clasp v3 fails on Node.js v25+ due to deprecated SlowBuffer in buffer-equal-constant-time

[vdavid]

Description

Clasp fails to run on Node.js v25, throws some TypeError related to SlowBuffer, which was apparently removed from Node 25.

Environment

• Node.js version: 25.2.1
• Clasp version: 3.1.3
• OS: latest macOS (likely cross-platform)

Error

TypeError: Cannot read properties of undefined (reading 'prototype')
at Object. (/path/to/node_modules/.pnpm/buffer-equal-constant-time@1.0.1/node_modules/buffer-equal-constant-time/index.js:37:35)
at Module._compile (node:internal/modules/cjs/loader:1760:14)
...

It seems to be the case because Clasp v3.x depends on buffer-equal-constant-time@1.0.1 (via jwa → google-auth-library-nodejs), which references Node's deprecated SlowBuffer. The buffer-equal-constant-time package seems to be unmaintained since 2013?

Steps to repro

1. Have Node.js v25.2.1+
2. Have clasp v3.1.3: npm install -g @google/clasp@3.1.3
3. Run any clasp command: clasp login or clasp push
4. Get the SlowBuffer error

Expected behavior

Clasp should work on supported Node.js versions. The docs state "The library requires NodeJS version >= 22.0.0.", which suggests that Node 25 is compatible.

Workaround

I've downgraded to Clasp v2.5.0, which works fine on Node.js v25 (pnpm install -g @google/clasp@2.5.0)

Proposed solution

Update transitive dependencies to remove buffer-equal-constant-time:

• Upgrade jwa and gtoken in google-auth-library-nodejs
• Or switch to an alternative JWT library like fast-jwt

This aligns with the broader ecosystem shift away from deprecated packages.

Thanks folks!