Getting `punycode` deprecation error on new custom plugins when run via `bin/dev.js`

[pchittum]

Note
Before you submit your issue, make sure that:

• You're using the latest version of Salesforce CLI.
  Yes
• You've searched both open and closed issues for related posts.
  Yes
• You've used the doctor command to diagnose common issues.
  Can I run that when it's a new unlinked plugin?
• You understand that GitHub Issues don't adhere to any agreement or SLA.
  Yes
  • If you require immediate assistance, use official channels such as Salesforce Customer Support.

Summary

When attempting to create a new plugin and testing it using bin/dev.js, there is a deprecation warning on the punycode module.

Steps To Reproduce

I followed the process for creating a new plugin, updated node, updated the cli, installed yarn and typescript.

Then I created the new plugin, no problems.

I went to test it and immediately I received the deprecation warning stack trace. I did some searching and found that in some instances, downgrading the node version removed the error. So I tried that and it worked. When I switch back to the latest node version 22.13.1, the error returns.

Here's the output to the console:

pchittum at UNKNOWN in ~/projects/sf-plugins/hello-plugin on main ✗                                                         19:07
> bin/dev.js hello world 
DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
    at node:punycode:3:9
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:399:7)
    at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:338:10)
    at loadBuiltinModule (node:internal/modules/helpers:110:7)
    at Function._load (node:internal/modules/cjs/loader:1095:17)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
    at Module.require (node:internal/modules/cjs/loader:1335:12)
    at require (node:internal/modules/helpers:136:16)
    at Object.<anonymous> (/Users/pchittum/projects/sf-plugins/hello-plugin/node_modules/whatwg-url/lib/url-state-machine.js:2:18)
Hello World at Mon Feb 03 2025.
pchittum at UNKNOWN in ~/projects/sf-plugins/hello-plugin on main ✗                                                         19:07
> nvm install v20.10.0
Downloading and installing node v20.10.0...
Downloading https://nodejs.org/dist/v20.10.0/node-v20.10.0-darwin-arm64.tar.xz...
########################################################################################################################### 100.0%
Computing checksum with sha256sum
Checksums matched!
Now using node v20.10.0 (npm v10.2.3)
pchittum at UNKNOWN in ~/projects/sf-plugins/hello-plugin on main ✗                                                         19:10
> bin/dev.js hello world 
Hello World at Mon Feb 03 2025.

IMPORTANT
Provide a repository that's configured to reproduce the issue. If you are unable to provide a repo, please explain why not. The more info we have from the start, the faster we can resolve your issue.
We may close your issue if you don't include proper instructions.

• Generate a project with sf project generate or fork dreamhouse-lwc.
• Provide detailed step-by-step instructions on how to reproduce the issue.

Tip

use sf doctor --create-issue to automatically fill the required information

Expected result

running bin/dev.js would work without a stack trace

Actual result

I got a stack trace

Additional information

See console output above

System Information

zsh

{
  "architecture": "darwin-arm64",
  "cliVersion": "@salesforce/cli/2.74.6",
  "nodeVersion": "node-v22.12.0",
  "osVersion": "Darwin 24.2.0",
  "rootPath": "/Users/pchittum/.local/share/sf/client/2.74.6-02685ea",
  "shell": "zsh",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 3.2.18 (core)",
    "@oclif/plugin-commands 4.1.17 (core)",
    "@oclif/plugin-help 6.2.22 (core)",
    "@oclif/plugin-not-found 3.2.37 (core)",
    "@oclif/plugin-plugins 5.4.26 (core)",
    "@oclif/plugin-search 1.2.19 (core)",
    "@oclif/plugin-update 4.6.26 (core)",
    "@oclif/plugin-version 2.2.20 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.31 (core)",
    "@oclif/plugin-which 3.2.26 (core)",
    "@salesforce/cli 2.74.6 (core)",
    "apex 3.6.8 (core)",
    "api 1.3.3 (core)",
    "auth 3.6.87 (core)",
    "data 4.0.1 (core)",
    "deploy-retrieve 3.17.7 (core)",
    "dev 2.5.1 (user) published 76 days ago (Tue Nov 19 2024)",
    "env 3.0.34 (user) published 78 days ago (Sun Nov 17 2024)",
    "info 3.4.32 (core)",
    "lightning-dev 2.10.1 (user) published 2 days ago (Sat Feb 01 2025) (latest is 1.10.0)",
    "limits 3.3.44 (core)",
    "marketplace 1.3.7 (core)",
    "org 5.2.23 (core)",
    "packaging 2.9.12 (core)",
    "schema 3.3.46 (core)",
    "settings 2.4.10 (core)",
    "sobject 1.4.49 (core)",
    "telemetry 3.6.29 (core)",
    "templates 56.3.35 (core)",
    "trust 3.7.55 (core)",
    "user 3.6.6 (core)"
  ]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[cristiand391]

it's a deep dependency that comes via jsforce-node > node-fetch v2 > whatwg-url (and I think some other place).

There's no easy way to remove it b/c jsforce is locked to node-fetch v2 for now, see:
jsforce/jsforce#1580

The current workaround is to disable that warning by passing --disable-warning=DEP0040 to node in the bin dev/run file (or --no-deprecation on node < 22).

The cool part:
node recently restricted the warning to code outside node_modules, it's already in node v23 and should be backported to v22:
jsforce/jsforce#1580 (comment)

[pchittum]

Just so I understand you. On the first line of bin/dev.js I would need to edit it so that it looked like this:

#!/usr/bin/env -S node --loader ts-node/esm --no-warnings=ExperimentalWarning --no-deprecation
// eslint-disable-next-line node/shebang
async function main() {
  const { execute } = await import('@oclif/core');
  await execute({ development: true, dir: import.meta.url });
}

await main();

Or add the same to bin/run.js?

FYI, I tried the --disable-warning=DEP0040 flag and still got the stack trace. If you have any thoughts as to why or if I did it wrong, I'd rather the more specific exception block rather than the nuclear option, but I can live with it.

My first line looked like this, in that instance:

#!/usr/bin/env -S node --loader ts-node/esm --no-warnings=ExperimentalWarning --disable-warning=DEP0040

Thanks!

[cristiand391]

hey, sorry for the late reply.

I played a bit more and can confirm --disable-warning=DEP0040 doesn't work on bin/dev (tbh I have NODE_OPTIONS=--disable-warning=DEP0040 in my zshrc and thought it was working for bin/dev but seems to only work for bin/run).

My guess is that it's something with the ts-node/esm loader because --disable-warning=DEP0040 does work with bin/run. These two changes should work for you on node >= 21 to remove the warning:

latest node v23 already disabled this warning so we are waiting for the fix to be backported to node 22.