Repository navigation
v5 DeprecationWarning: url.parse() behavior is not standardized #1370
Description
Activity
Hello @dgw, Thank you for creating this issue and we will look into it :)
Reacted by dgw@aparnajyothi-y
This issue also occurs on
actions/setup-node@v6Reacted by Tomasz CzubochaSee for instance CI
https://github.com/actions/setup-node/actions/workflows/e2e-cache.yml?query=branch%3Amain
with specific run on Dec 3, 2025, effectively using
v6.1.0(or to be more exact, commit 395ad32):https://github.com/actions/setup-node/actions/runs/19880934172/job/56978410828
Run ./ Found in cache @ /opt/hostedtoolcache/node/24.11.1/x64 (node:2118) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead. (Use `node --trace-deprecation ...` to show where the warning was created) Environment details /opt/hostedtoolcache/node/24.11.1/x64/bin/npm config get cache /home/runner/.npm Cache hit for: node-cache-Linux-x64-npm-fc6a90a4d4682787fc8a0805330d4f3cbebc702d043e527a005072a43e70ac12 (node:2118) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities. Received 670930 of 670930 (100.0%), 40.0 MBs/sec Cache Size: ~1 MB (670930 B) /usr/bin/tar -xf /home/runner/work/_temp/41967eea-48de-4006-a184-2ababd968d28/cache.tzst -P -C /home/runner/work/setup-node/setup-node --use-compress-program unzstd Cache restored successfully Cache restored from key: node-cache-Linux-x64-npm-fc6a90a4d4682787fc8a0805330d4f3cbebc702d043e527a005072a43e70ac12- This shows also v5+: DeprecationWarning: The
punycodemodule is deprecated #1364, in addition to[DEP0169] DeprecationWarning:
url.parse()behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued forurl.parse()vulnerabilities.
- This shows also v5+: DeprecationWarning: The
- See v5+: DeprecationWarning: The
punycodemodule is deprecated #1364 (comment) - Waiting for merge of PR Bump @actions/cache to v5.0.1 #1449
Reacted by dgw- See v5+: DeprecationWarning: The
This should be resolved in actions/setup-node@v6.2.0
@dgw - would you like to check?
Hello @dgw,
Thank you for bringing this to our attention.
We are pleased to inform you that this issue has been addressed in the latest release, actions/setup-node@v6.2.0. We have validated the behavior with this version and can confirm that the deprecation warning related to url.parse() no longer appears.
If you encounter any further issues or have additional feedback, please let us know. We appreciate your contribution to making this action better!
Thank you for your patience and support. Closing as resolved.
- added a commit that references this issue
on Sep 21, 2026
Description:
Somewhat similarly to #1364, this action reports a deprecation warning after upgrade to v5:
(node:1679) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.I checked the last run we had with a cache hit (from August 12) under v4, and it did not print this warning.
Action version:
v5tag, which as of the run (a few minutes ago) resolves to commit a0853c2Platform:
Runner type:
Tools version:
Repro steps:
Expected behavior:
Action quietly restores cache.
Actual behavior:
Action prints a deprecation warning (and then restores cache).
Log snippet:
Relevant runner log lines