Warning on connect() method - Buffer() is deprecated due to security and usability issues

[PedroS11]

Hi,

I'm using the version 4.1.3 from ssh2-sftp-client and when I call the connect() method I get the following warning:

Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

I check your code and I couldn't find any statement with Buffer() so I found it was this package concat-stream. Can you help?

Pedro

[theophilusx]

Start by upgrading to the current version. Then if you still see this issue, let me know.

[PedroS11]

Sorry I misspelled the version, I'm using 5.1.2 version and error remains because it comes from this package concat-stream. They are using Buffer() constructor instead of Buffer.from(). There's even a PR to fix this for more that a year PR.
I found a fork from this repo that may fix this warning node-concat-stream.

[theophilusx]

OK, I will look at the status of that dependency and see what the best action is. Might try and get rid of the dependency altogether.

[PedroS11]

That would be awesome, let me know if you fix it and create a new version so that I can use this package in a project because this package is really good, congrats.

[theophilusx]

What version of node are you using? I've not been able to reproduce that warning. Can you provide a basic script which produces the warning so that I can try and reproduce it?

[PedroS11]

I'm using v12 but now I don't get the error anymore (testing on personal computer). On Monday I will try again with everything set up and I let you know if the error still exists. Thanks

[PedroS11]

I can't replicate the problem again, don't know what happened but in the next days I will use others methods from this package and I let you know if I get it again. You can close the issue and sorry for the time lost