punycode deprecation warning in NodeJS v21

[felixfbecker]

@mergeapi/merge-node-client depends on an outdated version of node-fetch (2.7.0, latest is 3.3.2), which depends on an outdated version of whatwg-url (5.0.0, latest is 14), which depends on punycode, which is deprecated in Node 21 and will be removed in a future version.

This triggers the following deprecation warning at every start:

(node:50865) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.

FYI fetch() is also natively available as a global (and stable) since Node 18, which uses the undici implementation under the hood, which is also available on NPM: https://www.npmjs.com/package/undici
It has zero dependencies.

[dsinghvi]

@felixfbecker thanks for filing this issue, we'll report back on what we can do here. For context we depend on node-fetch because we publish a CJS package and node-fetch only publishes an esm version.

[felixfbecker]

@dsinghvi afaik undici (the fetch client shipped by NodeJS) is published as CJS: https://www.npmjs.com/package/undici?activeTab=code

But fetch has also been available unflagged natively in NodeJS since Node 18 (behind a flag since 16.5), so all maintained Node versions are supporting it without any dependency. What is the lowest Node version Merge supports?

[dsinghvi]

Merge supports Node 18 and above