Support Node 24: `Cannot read properties of undefined` (buffer-equal-constant-time)

[Artalus]

Hi, first time user here without much experience with JS ecosystem.
I was trying to rebuild an extension from source using vsce, but it failed with an error (see below).
I thought this was due to the extension using some outdated dependencies, but apparently the same error occurs even in a pristine Docker image with just Node 24 installed:

$ docker run --rm -it node:24 npx

  --8<--

Entering npm script environment at location:
/
Type 'exit' or ^D when finished

# node --version
v24.0.0
# npm --version
11.3.0
# npx @vscode/vsce --version
Need to install the following packages:
@vscode/vsce@3.3.2
Ok to proceed? (y) 

/root/.npm/_npx/66fbc91407e86cd3/node_modules/buffer-equal-constant-time/index.js:37
var origSlowBufEqual = SlowBuffer.prototype.equal;
                                  ^

TypeError: Cannot read properties of undefined (reading 'prototype')
    at Object.<anonymous> (/root/.npm/_npx/66fbc91407e86cd3/node_modules/buffer-equal-constant-time/index.js:37:35)
    at Module._compile (node:internal/modules/cjs/loader:1734:14)
    at Object..js (node:internal/modules/cjs/loader:1899:10)
    at Module.load (node:internal/modules/cjs/loader:1469:32)
    at Module._load (node:internal/modules/cjs/loader:1286:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
    at Module.require (node:internal/modules/cjs/loader:1491:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (/root/.npm/_npx/66fbc91407e86cd3/node_modules/jwa/index.js:1:19)

Doing the same thing in the node:23 image works:

$ docker run --rm -it node:23 npx

  --8<--

Entering npm script environment at location:
/
Type 'exit' or ^D when finished

# node --version
v23.11.0
# npm --version
10.9.2
# npx @vscode/vsce --version
Need to install the following packages:
@vscode/vsce@3.3.2
Ok to proceed? (y) 

3.3.2

[benibenj]

Node 24 is not yet supported due to an upstream bug.
We'll need to wait until it is fixed by node-jwa and for azure/identity to adopt the new jwa version.

• jwa: move from buffer-equal-constant-time to timingSafeEqual auth0/node-jwa#46
• jsonwebtoken: Node 24 compatibility auth0/node-jsonwebtoken#992
• @azure/identity: Deprecation error with NodeJS error Azure/azure-sdk-for-js#34243

@vscode/vsce
└─┬ @azure/identity@4.2.1
  ├─┬ @azure/msal-node@2.9.2
  │ └─┬ jsonwebtoken@9.0.2
  │   └─┬ jws@3.2.2
  │     └─┬ jwa@1.4.1
  │       └── buffer-equal-constant-time@1.0.1 deduped
  └─┬ jws@4.0.0
    └─┬ jwa@2.0.0
      └── buffer-equal-constant-time@1.0.1

[benibenj]

Root cause is nodejs which removed the SlowBuffer in the wrong version: nodejs/node#58211
As soon as they release an update, this issue should be resolved.

As SlowBuffer will be deprecated in an upcoming version, we still need to make sure to adopt the new versions of jws and @azure/identity when available

[slagiewka]

No need to wait for dependencies, as these use ranges and the lock can be updated to latest jwa. PR submitted.

[OzelotVanilla]

The LTS lts/jod (v22.21.1) of Node is still working for the vsce pack for my side. This temporary solution might be helpful.

Suggest that your package.json has this:

    "scripts": {
        "make": "vsce pack"
    }

Use nvm to install lts/jod:

nvm install lts/jod 

and then:

nvm exec lts/jod npm run make

If it is your first time using nvm (and a global installed node), use this to restore:

nvm alias default system