Replace use of deprecated/unsafe new Buffer constructor

[ghost]

What is the current behavior?

yarn uses deprecated new Buffer() constructor and causes deprecation warnings when run with NODE_PENDING_DEPRECATION=1.

$ ag '\bBuffer\('
src/registries/npm-registry.js
340:        const pw = new Buffer(String(password), 'base64').toString();
341:        return 'Basic ' + new Buffer(String(username) + ':' + pw).toString('base64');

src/util/fs.js
835:const cr = new Buffer('\r', 'utf8')[0];
836:const lf = new Buffer('\n', 'utf8')[0];

What is the expected behavior?

yarn should not use deprecated/unsafe Buffer constructor. According to the deprecation warning new Buffer() should be replaced with one of Buffer.alloc(), Buffer.allocUnsafe() or Buffer.from(); the safe-buffer package is another option.

Please mention your node.js, yarn and operating system version.

$ node -v
v8.9.4

$ yarn -v
1.5.1

$ uname -a
Linux 4.15.6-300.fc27.x86_64 #1 SMP Mon Feb 26 18:43:03 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

[malonehedges]

Getting this same warning on macOS. I believe #5704 is a duplicate of this.

[felixrabe]

As a workaround for now, I've created a ~/bin/node script that comes before (Homebrew-installed) /usr/local/bin/node in my $PATH:

#!/bin/bash

/usr/local/bin/node --no-deprecation "$@"

[marvinhagemeister]

FYI: Just went through yarn's dependencies and there are two which still call new Buffer():

• tar-stream (fixed, but we still depend on an older version)
• v8-compile-cache (not fixed)

We will likely need to update those.

[jacobq]

@vrobinson Yes, they should be fixed by #6208 -- You can see this by searching the standalone JS for new Buffer and observing that it only appears in fallbacks and comments. Have patience 😸

Update: Looks like it just landed 🎉 so watch for the next nightly. To everyone who helped make this happen, 🙇‍♂️ thank you 🙏!

[rof20004]

I got this error, was this solved?

[jacobq]

@rof20004 ☝️(right above your comment). PR has merged, so it is now "fixed" on the master branch of the source code. However, you'll continue to see this warning with Node 10 until (1) a new version is released and (2) you upgrade to that version.

[rof20004]

@jacobq I am using debian package, I need to wait until the new package then '-'.

Thanks :)

[jacobq]

@rof20004 You should be able to start using it tomorrow, if you want, just make sure you have apt pointing to the nightly:
https://yarnpkg.com/en/docs/install#debian-nightly

[damianobarbati]

@jacobq so we're going to see this finally issue finally resolved once for all with yarn@1.9.5, correct?

[arcanis]

Probably won't be a patch release, more like 1.10

[josuedjh3]

I have the same problem.
$ yarn install
node:39) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead. error An unexpected error occurred: "https://registry.yarnpkg.com/axios/-/axios-0.18.0.tgz: getaddrinfo EADDRNOTAVAIL registry.yarnpkg.com registry.yarnpkg.com:443". info If you think this is a bug, please open a bug report with the information provided in "/app/yarn-error.log". info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.
/app $ node -v v10.10.0 /app $ yarn -v 1.9.4 /app $

[josuedjh3]

someone has the solution?

[kbd]

@codestart123 read the thread, they said it's fixed in nightly but not released yet.

[jacobq]

@codestart123 The error you mentioned is not caused by this issue (you can ignore the deprecation warning):

error An unexpected error occurred: "https://registry.yarnpkg.com/axios/-/axios-0.18.0.tgz: getaddrinfo EADDRNOTAVAIL registry.yarnpkg.com registry.yarnpkg.com:443"

EADDRNOTAVAIL is a network-related error (error: address not available). Try running ping registry.yarnpkg.com to confirm that your system can resolve the name and reach the host.

[RyanZhu1024]

Has it been fixed yet?

[wopian]

@RyanZhu1024 it was fixed in 1.10.0, released a few days ago 👍

[iofu728]

Waiting node upgrade yarn version.

[vladshcherbin]

Can't believe this annoying warning is finally gone. Thank you :)

Hooraaaay 🙌 🎉 🍾

[Esqarrouth]

I have a similar problem here, any ideas: https://stackoverflow.com/questions/53201124/how-to-find-source-of-a-problem-inside-a-npm-package-node36378-dep0005-dep

[jacobq]

@goktugyil The question you linked does not make any mention of yarn. If you are using yarn, please make sure you have the latest version (currently 1.12.3). If you are not using yarn please do not cross-post here. StackOverflow is a good place for asking general programming questions, and https://github.com/nodejs/help is a good place to go for Node questions. https://github.com/yarnpkg/yarn/issues is for feature requests and problems related to yarn (not for general development support/questions).

@arcanis / @BYK / @imsnif Would you mind locking this thread? This problem has been fixed in yarn and its dependencies for a while now, and I don't think further discussion here will benefit anyone.