Underlying dependency urlsafe-base64 uses Buffer unsafely

[hikarunoryoma]

NOTE: Please test in a least two browsers (i.e. Chrome and Firefox). This
helps with diagnosing problems quicker.

Setup

Please provide the following details, the more info you can provide the
better.

Operating System: Amazon Linux 2
Node Version: 18.15.0
web-push Version: 3.5.0

Please select any browsers that you are experiencing problems with:

• [X ] Chrome
• [X ] Firefox
• [X ] Opera for Android
• Samsung Internet Browser
• Other

Please list the browsers you are have tested this, including the version
of the browser (i.e. Chrome Beta, Firefox Beta etc).
All Browsers

Problem

When calling setVapidDetails in Node18 I see the following console error:

ERROR	(node:14) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
    at showFlaggedDeprecation (node:buffer:195:11)
    at new Buffer (node:buffer:279:3)
    at Object.decode (/var/task/index.js:490:68353)
    at Object.validatePublicKey (/var/task/index.js:493:8952)
    at Qxe.setVapidDetails (/var/task/index.js:493:19995)
    at setVapidDetails (/var/task/index.js:497:4174)
    ...

Doing some debugging the cause of this is because the underlying library: urlsafe-base64 has not updated to using Buffer.from(). While there are already PRs to fix this, the maintainers seem to have abandoned the project. Would it be possible to fork the implementation of urlsafe-base64 and consume a patched version within web-push?

Expected

No console errors

Features Used

• [X ] VAPID Support
• GCM API Key
• Sending with Payload

Example / Reproduce Case

Please provide a code sample that reproduces the issue. If there is a
repository that reproduces the issue please put the link here.

import webpush from "web-push";

webpush.setVapidDetails(WEB_PUSH_API_SUBJECT, vapidDetails.publicKey, vapidDetails.privateKey);

[hikarunoryoma]

See PR: #786

[haouarihk]

Because i needed this quick, and the dev didn't update the npm,
i republished it in npm under web-push-temp-build name,
(i kept everything in the package.json, except upped the version)

ping me when you update the npm repo, so i can use it instead of my temporary one

[marco-c]

@haouarihk I've just published 3.6.2.