Skip to content

Resolve Node.js Buffer() deprecation warning (DEP0005) in workflow runs #331

@MariusStorhaug

Description

Context

During PR review of PSModule/NerdFonts#67, the following deprecation warning was detected in CI workflow logs across multiple jobs (Test-Module and Lint-Module on all three platforms — Linux, macOS, Windows):

(node:PID) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues.
Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

This warning originates from the Node.js runtime used by GitHub Actions infrastructure — likely from a dependency of one of the reusable workflows or actions referenced by the Process-PSModule workflow. Since this affects all repositories consuming the shared workflow, the issue belongs here rather than in individual consumer repos.

Impact

Currently a warning only (no functional impact). However, Buffer() without new is a known security concern (potential uninitialized memory exposure) and may eventually become a hard error in future Node.js versions used by GitHub Actions runners.

Investigation needed

  • Identify which specific action or tool triggers the Buffer() call (use node --trace-deprecation if possible)
  • Check if updating pinned action versions resolves the warning
  • The warning appeared in Test-Module and Lint-Module job steps specifically

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions