Crash in dependencies using SlowBuffer in v24.0.0

[suiboli314]

Version

v24.0.0

Platform

Linux a3399d7de011 5.15.167.4-microsoft-standard-WSL2 #1 SMP Tue Nov 5 00:21:55 UTC 2024 x86_64 Linux

Subsystem

No response

What steps will reproduce the bug?

1. Use the node:alpine Docker image (which now uses Node.js v24.0.0).
2. Install a package (e.g. jsonwebtoken) that depends on buffer-equal-constant-time@1.0.1.
3. Run the Node.js app in docker.

How often does it reproduce? Is there a required condition?

every time.
sample repo

What is the expected behavior? Why is that the expected behavior?

The app should not crash. In earlier Node.js versions (e.g. v23, node:lts-alpine), there is no error.

What do you see instead?

/usr/src/app/node_modules/buffer-equal-constant-time/index.js:37
var origSlowBufEqual = SlowBuffer.prototype.equal;
                                  ^

TypeError: Cannot read properties of undefined (reading 'prototype')
    at Object.<anonymous> (/usr/src/app/node_modules/buffer-equal-constant-time/index.js:37:35)
    at Module._compile (node:internal/modules/cjs/loader:1734:14)
    at Object..js (node:internal/modules/cjs/loader:1899:10)
    at Module.load (node:internal/modules/cjs/loader:1469:32)
    at Module._load (node:internal/modules/cjs/loader:1286:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
    at Module.require (node:internal/modules/cjs/loader:1491:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (/usr/src/app/node_modules/jwa/index.js:1:19)

Node.js v24.0.0

Additional information

[jasnell]

SlowBuffer was removed as it has reached it's end-of-life after being deprecated for quite a number of years ... #58008 ... that is, it no longer exists. You'll want to migrate things to use Buffer.allocUnsafeSlow(n)

[panva]

Both runtime-deprecation and EOL happened in the same major, that shouldn't have happened. #58211

[jasnell]

Ugh... You're correct. The SlowBuffer EOL commit was supposed to have been there for 25. Since it landed well after the semver-major cutoff for 24 I think the assumption was that it wouldn't get picked up in 24 but then 24 ended up a bit delayed and it looks like it was. Ok, well, I think a revert specifically for the 24.x release line would be the correct action. Keeping it EOl in main, however, is best.

[panva]

@jasnell agreed, I propose to re-land it on main right after #58211 (it is infact already ready to go)

[panva]

This was resolved with the release of https://github.com/nodejs/node/releases/tag/v24.0.1

The removal will still happen for 25.x and to avoid breakage then (and deprecation warnings now) the jwa module has releases that avoid use of the deprecated, to be removed, functionality.