Xud: DeprecationWarning on startup and CLI usage

[offerm]

Do we know what the reason for this is?

(node:55458) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

Complicated fix?

[sangaman]

This is from dependencies of ours and not xud code - we don't use any of those deprecated methods ourselves. Updating our dependencies might resolve this, I was thinking of doing so before our alpha release and maybe again before beta, and certainly before we attempt to support any version of node.js beyond 10. Closing as I don't think there's anything we can do about this for now.

[offerm]

@sangaman
Why close it?
Even if we don't handle now we should leave it open so we will remember it.
I also think it is a nice issue for any new team member to deal with.

Reopen.
@kilrau please decide when this should be done. Not sure exchanges will be happy with this security warning....

[michael1011]

We should just deal with this if we want to support Node.js v10 right now or in the near future. And I think we definitively should because according to the Node.js release schedule Node.js v10 will become Active LTS simultaneously to v8 in October 2018.

[sangaman]

From what I understand this is still supported in v10, and will only be dropped in a future release, so it doesn't interfere with v10 support I don't think. The deprecated code is in our generated proto files, so it's an issue with the proto generation dependencies.

I think it's probably the grpc-tools package that we need updated, they haven't published an npm release in roughly a year, although there's much newer releases on their github. I've previously commented on an issue asking for a new release and it sounds like they will eventually get around to it. In the meantime I suppose we can see if pointing to their latest release from github in package.json resolves this, but I'm fine with waiting for a release.

[kilrau]

Not pressing, but definitely keep this open, we'll revisit this in November once v10 is LTS and plans are clearer.

[michael1011]

I found a workaround in this issue:

sed -i -- 's/new Buffer(/Buffer.from(/g' lib/proto/*.js

It is quite hacky and sed doesn't exist on Windows but I wanted to let you know.