drop buffer polyfill from crypto

[dynst]

Buffer hasn't been used since #960
4a6253f

[webmaster128]

Thanks! The "buffer" import is not used directly anymore indeed. But this is added as a devDependency also because of

      new webpack.ProvidePlugin({
        Buffer: ["buffer", "Buffer"],
      }),

in the webpack config. But then again the combination with

    resolve: {
      fallback: {
        buffer: false,

does not make much sense.

So if I understand things correctly we should remove the Buffer plugin whenever we remive the buffer devDependency.

[dynst]

The "buffer" import is not used directly anymore indeed.

Not quite, it was never imported at all, the Buffer global was being used by the ripemd160 code in the linked commit. But yeah, it clearly only existed in devDependencies for the sake of the webpack build (node would already have it).

if I understand things correctly we should remove the Buffer plugin whenever we remive the buffer devDependency.

That's actually a bigger scope change than this tiny PR, because every webpack config file also includes the Buffer plugin. I suspect they have to or had to in the past, because lower-level packages use the global, and the plugin provides the Buffer global.

https://webpack.js.org/plugins/provide-plugin/

resolve.fallback.buffer = false is a separate thing that, in webpack 4, turns off the polyfill of importing the 'buffer' package, but doesn't affect the global. webpack is pointlessly confusing like that. https://webpack.js.org/configuration/resolve/#resolvefallback

It looks like it isn't actually needed anymore in webpack 5 though, where the default is false anyway.

BREAKING CHANGE: webpack < 5 used to include polyfills for node.js core modules by default.
This is no longer the case. Verify if you need this module and configure a polyfill for it.

But I'm also hoping to just fix #1688 and delete webpack+karma from the repo entirely fairly soon and replace them with playwright + vitest.

[webmaster128]

Thanks for all the explanations. This makes a lot of sense.

Coming back to the very specific case in this PR without increasing scope. Once we remove the buffer devDependency from @cosmjs/crypto, this line does not work anymore:
https://github.com/cosmos/cosmjs/blob/v0.36.1/packages/crypto/webpack.web.config.cjs#L20
Or it works by accident because some other package brings in the buffer dependency and can break any time later.

So if we remove the dependency, we also need to remove the Buffer plugin from the package. Not sure if this can be done without affecting any lower level dependency but probably worth a try.