You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi, I noticed that the project depends on safe-buffer. This dependency was mainly needed for very old Node.js versions (<6) that didn’t support the modern Buffer APIs.
Since all actively supported Node.js versions now include Buffer.from and Buffer.alloc natively, the safe-buffer dependency is no longer necessary. Removing it would help reduce install size and dependency tree complexity.
Additionally, safe-buffer can cause issues in modern ESM builds:
The package relies on require("buffer") internally.
When bundled as ESM (e.g. with esbuild/rollup/webpack), this leads to runtime errors such as Error: Dynamic require of "buffer" is not supported.
Suggested change:
Replace require('safe-buffer').Buffer with the built-in Buffer global.
Drop safe-buffer from dependencies.
This should be fully backwards-compatible for all currently supported Node.js versions (>=12, >=14, >=16, etc.).
Activity
fix: remove safe-buffer dependency, use built-in Buffer
mahmoodhamdi commentedon Mar 15, 2026
Fixed in #115. I also opened a PR for the same issue in node-jwa (auth0/node-jwa#57) since both packages share this dependency.