Dependency urlsafe-base64 uses Buffer unsafely (via http-ece) about web-push HOT 8 CLOSED

Thanks for the report. The first step would be to fix the problem in https://github.com/web-push-libs/encrypted-content-encoding, then update the package here.

from web-push.

Both are part of this same group, is this issue sufficient or should I duplicate it on the other repo?

from web-push.

@wmaltmann it'd be useful to file an issue on the other repo as well, and this one can track updating the dependency once the other repo's issue is fixed.

from web-push.

Just upgrading to the latest nodejs (18) runtime in AWS lamda solved the issue for me. I was on nodejs 16

from web-push.

Also running into this, although strangely a few notifications will make it through, and then the error surfaces after some amount of time has passed.

(node:8) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

Worth noting this is running Node 18—in response to the note above.

Happy to look into this further but figured I’d check in @wmaltmann.

from web-push.

@jondashkyle if you want to help, you'd need to fix web-push-libs/encrypted-content-encoding#68 in a similar fashion to #813.

from web-push.

I worked around it by making the change locally and pointing to my local version.

from web-push.

@wmaltmann could you submit a PR? That would benefit everyone!

from web-push.