Node DeprecationWarning in azure/webapps-deploy@v3

[YusukeTobo]

The following 3 deprecation alerts happen during this action. Could you please fix them?

Run azure/webapps-deploy@v3
(node:1954) [DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead.
at node:punycode:7:10
at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:398:7)
at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:337:10)
at loadBuiltinModule (node:internal/modules/helpers:126:7)
at loadBuiltinWithHooks (node:internal/modules/cjs/loader:1222:15)
at Module._load (node:internal/modules/cjs/loader:1313:48)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at Module.require (node:internal/modules/cjs/loader:1576:12)
at require (node:internal/modules/helpers:153:16)
at 24876 (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:112111:18)
(node:1954) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
at showFlaggedDeprecation (node:buffer:222:11)
at new Buffer (node:buffer:305:3)
at 94908 (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:21398:10)
at nccwpck_require (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:116074:43)
at 73380 (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:21726:17)
at nccwpck_require (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:116074:43)
at 47544 (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:22581:20)
at nccwpck_require (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:116074:43)
at 41622 (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:111749:31)
at nccwpck_require (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:116074:43)
(node:1954) [DEP0169] DeprecationWarning: url.parse() behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for url.parse() vulnerabilities.
at Object.urlParse [as parse] (node:url:136:13)
at HttpClient. (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:74907:33)
at Generator.next ()
at /home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:74716:71
at new Promise ()
at webpack_modules.96184.__awaiter (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:74712:12)
at HttpClient.request (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:74903:16)
at WebClient. (/home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:19123:51)
at Generator.next ()
at /home/runner/work/_actions/azure/webapps-deploy/v3/dist/index.js:19067:71

[BOLT04]

I see the same warnings, this would be amazing to get fixed 👍

[OzBob]

David Pereira (@BOLT04) does the latest v3.0.8 address your issue?

duplicate of #537

[BOLT04]

ahh interesting OzBob , is v3 the latest and stable GA? I got confused since all docs use v2 and latest release is v2 too

[kumaraksh1]

Hi David Pereira (@BOLT04),
v3 is the latest and stable GA.

We are supporting v2 also so any change/bug fix is done in both that's why you are able to see latest release of v2.

And thank you for your feedback, we will update the required docs.

[BOLT04]

thanks for your responses 👍

David Pereira (@BOLT04) does the latest v3.0.8 address your issue?

nope, unfortunately it doesn't OzBob I used the SHA pinning, but it's still v3.0.8:

Run azure/webapps-deploy@02a81bead70021f5284939794bcec79c271ab383
(node:4139) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
(node:4139) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(node:4139) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.

[kumaraksh1]

Thanks for reporting this. We reproduced the warnings with azure/webapps-deploy@v3.0.8 on Node.js 24.

The warnings originate from transitive dependencies bundled with this action:

DEP0040 (punycode) through the @actions/github dependency chain.
DEP0005 (Buffer()) through the compression libraries used by azure-actions-utility.
DEP0169 (url.parse()) through azure-actions-webclient and typed-rest-client.

Fixing these completely requires updates in the respective upstream/shared dependencies first. We will track or raise the necessary requests with their maintainers, then update the dependency versions in webapps-deploy and publish a new release.

These are deprecation warnings and should not affect deployment functionality. No workflow changes are required from users at this time. We will keep this issue open and provide updates as the upstream fixes become available.