Repository: octokit/webhooks.js (ts)

Issue:
Only accept string payloads for `webhooks.verify()` and `webhooks.verifyAndReceive()`
**What’s missing?**

We have recurring problems with some event payloads where the code returns a "signature does not match" error, mostly reported by Probot users who are probably the biggest share of users of `@octokit/webhooks`.

I think we should stop making assumptions about how a JSON payload is stringified by GitHub and only accept the raw request string, as all other webhooks SDKs do that I know of, e.g. [`stripe`](https://github.com/stripe/stripe-node#webhook-signing)

I'd consider passing the raw request body string as a best practice today, and we enforce best practices in the @octokit modules.

The challenge that this will bring is that the raw request body is not always easily accessible by server frameworks or serverless environments, so we should document how to do it with e.g. `express`, AWS Lambda, Vercel, Begin, Azure Functions, Google Cloud Functions, Cloudflare Workers, and invite users to add examples for other platforms.

**Alternatives you tried**

n/a

[BUG]: dependabot_alert events fail to verify
### What happened?

## Observed Behavior

I noticed that `webhooks.verify()` returns false for dependabot_alert events, but only for this event type. All other events verify successfully.

To reproduce, I created a small script:

```ts
import { Webhooks } from '@octokit/webhooks'

const webhooks = new Webhooks({ secret: 'redacted' })

const check_run_event = {
  sign: "sha256=redacted", // from the X-Hub-Signature-256 header of the check_run event
  data: { /* copied a check_run event payload from the App Settings */ }
}
const dependabot_alert_event = {
  sign: "sha256=redacted", // from the X-Hub-Signature-256 header of the dependabot_alert event
  data: { /* copied a dependabot_alert event payload from the App Settings */ }
}

await webhooks.verify(dependabot_alert_event.data, dependabot_alert_event.sign)
// -> false

await webhooks.verify(check_run_event.data, check_run_event.sign)
// -> true
```

## Expected Behavior

Given that other events verify successfully, I would've expected that the dependabot_alert event also verifies successfully.

## Note

I'm unsure if this is a bug of @octokit/webhooks, or maybe even a miscalculation of the `X-Hub-Signature-256` header coming from GitHub-Hookshot. In case it really seems to be an issue of Github-Hookshot, where can I report this?

I'm aware that the dependabot_alert event is still in beta.

### Versions

@octokit/webhooks v10.3.1

### Relevant log output

```shell
No logs are printed
```


### Code of Conduct

- [X] I agree to follow this project's Code of Conduct
Modify `package.json` fields for ESM and browser builds best practices
> Should we change the current value of the `module` field to point to `dist-src/` and add a new `browser` field that points to `dist-web/` ?
> 
> This would alleviate issues like [octokit/auth-app.js#59](https://github.com/octokit/auth-app.js/issues/59) until work on `octokit-next` is finished
> 
> ```diff
> diff --git a/scripts/build.mjs b/scripts/build.mjs
> index 3ef8688..73d9ef9 100644
> --- a/scripts/build.mjs
> +++ b/scripts/build.mjs
> @@ -72,9 +71,9 @@ async function main() {
>          ...pkg,
>          files: ["dist-*/**", "bin/**"],
>          main: "dist-node/index.js",
> -        module: "dist-web/index.js",
> +        browser: "dist-web/index.js",
>          types: "dist-src/index.d.ts",
> -        source: "dist-src/index.js",
> +        module: "dist-src/index.js",
>        },
> ```

I would do that in a separate PR (feel free to create a new issue mentioning this comment) so we do not add more things on top of this migration. I think it's good the differences are minimum in this PR. What do you think?

_Originally posted by @oscard0m in https://github.com/octokit/webhooks.js/pull/819#issuecomment-1498924723_

Pull request:
feat: v11
Fixes #589, fixes #775, fixes #828

### Breaking changes
* middleware only and (always) handles requests at `path`
* Only accept string payloads for `webhooks.verify()` and `webhooks.verifyAndReceive()` and `webhooks.sign()`
* The middleware now expects only string payloads for `request.body`
* Modifies the `module` field in `package.json` to point to the source ESM, and adds a `browser` field that points to the browser bundle

Patch:
diff --git a/README.md b/README.md
index d121977..ca7b462 100644
--- a/README.md
+++ b/README.md
@@ -162,7 +162,7 @@ webhooks.sign(eventPayload);
           eventPayload
         </code>
         <em>
-          (Object)
+          (String)
         </em>
       </td>
       <td>
@@ -556,12 +556,19 @@ const webhooks = new Webhooks({
   secret: "mysecret",
 });
 
-const middleware = createNodeMiddleware(webhooks, { path: "/" });
-
-createServer(middleware).listen(3000);
-// can now receive user authorization callbacks at POST /
+const middleware = createNodeMiddleware(webhooks, { path: "/webhooks" });
+createServer(async (req, res) => {
+  // `middleware` returns `false` when `req` is unhandled (beyond `/webhooks`)
+  if (await middleware(req, res)) return;
+  res.writeHead(404);
+  res.end();
+}).listen(3000);
+// can now receive user authorization callbacks at POST /webhooks
 ```
 
+The middleware returned from `createNodeMiddleware` can also serve as an
+`Express.js` middleware directly.
+
 <table width="100%">
   <tbody valign="top">
     <tr>
@@ -597,32 +604,6 @@ createServer(middleware).listen(3000);
 
 Used for internal logging. Defaults to [`console`](https://developer.mozilla.org/en-US/docs/Web/API/console) with `debug` and `info` doing nothing.
 
-</td>
-    </tr>
-    <tr>
-      <td>
-        <code>onUnhandledRequest (deprecated)</code>
-        <em>
-          function
-        </em>
-      </td>
-      <td>
-
-Defaults to
-
-```js
-function onUnhandledRequest(request, response) {
-  response.writeHead(400, {
-    "content-type": "application/json",
-  });
-  response.end(
-    JSON.stringify({
-      error: error.message,
-    })
-  );
-}
-```
-
 </td>
     </tr>
   <tbody>
diff --git a/scripts/build.mjs b/scripts/build.mjs
index ca60721..05e2e17 100644
--- a/scripts/build.mjs
+++ b/scripts/build.mjs
@@ -74,9 +74,9 @@ async function main() {
         ...pkg,
         files: ["dist-*/**", "bin/**"],
         main: "dist-node/index.js",
-        module: "dist-web/index.js",
+        browser: "dist-web/index.js",
         types: "dist-types/index.d.ts",
-        source: "dist-src/index.js",
+        module: "dist-src/index.js",
         sideEffects: false,
       },
       null,
diff --git a/src/index.ts b/src/index.ts
index 45c27cf..e6c6215 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,7 +1,6 @@
 import { createLogger } from "./createLogger";
 import { createEventHandler } from "./event-handler/index";
-import { sign } from "./sign";
-import { verify } from "./verify";
+import { sign, verify } from "@octokit/webhooks-methods";
 import { verifyAndReceive } from "./verify-and-receive";
 import type {
   EmitterWebhookEvent,
@@ -13,27 +12,15 @@ import type {
   WebhookError,
   WebhookEventHandlerError,
   EmitterWebhookEventWithStringPayloadAndSignature,
-  EmitterWebhookEventWithSignature,
 } from "./types";
 
 export { createNodeMiddleware } from "./middleware/node/index";
 export { emitterEventNames } from "./generated/webhook-names";
 
-export type Iverify = {
-  /** @deprecated Passing a JSON payload object to `verify()` is deprecated and the functionality will be removed in a future release of `@octokit/webhooks`. */
-  (eventPayload: object, signature: string): Promise<boolean>;
-  (eventPayload: string, signature: string): Promise<boolean>;
-};
-export type IverifyAndReceive = {
-  /** @deprecated Passing a JSON payload object to `verifyAndReceive()` is deprecated and the functionality will be removed in a future release of `@octokit/webhooks`. */
-  (options: EmitterWebhookEventWithSignature): Promise<void>;
-  (options: EmitterWebhookEventWithStringPayloadAndSignature): Promise<void>;
-};
-
 // U holds the return value of `transform` function in Options
 class Webhooks<TTransformed = unknown> {
-  public sign: (payload: string | object) => Promise<string>;
-  public verify: Iverify;
+  public sign: (payload: string) => Promise<string>;
+  public verify: (eventPayload: string, signature: string) => Promise<boolean>;
   public on: <E extends EmitterWebhookEventName>(
     event: E | E[],
     callback: HandlerFunction<E, TTransformed>
@@ -45,7 +32,9 @@ class Webhooks<TTransformed = unknown> {
     callback: RemoveHandlerFunction<E, TTransformed>
   ) => void;
   public receive: (event: EmitterWebhookEvent) => Promise<void>;
-  public verifyAndReceive: IverifyAndReceive;
+  public verifyAndReceive: (
+    options: EmitterWebhookEventWithStringPayloadAndSignature
+  ) => Promise<void>;
 
   constructor(options: Options<TTransformed> & { secret: string }) {
     if (!options || !options.secret) {
@@ -60,31 +49,13 @@ class Webhooks<TTransformed = unknown> {
     };
 
     this.sign = sign.bind(null, options.secret);
-    this.verify = (eventPayload: object | string, signature: string) => {
-      if (typeof eventPayload === "object") {
-        console.warn(
-          "[@octokit/webhooks] Passing a JSON payload object to `verify()` is deprecated and the functionality will be removed in a future release of `@octokit/webhooks`"
-        );
-      }
-      return verify(options.secret, eventPayload, signature);
-    };
+    this.verify = verify.bind(null, options.secret);
     this.on = state.eventHandler.on;
     this.onAny = state.eventHandler.onAny;
     this.onError = state.eventHandler.onError;
     this.removeListener = state.eventHandler.removeListener;
     this.receive = state.eventHandler.receive;
-    this.verifyAndReceive = (
-      options:
-        | EmitterWebhookEventWithStringPayloadAndSignature
-        | EmitterWebhookEventWithSignature
-    ) => {
-      if (typeof options.payload === "object") {
-        console.warn(
-          "[@octokit/webhooks] Passing a JSON payload object to `verifyAndReceive()` is deprecated and the functionality will be removed in a future release of `@octokit/webhooks`"
-        );
-      }
-      return verifyAndReceive(state, options);
-    };
+    this.verifyAndReceive = verifyAndReceive.bind(null, state);
   }
 }
 
diff --git a/src/middleware/node/get-payload.ts b/src/middleware/node/get-payload.ts
index 1094311..2856056 100644
--- a/src/middleware/node/get-payload.ts
+++ b/src/middleware/node/get-payload.ts
@@ -1,4 +1,3 @@
-import type { WebhookEvent } from "@octokit/webhooks-types";
 // @ts-ignore to address #245
 import AggregateError from "aggregate-error";
 
@@ -12,20 +11,11 @@ import AggregateError from "aggregate-error";
 // }
 type IncomingMessage = any;
 
-export function getPayload(
-  request: IncomingMessage
-): Promise<WebhookEvent | string> {
+export function getPayload(request: IncomingMessage): Promise<string> {
   // If request.body already exists we can stop here
   // See https://github.com/octokit/webhooks.js/pull/23
 
-  if (request.body) {
-    if (typeof request.body !== "string") {
-      console.warn(
-        "[@octokit/webhooks] Passing the payload as a JSON object in `request.body` is deprecated and will be removed in a future release of `@octokit/webhooks`, please pass it as a a `string` instead."
-      );
-    }
-    return Promise.resolve(request.body as WebhookEvent | string);
-  }
+  if (request.body) return Promise.resolve(request.body);
 
   return new Promise((resolve, reject) => {
     let data = "";
diff --git a/src/middleware/node/index.ts b/src/middleware/node/index.ts
index d7556b1..821d04e 100644
--- a/src/middleware/node/index.ts
+++ b/src/middleware/node/index.ts
@@ -1,26 +1,17 @@
 import { createLogger } from "../../createLogger";
 import type { Webhooks } from "../../index";
 import { middleware } from "./middleware";
-import { onUnhandledRequestDefault } from "./on-unhandled-request-default";
 import type { MiddlewareOptions } from "./types";
 
 export function createNodeMiddleware(
   webhooks: Webhooks,
   {
     path = "/api/github/webhooks",
-    onUnhandledRequest = onUnhandledRequestDefault,
     log = createLogger(),
   }: MiddlewareOptions = {}
 ) {
-  const deprecateOnUnhandledRequest = (request: any, response: any) => {
-    console.warn(
-      "[@octokit/webhooks] `onUnhandledRequest()` is deprecated and will be removed in a future release of `@octokit/webhooks`"
-    );
-    return onUnhandledRequest(request, response);
-  };
   return middleware.bind(null, webhooks, {
     path,
-    onUnhandledRequest: deprecateOnUnhandledRequest,
     log,
   } as Required<MiddlewareOptions>);
 }
diff --git a/src/middleware/node/middleware.ts b/src/middleware/node/middleware.ts
index 2414e5b..f89396e 100644
--- a/src/middleware/node/middleware.ts
+++ b/src/middleware/node/middleware.ts
@@ -11,6 +11,7 @@ import type { WebhookEventHandlerError } from "../../types";
 import type { MiddlewareOptions } from "./types";
 import { getMissingHeaders } from "./get-missing-headers";
 import { getPayload } from "./get-payload";
+import { onUnhandledRequestDefault } from "./on-unhandled-request-default";
 
 export async function middleware(
   webhooks: Webhooks,
@@ -18,7 +19,7 @@ export async function middleware(
   request: IncomingMessage,
   response: ServerResponse,
   next?: Function
-) {
+): Promise<boolean> {
   let pathname: string;
   try {
     pathname = new URL(request.url as string, "http://localhost").pathname;
@@ -31,17 +32,15 @@ export async function middleware(
         error: `Request URL could not be parsed: ${request.url}`,
       })
     );
-    return;
+    return true;
   }
 
-  const isUnknownRoute = request.method !== "POST" || pathname !== options.path;
-  const isExpressMiddleware = typeof next === "function";
-  if (isUnknownRoute) {
-    if (isExpressMiddleware) {
-      return next!();
-    } else {
-      return options.onUnhandledRequest(request, response);
-    }
+  if (pathname !== options.path) {
+    next?.();
+    return false;
+  } else if (request.method !== "POST") {
+    onUnhandledRequestDefault(request, response);
+    return true;
   }
 
   // Check if the Content-Type header is `application/json` and allow for charset to be specified in it
@@ -60,7 +59,7 @@ export async function middleware(
         error: `Unsupported "Content-Type" header value. Must be "application/json"`,
       })
     );
-    return;
+    return true;
   }
 
   const missingHeaders = getMissingHeaders(request).join(", ");
@@ -75,7 +74,7 @@ export async function middleware(
       })
     );
 
-    return;
+    return true;
   }
 
   const eventName = request.headers["x-github-event"] as WebhookEventName;
@@ -99,18 +98,19 @@ export async function middleware(
     await webhooks.verifyAndReceive({
       id: id,
       name: eventName as any,
-      payload: payload as any,
+      payload,
       signature: signatureSHA256,
     });
     clearTimeout(timeout);
 
-    if (didTimeout) return;
+    if (didTimeout) return true;
 
     response.end("ok\n");
+    return true;
   } catch (error) {
     clearTimeout(timeout);
 
-    if (didTimeout) return;
+    if (didTimeout) return true;
 
     const err = Array.from(error as WebhookEventHandlerError)[0];
     const errorMessage = err.message
@@ -125,5 +125,7 @@ export async function middleware(
         error: errorMessage,
       })
     );
+
+    return true;
   }
 }
diff --git a/src/middleware/node/types.ts b/src/middleware/node/types.ts
index 4826c9d..92dec00 100644
--- a/src/middleware/node/types.ts
+++ b/src/middleware/node/types.ts
@@ -1,17 +1,6 @@
-// remove type imports from http for Deno compatibility
-// see https://github.com/octokit/octokit.js/issues/24#issuecomment-817361886
-// import { IncomingMessage, ServerResponse } from "http";
-type IncomingMessage = any;
-type ServerResponse = any;
-
 import type { Logger } from "../../createLogger";
 
 export type MiddlewareOptions = {
   path?: string;
   log?: Logger;
-  /** @deprecated `onUnhandledRequest()` is deprecated and will be removed in a future release of `@octokit/webhooks` */
-  onUnhandledRequest?: (
-    request: IncomingMessage,
-    response: ServerResponse
-  ) => void;
 };
diff --git a/src/sign.ts b/src/sign.ts
deleted file mode 100644
index 69efeee..0000000
--- a/src/sign.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { sign as signMethod } from "@octokit/webhooks-methods";
-
-import { toNormalizedJsonString } from "./to-normalized-json-string";
-
-export async function sign(
-  secret: string,
-  payload: string | object
-): Promise<any> {
-  return signMethod(
-    secret,
-    typeof payload === "string" ? payload : toNormalizedJsonString(payload)
-  );
-}
diff --git a/src/to-normalized-json-string.ts b/src/to-normalized-json-string.ts
deleted file mode 100644
index ca551ca..0000000
--- a/src/to-normalized-json-string.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/**
- * GitHub sends its JSON with no indentation and no line break at the end
- */
-export function toNormalizedJsonString(payload: object) {
-  const payloadString = JSON.stringify(payload);
-  return payloadString.replace(/[^\\]\\u[\da-f]{4}/g, (s) => {
-    return s.substr(0, 3) + s.substr(3).toUpperCase();
-  });
-}
diff --git a/src/types.ts b/src/types.ts
index 76a863e..77f3e1b 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -21,10 +21,6 @@ export type EmitterWebhookEventWithStringPayloadAndSignature = {
   payload: string;
   signature: string;
 };
-/** @deprecated */
-export type EmitterWebhookEventWithSignature = EmitterWebhookEvent & {
-  signature: string;
-};
 
 interface BaseWebhookEvent<TName extends WebhookEventName> {
   id: string;
diff --git a/src/verify-and-receive.ts b/src/verify-and-receive.ts
index 4b264c0..2ff4a34 100644
--- a/src/verify-and-receive.ts
+++ b/src/verify-and-receive.ts
@@ -1,24 +1,18 @@
 import { verify } from "@octokit/webhooks-methods";
 
-import { toNormalizedJsonString } from "./to-normalized-json-string";
 import type {
   EmitterWebhookEventWithStringPayloadAndSignature,
-  EmitterWebhookEventWithSignature,
   State,
 } from "./types";
 
 export async function verifyAndReceive(
   state: State & { secret: string },
-  event:
-    | EmitterWebhookEventWithStringPayloadAndSignature
-    | EmitterWebhookEventWithSignature
+  event: EmitterWebhookEventWithStringPayloadAndSignature
 ): Promise<any> {
   // verify will validate that the secret is not undefined
   const matchesSignature = await verify(
     state.secret,
-    typeof event.payload === "object"
-      ? toNormalizedJsonString(event.payload)
-      : event.payload,
+    event.payload,
     event.signature
   );
 
@@ -35,9 +29,6 @@ export async function verifyAndReceive(
   return state.eventHandler.receive({
     id: event.id,
     name: event.name,
-    payload:
-      typeof event.payload === "string"
-        ? JSON.parse(event.payload)
-        : event.payload,
+    payload: JSON.parse(event.payload),
   });
 }
diff --git a/src/verify.ts b/src/verify.ts
deleted file mode 100644
index eaf5cfa..0000000
--- a/src/verify.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { verify as verifyMethod } from "@octokit/webhooks-methods";
-
-import { toNormalizedJsonString } from "./to-normalized-json-string";
-
-export async function verify(
-  secret: string,
-  payload: string | object,
-  signature: string
-): Promise<any> {
-  return verifyMethod(
-    secret,
-    typeof payload === "string" ? payload : toNormalizedJsonString(payload),
-    signature
-  );
-}


Test patch:
diff --git a/test/integration/node-middleware.test.ts b/test/integration/node-middleware.test.ts
index 4ecb70b..1d5621f 100644
--- a/test/integration/node-middleware.test.ts
+++ b/test/integration/node-middleware.test.ts
@@ -7,7 +7,7 @@ import { sign } from "@octokit/webhooks-methods";
 // import without types
 const express = require("express");
 
-import { Webhooks, createNodeMiddleware } from "../../src";
+import { createNodeMiddleware, Webhooks } from "../../src";
 
 const pushEventPayload = readFileSync(
   "test/fixtures/push-payload.json",
@@ -76,7 +76,7 @@ describe("createNodeMiddleware(webhooks)", () => {
       req.once("data", (chunk) => dataChunks.push(chunk));
       req.once("end", () => {
         // @ts-expect-error - TS2339: Property 'body' does not exist on type 'IncomingMessage'.
-        req.body = JSON.parse(Buffer.concat(dataChunks).toString());
+        req.body = Buffer.concat(dataChunks).toString();
         middleware(req, res);
       });
     }).listen();
@@ -233,6 +233,40 @@ describe("createNodeMiddleware(webhooks)", () => {
     server.close();
   });
 
+  test("handle unhandled requests", async () => {
+    const webhooks = new Webhooks({
+      secret: "mySecret",
+    });
+
+    const middleware = createNodeMiddleware(webhooks, {});
+    const server = createServer(async (req, res) => {
+      if (!(await middleware(req, res))) {
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.write("nope.");
+        res.end();
+      }
+    }).listen();
+
+    // @ts-expect-error complains about { port } although it's included in returned AddressInfo interface
+    const { port } = server.address();
+
+    const response = await fetch(`http://localhost:${port}/foo`, {
+      method: "PUT",
+      headers: {
+        "X-GitHub-Delivery": "123e4567-e89b-12d3-a456-426655440000",
+        "X-GitHub-Event": "push",
+        "X-Hub-Signature-256": signatureSha256,
+      },
+      body: "invalid",
+    });
+
+    expect(response.status).toEqual(404);
+
+    await expect(response.text()).resolves.toEqual("nope.");
+
+    server.close();
+  });
+
   test("Handles missing headers", async () => {
     const webhooks = new Webhooks({
       secret: "mySecret",
diff --git a/test/integration/webhooks.test.ts b/test/integration/webhooks.test.ts
index 9316f9c..f2e70c8 100644
--- a/test/integration/webhooks.test.ts
+++ b/test/integration/webhooks.test.ts
@@ -3,7 +3,6 @@ import { readFileSync } from "fs";
 import { sign } from "@octokit/webhooks-methods";
 
 import { Webhooks } from "../../src";
-import { toNormalizedJsonString } from "../../src/to-normalized-json-string";
 
 const pushEventPayloadString = readFileSync(
   "test/fixtures/push-payload.json",
@@ -18,13 +17,6 @@ describe("Webhooks", () => {
     );
   });
 
-  test("webhooks.sign(payload) with object payload", async () => {
-    const secret = "mysecret";
-    const webhooks = new Webhooks({ secret });
-
-    await webhooks.sign(JSON.parse(pushEventPayloadString));
-  });
-
   test("webhooks.sign(payload) with string payload", async () => {
     const secret = "mysecret";
     const webhooks = new Webhooks({ secret });
@@ -32,20 +24,6 @@ describe("Webhooks", () => {
     await webhooks.sign(pushEventPayloadString);
   });
 
-  test("webhooks.verify(payload, signature) with object payload containing special characters", async () => {
-    const secret = "mysecret";
-    const webhooks = new Webhooks({ secret });
-
-    const payload = {
-      foo: "Foo\n\u001b[34mbar: ♥♥♥♥♥♥♥♥\nthis-is-lost\u001b[0m\u001b[2K",
-    };
-
-    await webhooks.verify(
-      payload,
-      await sign(secret, toNormalizedJsonString(payload))
-    );
-  });
-
   test("webhooks.verify(payload, signature) with string payload", async () => {
     const secret = "mysecret";
     const webhooks = new Webhooks({ secret });
diff --git a/test/typescript-validate.ts b/test/typescript-validate.ts
index 8268909..2b1db3d 100644
--- a/test/typescript-validate.ts
+++ b/test/typescript-validate.ts
@@ -82,8 +82,8 @@ export default async function () {
 
   webhooks.onAny(async ({ id, name, payload }) => {
     console.log(name, "event received", id);
-    const sig = await webhooks.sign(payload);
-    webhooks.verify(payload, sig);
+    const sig = await webhooks.sign(JSON.stringify(payload));
+    webhooks.verify(JSON.stringify(payload), sig);
   });
 
   webhooks.on("check_run.completed", () => {});
diff --git a/test/unit/deprecation.test.ts b/test/unit/deprecation.test.ts
deleted file mode 100644
index ed132a4..0000000
--- a/test/unit/deprecation.test.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-import { createServer } from "http";
-import { readFileSync } from "fs";
-
-import fetch from "node-fetch";
-import { sign } from "@octokit/webhooks-methods";
-
-import { Webhooks, createNodeMiddleware } from "../../src";
-
-const pushEventPayloadString = readFileSync(
-  "test/fixtures/push-payload.json",
-  "utf-8"
-);
-let signatureSha256: string;
-describe("Deprecations", () => {
-  beforeAll(async () => {
-    signatureSha256 = await sign(
-      { secret: "mySecret", algorithm: "sha256" },
-      pushEventPayloadString
-    );
-  });
-  test("onUnhandledRequest", async () => {
-    const spy = jest.spyOn(console, "warn");
-    const webhooks = new Webhooks({
-      secret: "mySecret",
-    });
-
-    const server = createServer(
-      createNodeMiddleware(webhooks, {
-        onUnhandledRequest(_request, response) {
-          response.writeHead(404);
-          response.end("nope");
-        },
-      })
-    ).listen();
-
-    // @ts-expect-error complains about { port } although it's included in returned AddressInfo interface
-    const { port } = server.address();
-
-    await fetch(`http://localhost:${port}/api/github/webhooks`, {
-      method: "PUT",
-      headers: {
-        "X-GitHub-Delivery": "123e4567-e89b-12d3-a456-426655440000",
-        "X-GitHub-Event": "push",
-        "X-Hub-Signature-256": signatureSha256,
-      },
-      body: "invalid",
-    });
-
-    expect(spy).toBeCalledWith(
-      "[@octokit/webhooks] `onUnhandledRequest()` is deprecated and will be removed in a future release of `@octokit/webhooks`"
-    );
-    spy.mockClear();
-    server.close();
-  });
-
-  test("webhooks.verify(payload, signature) with object payload", async () => {
-    const spy = jest.spyOn(console, "warn");
-    const secret = "mysecret";
-    const webhooks = new Webhooks({ secret });
-
-    await webhooks.verify(
-      JSON.parse(pushEventPayloadString),
-      await sign({ secret, algorithm: "sha256" }, pushEventPayloadString)
-    );
-    expect(spy).toBeCalledWith(
-      "[@octokit/webhooks] Passing a JSON payload object to `verify()` is deprecated and the functionality will be removed in a future release of `@octokit/webhooks`"
-    );
-    spy.mockClear();
-  });
-
-  test("webhooks.verifyAndReceive(payload, signature) with object payload", async () => {
-    const spy = jest.spyOn(console, "warn");
-    const secret = "mysecret";
-    const webhooks = new Webhooks({ secret });
-
-    await webhooks.verifyAndReceive({
-      id: "123e456",
-      name: "push",
-      payload: JSON.parse(pushEventPayloadString),
-      signature: await sign(
-        { secret, algorithm: "sha256" },
-        pushEventPayloadString
-      ),
-    });
-    expect(spy).toBeCalledWith(
-      "[@octokit/webhooks] Passing a JSON payload object to `verifyAndReceive()` is deprecated and the functionality will be removed in a future release of `@octokit/webhooks`"
-    );
-    spy.mockClear();
-  });
-});