Investigate DEP0005 Buffer() deprecation warnings in workflow jobs

[MariusStorhaug]

Workflow review for PR #210 on branch perf/install-improvements surfaced repeated Node.js deprecation warnings in CI logs during routine validation of module, docs, and site pipelines.

Request

Current experience

Multiple workflow jobs emit [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. during execution, including Build-Docs, Build-Site, Test-Module, and Lint-Module.

Desired experience

Workflow jobs complete without DEP0005 warnings by identifying and updating or reconfiguring the dependency/tool path that still invokes the deprecated Buffer() constructor.

User impact

Repeated deprecation output introduces noise in CI logs, obscures actionable failures, and indicates aging Node-based tooling that can become a future compatibility risk.

Acceptance criteria

• Source dependency/toolchain component that triggers DEP0005 is identified
• A remediation is selected and documented (upgrade, pin, replacement, or configuration change)
• Build-Docs, Build-Site, Test-Module, and Lint-Module jobs run without DEP0005 warnings
• Any version pins or workflow changes are documented with rationale

Evidence

• Warning text: [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues.
• Detected while reviewing PR 🚀 [Feature]: Install-GoogleFont is faster on repeats and bulk installs #210 on branch perf/install-improvements
• Observed in logs across multiple workflow jobs

Related references: Node.js DEP0005 deprecation, Node.js Buffer API guidance, GitHub Actions workflow syntax.

---

Technical decisions

Investigation scope: Start from workflow steps used by Build-Docs, Build-Site, Test-Module, and Lint-Module to map all Node-based actions and package executions.

Root-cause method: Enable targeted diagnostics (--trace-deprecation where feasible) in a temporary branch or reproduction run to capture stack context that points to the exact package/tool invoking Buffer().

Remediation priority: Prefer dependency/action upgrades first; if upstream is unpatched, apply short-term pinning or replacement with explicit tracking to remove temporary mitigations later.

Compatibility guardrails: Preserve current workflow behavior and required outputs while removing warning paths; avoid broad Node runtime shifts unless needed for a verified fix.

Validation strategy: Re-run affected workflows and confirm absence of DEP0005 lines in logs for all listed jobs before closing.

---

Implementation plan

Discovery

• Inventory Node-based actions and commands used in Build-Docs, Build-Site, Test-Module, and Lint-Module workflows
• Reproduce warning with diagnostic tracing to capture call-site/package origin
• Document exact dependency/tool and version responsible for DEP0005

Remediation

• Evaluate upgrade path for affected action/package and choose safest fix
• Apply workflow/package updates (or temporary pin/replacement if no direct fix exists)
• Record rationale for chosen mitigation in issue/PR notes

Verification

• Execute affected workflow jobs after remediation
• Confirm logs are free of DEP0005 warnings in Build-Docs, Build-Site, Test-Module, and Lint-Module
• Add follow-up tracking task if temporary mitigation is required