Skip to content

Investigate DEP0005 Buffer() deprecation warnings in workflow jobs #213

@MariusStorhaug

Description

Workflow review for PR #210 on branch perf/install-improvements surfaced repeated Node.js deprecation warnings in CI logs during routine validation of module, docs, and site pipelines.

Request

Current experience

Multiple workflow jobs emit [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. during execution, including Build-Docs, Build-Site, Test-Module, and Lint-Module.

Desired experience

Workflow jobs complete without DEP0005 warnings by identifying and updating or reconfiguring the dependency/tool path that still invokes the deprecated Buffer() constructor.

User impact

Repeated deprecation output introduces noise in CI logs, obscures actionable failures, and indicates aging Node-based tooling that can become a future compatibility risk.

Acceptance criteria

  • Source dependency/toolchain component that triggers DEP0005 is identified
  • A remediation is selected and documented (upgrade, pin, replacement, or configuration change)
  • Build-Docs, Build-Site, Test-Module, and Lint-Module jobs run without DEP0005 warnings
  • Any version pins or workflow changes are documented with rationale

Evidence

Related references: Node.js DEP0005 deprecation, Node.js Buffer API guidance, GitHub Actions workflow syntax.


Technical decisions

Investigation scope: Start from workflow steps used by Build-Docs, Build-Site, Test-Module, and Lint-Module to map all Node-based actions and package executions.

Root-cause method: Enable targeted diagnostics (--trace-deprecation where feasible) in a temporary branch or reproduction run to capture stack context that points to the exact package/tool invoking Buffer().

Remediation priority: Prefer dependency/action upgrades first; if upstream is unpatched, apply short-term pinning or replacement with explicit tracking to remove temporary mitigations later.

Compatibility guardrails: Preserve current workflow behavior and required outputs while removing warning paths; avoid broad Node runtime shifts unless needed for a verified fix.

Validation strategy: Re-run affected workflows and confirm absence of DEP0005 lines in logs for all listed jobs before closing.


Implementation plan

Discovery

  • Inventory Node-based actions and commands used in Build-Docs, Build-Site, Test-Module, and Lint-Module workflows
  • Reproduce warning with diagnostic tracing to capture call-site/package origin
  • Document exact dependency/tool and version responsible for DEP0005

Remediation

  • Evaluate upgrade path for affected action/package and choose safest fix
  • Apply workflow/package updates (or temporary pin/replacement if no direct fix exists)
  • Record rationale for chosen mitigation in issue/PR notes

Verification

  • Execute affected workflow jobs after remediation
  • Confirm logs are free of DEP0005 warnings in Build-Docs, Build-Site, Test-Module, and Lint-Module
  • Add follow-up tracking task if temporary mitigation is required

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions