Faulty NPM upload 2.7.0

[spetrac-nicos-ag]

I have noticed a deprecation warning for punycode and searched for the problem.

The problem was with whatwg-url v5 and regarding issue #1794 this is already known. The pull request #1795 addresses this issue and updates the dependency of whatwg-url from v5 to v14.

The change list of the pull request does indeed reflect the correct change:

    "name": "node-fetch",
    "version": "2.6.7",

    "dependencies": {
        "whatwg-url": "^5.0.0"
    },

    "name": "node-fetch",
    "version": "2.7.0",

    "dependencies": {
        "whatwg-url": "^14.0.0"
    },

But when I actually install node-fetch v2.7.0 via npm or look at the code on npmjs.com there is still the previous dependency to whatwg-url v5:

    "name": "node-fetch",
    "version": "2.7.0",

    "dependencies": {
        "whatwg-url": "^5.0.0"
    },

This means that the issue #1794 is not resolved with the currently available version of node-fetch v2!

[jimmywarting]

Did you read #1793 (comment) ?

We never merged that pr so nothing where ever uploaded to npm

[spetrac-nicos-ag]

whatwg-url v12.x does no longer use punycode, but it also requires node >= 14 which might not be enough for you.

The problem is, I am not using node-fetch directly or else I would upgrade to version 3. The jsonld-context-parser which is used by the comunica framework requires the cross-fetch module. cross-fetch has a dependency to node-fetch v2.x to remain backwards compatibility and implement polyfill options.

I will definitely raise an issue for cross-fetch and link it to this issue. Maybe they can do something to improve the problem.

[coderaiser]

Could you please get rid of punycode in CommonJS version of node-fetch? It crashes on node v21: