What is the current behavior?

yarn uses deprecated new Buffer() constructor and causes deprecation warnings when run with NODE_PENDING_DEPRECATION=1.

$ ag '\bBuffer\(' src/registries/npm-registry.js 340: const pw = new Buffer(String(password), 'base64').toString(); 341: return 'Basic ' + new Buffer(String(username) + ':' + pw).toString('base64'); src/util/fs.js 835:const cr = new Buffer('\r', 'utf8')[0]; 836:const lf = new Buffer('\n', 'utf8')[0]; 

What is the expected behavior?

yarn should not use deprecated/unsafe Buffer constructor. According to the deprecation warning new Buffer() should be replaced with one of Buffer.alloc(), Buffer.allocUnsafe() or Buffer.from(); the safe-buffer package is another option.

Please mention your node.js, yarn and operating system version.

$ node -v v8.9.4 $ yarn -v 1.5.1 $ uname -a Linux 4.15.6-300.fc27.x86_64 #1 SMP Mon Feb 26 18:43:03 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux