]

Regarding this, --zero-fill-buffers can be used to avoid the warning.
Update: command line invoke

pkg --options zero-fill-buffers -o dist/wafter .

Edit: This one doesn't work at all

[minhducsun2002]

Try this : webpack/webpack#4240 (comment)

[minhducsun2002]

Actually, the option above seems to be the solution for modules whose developers stepped away. We cannot control our (indirect) dependencies, and thus it seems to be the only way around this warning.

See this article.

[dungwinux]

@minhducsun2002, ncc design goal is to have zero configuration, meaning there's noway you can configure the webpack bundled inside.