Test suite fails to load on Node 25+ (SlowBuffer removed)

[AnasAA98]

Context (Environment)

• macOS (Apple Silicon)
• Node v25.9.0
• Clean clone of main at 0c63f81, no customizations, no drive configured

Expected Behavior

npm test runs the suite. package.json declares engines.node as >=18.x with no upper bound, so Node 25 and 26 fall within the supported range.

Actual Behavior

All 14 suites fail to load and zero tests execute:

TypeError: Cannot read properties of undefined (reading 'prototype')

  at node_modules/buffer-equal-constant-time/index.js:37:35
  at node_modules/jwa/index.js:1:108
  at node_modules/jws/lib/sign-stream.js:4:11
  at node_modules/gtoken/build/src/index.js:12:13
  at node_modules/google-auth-library/build/src/auth/jwtclient.js:17:18
  at test/utils/__mocks__/google-auth-library.js:2:25
  at test/utils/googleMock.js:6:18
  at test/utils/bootstrap.js:4:20

Test Suites: 14 failed, 14 total
Tests:       0 total

The throw happens inside bootstrap.js, before any test file runs, so every suite is affected regardless of what it covers.

To Reproduce

nvm use 25          # or fnm use 25
git clone https://github.com/nytimes/library.git && cd library
npm install --no-optional
npm test

Switching to the version in .nvmrc (v24.4.1) makes it go away.

Additional Information

Node 25.0.0 removed the SlowBuffer class (https://nodejs.org/en/blog/release/v25.0.0). Line 37 of buffer-equal-constant-time reads SlowBuffer.prototype.equal, which throws once SlowBuffer is undefined.

Dependency chain:

library
  └─ google-auth-library@6.1.6
     └─ jws@4.0.0
        └─ jwa@2.0.0
           └─ buffer-equal-constant-time@1.0.1

CI passes because the matrix in .github/workflows/test.yaml covers Node 18, 20, 22, and 24. All four still have SlowBuffer, so nothing in CI exercises the affected versions.

Possible Solution

A dependency bump does not appear to fix this. jws@4.0.1 (latest) still depends on jwa ^2.0.1, and every published version of jwa including the latest still depends on buffer-equal-constant-time. That package's most recent release is 1.0.1, published in December 2013, so an upstream fix seems unlikely.

Options that might work, none of which I have verified:

• An npm overrides entry pointing buffer-equal-constant-time at a patched fork or a shim that restores SlowBuffer
• Narrowing engines.node to an upper bound reflecting what is actually supported, so this surfaces at install time rather than as an unexplained test crash
• Adding 25.x to the CI matrix so it gets caught upstream of contributors

Happy to dig further if any of these directions is useful.

I ran into this while setting up the repo for #395.