Node v24 released, And The SlowBuffer was deprecated, The package: buffer-equal-constant-time can not be used

[dingiyan]

Description

Node v24 released, And The SlowBuffer was deprecated. JWA package have a dependence named buffer-equal-constant-time, and the package use SlowBuffer object, so it's didn't run on node24.

[panva]

Both runtime-deprecation and EOL of said Node.js API happened in the same major, that shouldn't have happened. nodejs/node#58211

[panva]

I've tagged #52 internally to work around the deprecation and unintended removal (that nodejs/node#58211 will also resolve)

[panva]

We've released patched versions of the jwa module. These releases take care of not using the deprecated code when crypto.timingSafeEqual() is available (while still using it when run in legacy codebase with EOL Node.js versions where it wasn't available).

Running npm upgrade jwa (or whichever package manager alternative you happen to use) will pick those patched versions up and fix the issue for you.

I will leave this issue open to hopefully avoid new issues from being open and will comment again when a Node.js release with the deprecated (but not removed) functionality is available.

Edit: Node.js v24.0.1 was released on 2025-05-08 which reverts the problematic removal, it will still be removed in v25.x in October, but with the release of jwa@1.4.2 and jwa@2.0.1 these APIs are no longer in use so long as you upgrade your dependency tree, e.g. via npm upgrade jwa.