From 68fcb5f7520690ad287621eb728d17f7988fe695 Mon Sep 17 00:00:00 2001
From: Daniel Weinberger <dweinber@users.noreply.github.com>
Date: Wed, 29 Apr 2026 11:25:10 +0200
Subject: [PATCH] Drop deprecated punycode dependency via whatwg-url override
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every CLI invocation printed:
  DeprecationWarning: The `punycode` module is deprecated.

Traced to the SDK's transitive chain:
  @bitmovin/api-sdk → isomorphic-fetch → node-fetch@2 → whatwg-url@5
                                                       → tr46@0.0.3
Both whatwg-url@5 and tr46@0.0.3 do `require("punycode")` without the
trailing slash, which Node resolves to the deprecated builtin.

Add an npm override pinning whatwg-url to ^14.0.0. whatwg-url@14
pulls in tr46@5+ which uses `require("punycode/")` (forcing the
userland package and silencing the warning). The SDK does not call
into whatwg-url APIs directly — it only loads it transitively for
URL parsing inside node-fetch — so the major-version bump is safe.

Verified: SDK still talks to the API, all 108 tests still pass, no
DEP0040 warning on any CLI invocation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 package-lock.json | 41 ++++++++++++++++++++++++++---------------
 package.json      |  3 +++
 2 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 26f6b5b..237b771 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -36,7 +36,7 @@
         "vitest": "^4.1.2"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/@aws-crypto/crc32": {
@@ -8946,7 +8946,6 @@
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
       "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -9421,10 +9420,16 @@
       }
     },
     "node_modules/tr46": {
-      "version": "0.0.3",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
-      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
-      "license": "MIT"
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
+      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
+      "license": "MIT",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/ts-api-utils": {
       "version": "2.5.0",
@@ -9783,10 +9788,13 @@
       }
     },
     "node_modules/webidl-conversions": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
-      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
-      "license": "BSD-2-Clause"
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      }
     },
     "node_modules/whatwg-fetch": {
       "version": "3.6.20",
@@ -9795,13 +9803,16 @@
       "license": "MIT"
     },
     "node_modules/whatwg-url": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
-      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "version": "14.2.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
+      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
       "license": "MIT",
       "dependencies": {
-        "tr46": "~0.0.3",
-        "webidl-conversions": "^3.0.0"
+        "tr46": "^5.1.0",
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/which": {
diff --git a/package.json b/package.json
index f730b11..c890063 100644
--- a/package.json
+++ b/package.json
@@ -149,5 +149,8 @@
         "description": "Account information"
       }
     }
+  },
+  "overrides": {
+    "whatwg-url": "^14.0.0"
   }
 }