Repository navigation
Node v24 released, And The SlowBuffer was deprecated, The package: buffer-equal-constant-time can not be used #51
Description
Description
Node v24 released, And The SlowBuffer was deprecated. JWA package have a dependence named
buffer-equal-constant-time, and the package use SlowBuffer object, so it's didn't run on node24.
Reacted by BojDom, Daniel Osvaldo Rahmanto, Alan Agius, Cédric Belin, Sterling Camden, Sang and Emil Toivainen
Activity
panva commentedon May 7, 2025
Both runtime-deprecation and EOL of said Node.js API happened in the same major, that shouldn't have happened. nodejs/node#58211
panva commentedon May 7, 2025
I've tagged #52 internally to work around the deprecation and unintended removal (that nodejs/node#58211 will also resolve)
panva commentedon May 7, 2025
We've released patched versions of the
jwamodule. These releases take care of not using the deprecated code whencrypto.timingSafeEqual()is available (while still using it when run in legacy codebase with EOL Node.js versions where it wasn't available).Running
npm upgrade jwa(or whichever package manager alternative you happen to use) will pick those patched versions up and fix the issue for you.I will leave this issue open to hopefully avoid new issues from being open and will comment again when a Node.js release with the deprecated (but not removed) functionality is available.
Edit: Node.js v24.0.1 was released on 2025-05-08 which reverts the problematic removal, it will still be removed in v25.x in October, but with the release of jwa@1.4.2 and jwa@2.0.1 these APIs are no longer in use so long as you upgrade your dependency tree, e.g. via
npm upgrade jwa.mbtools commentedon Dec 12, 2025
Closed by #52
fix(deps): bump jwa for Node 25+
ci: mise instead of corepack, Node 26 (#84)