Node.js API used in jose/dist/browser/runtime/env.js on line 6

What happened?

I am using Jose in combination with Next.js (v12.2) middleware and an error is thrown due to process.versions being used inside jose/dist/browser/runtime/env.js on line 6. I suppose it could be replaced with simply checking typeof process === 'object to find out if it’s node, since the only thing done in this file is to check if it’s run inside node.

Version

4.18.1

Runtime

Browser

Runtime Details

Next.js (v12.2) middleware / only browser api available

Code to reproduce

Create a project with Next.js v12.2 and add import * as jose from 'jose' inside a middleware defined according to: https://nextjs.org/docs/advanced-features/middleware

Required

• I have searched the issues tracker and discussions for similar topics and couldn’t find anything related.
• I agree to follow this project’s Code of Conduct

[panva]

@leerob @balazsorban44 how do you envision universal libraries doing runtime detection?

This here seems like a regression in Next.js. I think if it were to first do a typeof check on the process global and then continue off to access the versions and node properties it would still not allow these developers’ apps to run in 12.2 which ran just fine before

[panva]

v4.8.3 will be released shortly (pending CI) with the code from main which coincidentally removed the need for this anyway.

I’ll leave this open as https://github.com/panva/jose/labels/triage so that @leerob @balazsorban44 can pitch in.