ci: trace DEP0005 Buffer deprecation in artifact download path #2118

Activity

1. seonghobae commented on Sep 12, 2026

   

   seonghobae

   on Sep 12, 2026

   Last edited by seonghobae

   ContributorAuthor

   More actions

   RCA correction and bounded reproduction:

   • Git tags confirm pinned 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c is both v8 and v8.0.1, the latest upstream release observed. The earlier suggestion to upgrade to a later release is withdrawn: no such verified consumer upgrade candidate exists.
   • The lockfile path is unzip-stream@0.3.4 → binary@0.3.0 → buffers@0.1.1. A diagnostic copy extracted only the self-contained Buffers module; it did not execute the action entrypoint, network calls, token handling, or installed runtime.
   • Under Node v24.16.0 with --trace-deprecation, an in-memory splice/slice fixture reproduces DEP0005 at Buffers.slice. Replacing numeric constructors with Buffer.alloc and the string constructor with Buffer.from in that diagnostic copy preserves splice, cross-buffer slice, and empty-slice outputs and emits no DEP0005. The original reproduction remains runnable with --original.
   • This proves a concrete deprecated-call path in the dependency. It does not prove that this was the exact call executed in the original CI capture; that capture has no stack trace. Conditional proxy-auth and other parser constructors remain separate candidates.

   Next owner action: trace the real artifact-download warning with deprecation stacks, repair the identified upstream source dependency and rebuild the action distribution, then adopt a reviewed immutable release and rerun the original artifact download/integrity validation. Do not patch generated dist in the consumer or suppress diagnostics. The issue remains unresolved, with the existing 2026-09-13 investigation/review target retained.
2. seonghobae commented on Sep 12, 2026

   

   seonghobae

   on Sep 12, 2026

   ContributorAuthor

   More actions

   The same fast-mlsirm #1818 coverage run 34621596364 / check 103336781298 repeated Node [DEP0005] Buffer() at 2026-09-11T16:22:53.0448505Z. This is a recurrence in the captured diagnostic lane; it does not identify the exact artifact-download callsite. Preserve the existing request for stack-traced artifact-download reproduction and upstream dependency repair; do not suppress the warning.
3. seonghobae

   added

   maintenance

   priority: mediumNormal-priority or P2 workNormal-priority or P2 work

   on Sep 12, 2026
4. seonghobae commented on Sep 13, 2026

   

   seonghobae

   on Sep 13, 2026

   ContributorAuthor

   More actions

   Investigation-date check (2026-09-13), consumer side — no suppression, no change to the pinned action:

   • Upstream already tracks this exact warning, four ways: v8 emits Node DEP0005 Buffer() deprecation warning on every download actions/download-artifact#484 (open, "v8 emits Node DEP0005 Buffer() deprecation warning on every download"), chore(deps): bump google-cloud-bigquery from 3.42.0 to 3.42.1 #327 and fix(opencode-review): cap context + fail fast to stop org-wide review hang #381 (open, older reports), and @actions/artifact: [DEP0005] DeprecationWarning caused when used in @actions/download-artifact actions/toolkit#2003 (open, @actions/artifact is the emitter when used by download-artifact). Root cause matches the RCA above: unzip-stream@0.3.4 → binary@0.3.0 → buffers@0.1.1; buffers calls new Buffer(...) in Buffers.slice/splice (visible in the pinned dist/index.js at ~L16638-16643, 15 new Buffer( sites total).
   • No consumer upgrade exists today. npm: @actions/artifact latest is 6.2.1 and still depends on unzip-stream; unzip-stream latest is still 0.3.4 depending on binary ^0.3.0; binary and buffers were last modified 2022-11-11 (unmaintained). actions/download-artifact latest release is v8.0.1 = the SHA we pin. So the repair has to land in @actions/artifact (replace unzip-stream, or vendor a Buffer.from-based fork), then in a download-artifact release, before any pin bump here can remove the warning.
   • Separate compliance angle worth an owner look: [@actions/artifact] Transitive dependency buffers has no declared license actions/toolkit#2392 reports that the same transitive buffers package declares no license. CWL's permissive-license convention (docs/CWL-MASTER-CONTEXT.md §7) is about what we add; this is a transitive dependency of a GitHub-owned action we consume, but it should be recorded rather than discovered later.

   Next: subscribe-and-adopt — re-check actions/toolkit#2003 / download-artifact#484 for a released fix, then bump the pin in exact-artifact-sbom-attestation.yml (2 sites), opencode-review-dispatch.yml (1 site) and the two contract tests that pin the SHA, and re-run an artifact-download lane with NODE_OPTIONS=--trace-deprecation to confirm zero DEP0005. Internal next review date: 2026-09-27 (two weeks; no release cadence signal upstream yet). Kept open; not resolved.