[pablotransifex]

Fixes #235.

Problem

@transifex/native uses cross-fetch, which on Node uses node-fetch@2. That pulls in whatwg-url@5 and tr46, and tr46 calls require("punycode"), Node's deprecated core module. The Node build bundles this chain and keeps punycode external, so dist/node.native.js loads the core module and Node prints:

[DEP0040] DeprecationWarning: The `punycode` module is deprecated.

Users see this:

• on Node 21 and 22.0–22.12 (the reporter used 22.8.0), for any install;
• on any Node version, including 24, when an app bundles the package into its own server build (webpack, Next.js and similar), because the code then runs from outside node_modules;
• under Jest on the Node versions above.

Fix

The Node build now bundles the userland punycode package instead of loading the core module. It is the same library that Node's core module was made from, with the same API. Webpack decides which modules are Node built-ins from the request name, before any alias or replacement runs. So the config now declares Node built-ins as externals itself, the same way target: 'node' does, minus punycode. punycode is a devDependency because it is bundled.

Nothing else changes. node-fetch and cross-fetch are still used, so code that mocks requests with nock keeps working. I first tried loading cross-fetch from node_modules instead of bundling it, but Node 21 to 22.12 still warn in that case. Switching to Node's built-in fetch would break nock 13 for anyone mocking Transifex requests, so I left that for a major version.

Verification

Build output compared with a build of master:

• browser.native.js and node.native.d.ts are byte-identical, so React Native and browser users are unaffected.
• In node.native.js, the source maps show one change: external "punycode" is replaced by the bundled punycode.es6.js (+2.4 KB). Every other module and external is the same.
• The published file list and package.json are unchanged apart from devDependencies.

Smoke tests against the packed tarball, installed fresh in a separate project, on Node 16, 18, 20, 21, 22.0.0, 22.8.0, 22.12.0, 22 (latest), 23 and 24, for both master and this branch. All checks pass on every version for both builds:

• language and translation fetches, including polling while the server returns 202;
• pushSource with job polling;
• Authorization and SDK headers;
• an HTTP 403 error surfacing as HTTP 403: forbidden;
• fetchTimeout aborting a request that never answers;
• nock interception;
• an internationalized cdsHost (bücher…) resolving to its punycode form;
• importing the package as an ES module.

DEP0040 on Node 21 and 22.0–22.12: printed by master, not by this branch.

Scenario	master	this branch
App bundled with webpack, Node 22.8.0 and 24	DEP0040 printed	no warning
Jest + nock consumer, Node 22.8.0	DEP0040 printed	no warning

Other checks:

• The package's own test suite passes (61) and lint is clean.
• The express, i18next, react, vue2 and vue3 suites pass against the new build, as does the CLI (53 tests with the new node.native.js).
• node-fetch uses Node's own URL when it exists, so the whatwg-url/punycode code is loaded but not called at runtime on supported Node versions. Even so, the userland toASCII/toUnicode give the same output as Node's core module on a set of internationalized domain names.