# Node "punycode module is deprecated" DEP0040 Warning - Fix in CI

> Fix the Node "[DEP0040] The punycode module is deprecated" warning in CI - noisy on Node 21+ from a transitive dependency. Trace the dependency or silence the deprecation deliberately.

Source: https://latchkey.dev/learn/node-js/npm-punycode-deprecation-warning  
Updated: 2026-06-25

Node 21+ emits `[DEP0040] The punycode module is deprecated` when a dependency imports the built-in `punycode`. It is a warning, not an error - but it clutters CI logs and, with `--throw-deprecation`, can fail a step.

## Diagnose it: which registry, and with what credentials?

Registry errors are resolved in a precedence chain, and the effective value is rarely the one in the file you are looking at. Scoped registries, `.npmrc` files at several levels, and environment variables all combine before a request is made.

```Terminal
# the effective, fully merged configuration
npm config list -l | grep -E "registry|_auth|always-auth"

# where each value came from
npm config get registry
npm config get @yourscope:registry

# prove the token works, independently of the install
curl -sI -H "Authorization: Bearer $NPM_TOKEN" \
  "$(npm config get registry)@yourscope%2fpackage" | head -1
```

> A private package 404s rather than 401s when the token lacks read access, because the registry will not confirm that a package you cannot see exists. Treat an unexpected 404 on a private scope as an auth problem, not a missing package.

## FAQ

### What causes Node "punycode module is deprecated" DEP0040 warning?

There are 2 common causes: a transitive dependency imports the built-in punycode and a strict deprecation flag turns it fatal. An older library still requires Node’s deprecated punycode builtin.

### How do I fix Node "punycode module is deprecated" DEP0040 warning?

There are 2 fixes depending on which cause you have: trace and upgrade the source dependency and silence intentionally if you cannot upgrade yet. Work through them in order, since the first is the most common.

### What does Node "punycode module is deprecated" DEP0040 warning actually mean?

CI logs show (node:NNN) [DEP0040] DeprecationWarning: The punycode module is deprecated.

### How do I stop Node "punycode module is deprecated" DEP0040 warning happening again?

Upgrade dependencies that import deprecated builtins. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt