Yarn: Buffer DeprecationWarning with Node v10.1.0

Created on 10 May 2018 · 6Comments · Source: yarnpkg/yarn

Versions:

λ ver
Microsoft Windows [Version 10.0.16299.431]

λ node -v
v10.1.0



md5-c579d5119ba41fa49c3066aef5884769



λ yarn -v
1.6.0



md5-7b7bf0cb79670a29b918cacdd5df5c81



λ yarn
yarn install v1.6.0
(node:2444) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
[1/5] Validating package.json...
[2/5] Resolving packages...
success Already up-to-date.
Done in 0.61s.



md5-c579d5119ba41fa49c3066aef5884769



λ set NODE_OPTIONS=--trace-warnings



md5-c579d5119ba41fa49c3066aef5884769



λ yarn
yarn install v1.6.0
(node:760) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
    at showFlaggedDeprecation (buffer.js:159:11)
    at new Buffer (buffer.js:174:3)
    at Object.<anonymous> (C:\Program Files (x86)\Yarn\lib\cli.js:146012:18)
    at __webpack_require__ (C:\Program Files (x86)\Yarn\lib\cli.js:22:30)
    at Object.<anonymous> (C:\Program Files (x86)\Yarn\lib\cli.js:76874:16)    at __webpack_require__ (C:\Program Files (x86)\Yarn\lib\cli.js:22:30)
    at Object.module.exports.gf (C:\Program Files (x86)\Yarn\lib\cli.js:45967:11)
    at __webpack_require__ (C:\Program Files (x86)\Yarn\lib\cli.js:22:30)
    at Object.module.exports.Object.defineProperty.value (C:\Program Files (x86)\Yarn\lib\cli.js:41400:11)
    at __webpack_require__ (C:\Program Files (x86)\Yarn\lib\cli.js:22:30)
[1/5] Validating package.json...
[2/5] Resolving packages...
success Already up-to-date.
Done in 0.59s.

triaged

Source

MarkTiedemann

👍3

Most helpful comment

Warning is still present in v1.7.0:

yarn outdated v1.7.0
(node:8576) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

alexdevero on 24 May 2018

👍4

All 6 comments

Line cli.js:146012 contains the following code var END_OF_TAR = new Buffer(1024), which is part of the tar-stream module.

Luckily, tar-stream has already fixed this issue in v1.6.0 "no deprecation on 10".

EDIT: And it seems like, on master, yarn is already using the latest tar-stream version"tar-stream": "^1.6.0". So I guess this issue can be closed.

MarkTiedemann on 10 May 2018

🎉1

@MarkTiedemann awesome! So this will be fixed into next release of yarn, right?
I saw in package.json there's already [email protected] 👍

filipposarzana on 10 May 2018

👍1

Hey, thanks for reporting this.

We are aware and addressing these issues. This has been partially fixed by https://github.com/yarnpkg/yarn/pull/5752 And will be fully addressed by https://github.com/yarnpkg/yarn/issues/5477

Closing this in favor of the aforementioned issue.

imsnif on 10 May 2018

🎉1

Warning is still present in v1.7.0:

yarn outdated v1.7.0
(node:8576) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

alexdevero on 24 May 2018

👍4

@alexdevero True, you may get the DeprecationWarning in quite a few cases: When searching for new Buffer in C:\Program Files (x86)\Yarn\lib\cli.js, there are still 143 hits where this warning might occur. I think we need some patience until all of them are slowly, but surely upgraded. 🙂

MarkTiedemann on 24 May 2018

👍2

I currently have this issue at node v12.13.1

yarn outdated
yarn outdated v1.7.0
(node:4039) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
    at showFlaggedDeprecation (buffer.js:174:11)
    at new Buffer (buffer.js:257:3)
    at Object.<anonymous> (/home/suther/.yarn/lib/cli.js:4105:6)
    at __webpack_require__ (/home/suther/.yarn/lib/cli.js:22:30)
    at Object.<anonymous> (/home/suther/.yarn/lib/cli.js:4228:12)
    at __webpack_require__ (/home/suther/.yarn/lib/cli.js:22:30)
    at Object.<anonymous> (/home/suther/.yarn/lib/cli.js:56449:11)
    at __webpack_require__ (/home/suther/.yarn/lib/cli.js:22:30)
    at Object.<anonymous> (/home/suther/.yarn/lib/cli.js:43234:13)
    at __webpack_require__ (/home/suther/.yarn/lib/cli.js:22:30)
Done in 2.27s.

At Line 4105 I have this:

I figured out, that an upgrade of yarn solved this.
Before I had Version 1.7.0, then I run: curl --compressed -o- -L https://yarnpkg.com/install.sh | bash
yarn 1.19.1 was installed, and yarn work again without the Warning-Message