Regression: `@google-cloud/pubsub` fails to run due to JWA dependency in `google-auth-library` for node v24.0.0-rc.3 and later

[abhilash-sivan]

Hello team,

I'm encountering a failure when using the @google-cloud/pubsub package with Node.js versions v24.0.0-rc.3 and later. The issue appears to be related to a transitive dependency within the google-auth-library-nodejs package.

The following code, which works reliably on earlier Node.js versions, now fails starting from v24.0.0-rc.3:

const [topic] = await pubSubClient.topic(topicName);

Error:

/Users/abhi/instana/test-apps/pubsub/node_modules/buffer-equal-constant-time/index.js:37
var origSlowBufEqual = SlowBuffer.prototype.equal;
                                  ^

TypeError: Cannot read properties of undefined (reading 'prototype')
    at Object.<anonymous> (/Users/abhi/instana/test-apps/pubsub/node_modules/buffer-equal-constant-time/index.js:37:35)
    at Module._compile (node:internal/modules/cjs/loader:1734:14)
    at Object..js (node:internal/modules/cjs/loader:1899:10)
    at Module.load (node:internal/modules/cjs/loader:1469:32)
    at Function._load (node:internal/modules/cjs/loader:1286:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
    at Module.require (node:internal/modules/cjs/loader:1491:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (/Users/abhi/instana/test-apps/pubsub/node_modules/jwa/index.js:1:19)

Node.js v24.0.0-rc.3

The issue is with a dependency in googleapis/google-auth-library-nodejs pkg.

• Works fine in: v24.0.0-rc.2 and earlier
• Fails in: v24.0.0-rc.3, v24.0.0-rc.4

🔍 Root Cause Investigation
After investigating the dependency tree, I’ve identified the root cause:

1. google-cloud/pubsub depends on google-auth-library-nodejs
→ pubsub package.json
2. google-auth-library-nodejs depends on jws
→ auth-library package.json
3. jws uses jwa
→ jws package.json
4. jwa depends on buffer-equal-constant-time
→ jwa package.json

The issue appears to stem from a problem in the jwa dependency chain.

📎 Related Issues & Discussions

• Migration request to drop jws from google-auth-library: refactor(deps): Migrate from jws library #1650
• Upstream issue in jwa: move from buffer-equal-constant-time to timingSafeEqual auth0/node-jwa#46

Thanks In Advance

[d-goog]

It looks like slowbuffer was runtime deprecated rather than removed:

• https://nodejs.org/en/blog/release/v24.0.0#deprecations-and-removals

I'll investigate further.

[d-goog]

Actually, it has been removed entirely:

• buffer: move SlowBuffer to EOL nodejs/node#58008

Making this a P1.

[panva]

Both runtime-deprecation and EOL happened in the same major, that shouldn't have happened. nodejs/node#58211