Eliminate DEP0005 Buffer() deprecation warnings in CI workflows

[MariusStorhaug]

During review of PR #45, the latest completed workflow logs showed repeated Node.js deprecation warnings for Buffer() usage ([DEP0005] DeprecationWarning: Buffer() is deprecated...) across multiple CI jobs. The current user experience is noisy and ambiguous CI output where warnings obscure actionable failures and reduce confidence in job health.

Request

The current experience includes repeated [DEP0005] warnings in these jobs: Build-Docs, Build-Site, Test-Module (Linux/macOS/Windows), Test-ModuleLocal (Linux/macOS/Windows), and Lint-Module. The desired experience is warning-free CI for this deprecation class, with repository-owned usage migrated to modern Buffer APIs and third-party sources addressed through dependency/tooling upgrades.

User impact

Persistent deprecation warnings increase log noise, make regression triage slower, and mask meaningful warnings/errors during pull request validation.

Acceptance criteria

• All [DEP0005] warnings are eliminated from the affected CI jobs listed above.
• Every repository-owned Buffer() constructor usage is replaced with Buffer.from(...), Buffer.alloc(...), or Buffer.allocUnsafe(...) as appropriate.
• Any warning source from external packages/tooling is addressed by upgrading/pinning to a non-warning version, or documented with a tracked follow-up if an upstream fix is required.
• CI logs for the affected jobs are validated on a follow-up run and contain no [DEP0005] entries.
• The change is documented in the issue with root cause mapping (owned code vs external dependency).

---

Technical decisions

Scope boundary: Treat CI workflow definitions, repository scripts, and checked-in tooling configuration as repository-owned; treat package internals from third-party dependencies as external.

Detection strategy: Add targeted detection during investigation using deprecation tracing (--trace-deprecation) in relevant Node invocations where feasible to identify the call stack and owning source.

Remediation policy: For repository-owned code paths, replace deprecated constructor calls with explicit modern Buffer APIs based on intent (from for existing data, alloc/allocUnsafe for new buffers).

External dependency handling: Prefer dependency/tooling upgrades first. If no fixed version exists, pin to the best available version and document an upstream tracking item.

Validation approach: Re-run the affected workflow matrix and verify absence of [DEP0005] lines in logs before closing.

Compatibility: Preserve behavior and binary output semantics while changing constructor usage; do not introduce functional changes beyond warning remediation.

---

Implementation plan

Investigation

• Enumerate all Node entry points used by Build-Docs, Build-Site, Test-Module, Test-ModuleLocal, and Lint-Module.
• Collect deprecation stack traces from representative runs to attribute each warning to repository-owned code or external dependencies.
• Produce a source map of each warning occurrence and ownership classification.

Repository-owned fixes

• Replace all repository-owned Buffer() constructor calls with the correct Buffer.from/alloc/allocUnsafe variant.
• Add or update tests/validation where needed to confirm equivalent behavior.

External/tooling fixes

• Upgrade or pin dependencies/tooling that emit Buffer() deprecations in CI.
• Record any unavoidable upstream gaps with links and a follow-up tracking issue if required.

Verification

• Execute CI workflows covering Build-Docs, Build-Site, Lint-Module, Test-Module (Linux/macOS/Windows), and Test-ModuleLocal (Linux/macOS/Windows).
• Confirm zero [DEP0005] warnings in logs and capture verification evidence in the issue notes.

[MariusStorhaug]

Closing: the DEP0005 Buffer() warnings originate from the Process-PSModule reusable workflow tooling, not from the Sodium module. Please track in the PSModule framework repository.