Bug: [DEP0040] Deprecation warning: punycode module deprecated on Node.js 22+

[homelab-alpha]

📑 I have found these related issues/pull requests

I have checked, but couldn't find anything similar.

🛡️ Security Policy

• I have read and agree to Uptime Kuma's Security Policy.

📝 Description

On startup, Uptime Kuma emits a [DEP0040] deprecation warning because one or more dependencies still import Node.js's built-in punycode module. This module became a runtime deprecation in Node.js v21+ and will eventually be removed from Node.js entirely.

screencast (click to expand)

👟 Reproduction steps

1. Run Uptime Kuma 2.3.0 on Node.js 22+
2. Observe the startup logs

👀 Expected behavior

No deprecation warnings on startup.

😓 Actual Behavior

The following warning is emitted on every startup:

(node:7) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

References:

• Node.js DEP0040
• Punycode Deprecated Notice

🐻 Uptime-Kuma Version

2.3.0

💻 Operating System and Arch

Ubuntu Server 24.04.4 LTS (GNU/Linux 6.8.0-110-generic x86_64)

🌐 Browser

Brave 1.89.145 - Chromium: 147.0.7727.137 (Official Build) (64-bit)

🖥️ Deployment Environment

• Runtime Environment:
  • Docker: Version 26.1.0 (Build 9714adc)
  • Docker Compose: Version 2.26.1
  • Portainer (BE): Version 2.39.1 (LTS: Yes)
  • MariaDB: Version 12.2.2 (LTS: Yes)
• Database:
  • MariaDB: External
• Database Storage:
  • Filesystem:
    • Linux: ext4
  • Storage Medium: SSD
• Uptime Kuma Setup:
  • Number of monitors: 99

📝 Relevant log output

01-05-2026 07:49:13 Welcome to Uptime Kuma
01-05-2026 07:49:13 Your Node.js version: 22.22.2
01-05-2026 07:49:13 2026-05-01T07:49:13+02:00 [SERVER] INFO: Env: production
01-05-2026 07:49:13 2026-05-01T07:49:13+02:00 [SERVER] INFO: Uptime Kuma Version: 2.3.0
01-05-2026 07:49:13 2026-05-01T07:49:13+02:00 [SERVER] INFO: Loading modules
01-05-2026 07:49:15 2026-05-01T07:49:15+02:00 [SERVER] INFO: Creating express and socket.io instance
01-05-2026 07:49:15 2026-05-01T07:49:15+02:00 [SERVER] INFO: Server Type: HTTP
01-05-2026 07:49:15 2026-05-01T07:49:15+02:00 [SERVER] INFO: Data Dir: ./data/
01-05-2026 07:49:15 2026-05-01T07:49:15+02:00 [DB] INFO: Database Type: mariadb
01-05-2026 07:49:15 (node:7) [DEP0040] DeprecationWarning: The `punycode` module is
                    deprecated. Please use a userland alternative instead.
01-05-2026 07:49:15 (Use `node --trace-deprecation ...` to show where the warning was created)
01-05-2026 07:49:15 2026-05-01T07:49:15+02:00 [SERVER] INFO: Connected to the database
01-05-2026 07:49:15 2026-05-01T07:49:15+02:00 [SERVER] INFO: Listening on:
01-05-2026 07:49:15 2026-05-01T07:49:15+02:00 [SERVER] INFO: -  http://localhost:3001
01-05-2026 07:49:15 2026-05-01T07:49:15+02:00 [SERVER] INFO: -  http://172.19.4.2:3001
01-05-2026 07:49:15 2026-05-01T07:49:15+02:00 [SERVER] INFO: -  http://172.20.4.3:3001

[louislam]

Should be coming from an upstream dependency.

Not sure why my current PC's Node.js 25 doesn't throw this warning. Probably need someone to trace it by node --trace-deprecation, as suggested by the warning message. And see if the dependency is upgradable.

[corysell]

I'm seeing this as well, and I ran --trace-deprecation for you as a variable. Let me know if this works or if you need anything else!

Welcome to Uptime Kuma
Your Node.js version: 22.22.2
2026-05-04T08:02:11-05:00 [SERVER] INFO: Env: production
2026-05-04T08:02:12-05:00 [SERVER] INFO: Uptime Kuma Version: 2.3.2
2026-05-04T08:02:12-05:00 [SERVER] INFO: Loading modules
2026-05-04T08:02:14-05:00 [SERVER] INFO: Creating express and socket.io instance
2026-05-04T08:02:14-05:00 [SERVER] INFO: Server Type: HTTP
2026-05-04T08:02:14-05:00 [SERVER] INFO: Data Dir: ./data/
2026-05-04T08:02:14-05:00 [DB] INFO: Database Type: sqlite
2026-05-04T08:02:14-05:00 [DB] INFO: Using single connection for SQLite
(node:7) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
    at node:punycode:7:10
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:400:7)
    at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:338:10)
    at loadBuiltinModule (node:internal/modules/helpers:121:7)
    at loadBuiltinWithHooks (node:internal/modules/cjs/loader:1154:15)
    at Function._load (node:internal/modules/cjs/loader:1228:20)
    at TracingChannel.traceSync (node:diagnostics_channel:328:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:237:24)
    at Module.require (node:internal/modules/cjs/loader:1463:12)
    at require (node:internal/modules/helpers:147:16)
2026-05-04T08:02:14-05:00 [SERVER] INFO: Connected to the database

EDIT:

Figured I'd pull this, since the stack trace looks a bit weak.

root@server:~# docker exec UptimeKuma grep -r "require('punycode')\|require(\"punycode\")" /app/node_modules --include="*.js" -l

/app/node_modules/mongodb-connection-string-url/node_modules/tr46/index.js
/app/node_modules/mqtt/dist/mqtt.js
/app/node_modules/node-fetch/node_modules/tr46/index.js
/app/node_modules/node-fetch/node_modules/whatwg-url/lib/url-state-machine.js

root@server:~# docker exec UptimeKuma grep -E '"name"|"version"' /app/node_modules/mongodb-connection-string-url/node_modules/tr46/package.json
  "name": "tr46",
  "version": "3.0.0",
root@server:~# docker exec UptimeKuma grep -E '"name"|"version"' /app/node_modules/mqtt/package.json
  "name": "mqtt",
  "version": "4.3.8",
root@server:~# docker exec UptimeKuma grep -E '"name"|"version"' /app/node_modules/node-fetch/node_modules/tr46/package.json
  "name": "tr46",
  "version": "0.0.3",
root@server:~# docker exec UptimeKuma grep -E '"name"|"version"' /app/node_modules/node-fetch/node_modules/whatwg-url/package.json
  "name": "whatwg-url",
  "version": "5.0.0",

Not sure if any of this is helpful, but I don't mind helping out.

[louislam]

Thanks @corysell, I added breakpoints on these require() line. Found it stopped at both tough-cookie and mongodb-connection-string-url (probably sub-dependency of mongodb).

Both packages have newer versions, but both of them introduced some breaking changes, so it required some efforts to test/fix after update.