ERROR: Citing in a use client component wrong buffer to use

Rules and Languages
,
1

In a context file using use client I’m importing buffer:

import { Buffer } from 'buffer';

but Sonarqube in VSC is citing:

Node.js built-in modules should be imported using the “node:” protocol (typescript:S7772)

with docs of:

Why is this an issue?

When importing Node.js built-in modules, using the node: protocol makes it explicitly clear that you’re importing a core Node.js module rather than a third-party package from npm.

Without the node: prefix, it can be ambiguous whether import fs from 'fs' refers to the built-in file system module or a potential npm package named ‘fs’. This ambiguity can lead to confusion, especially for developers who are new to a codebase or when reviewing code.

The node: protocol was introduced in Node.js 12.20.0 and became the recommended approach for importing built-in modules. It provides several benefits:

  • Clarity: Makes it immediately obvious that the import refers to a Node.js built-in module
  • Security: Prevents potential confusion attacks where malicious packages could have names similar to built-in modules
  • Future-proofing: Aligns with Node.js best practices and ESM standards
  • Consistency: Creates a uniform way to reference all built-in modules

This practice is particularly important in larger codebases where the distinction between built-in modules and external dependencies needs to be clear at a glance.

What is the potential impact?

Using imports without the node: protocol can lead to confusion about whether a module is built-in or external. In rare cases, this could create security vulnerabilities if malicious packages with names similar to built-in modules are installed. The lack of explicit protocol also makes code less self-documenting and harder to understand for new team members.

How to fix?

Add the node: prefix to ES6 import statements when importing Node.js built-in modules.

Assumption

but my understanding this is wrong for buffer:

  • Use import { Buffer } from 'buffer' in code that must run in the browser (client components).
  • The "node:buffer" specifier refers to the Node.js core module namespace and is intended for Node runtime usage — it is effectively Node-only and may not be available or polyfilled in browser bundles.

Why

  • node:buffer is the Node builtin namespace import (same family as node:fs, node:path). It explicitly points at the Node runtime implementation and signals the bundler/runtime to resolve the Node core module. Browsers do not provide Node core modules, so importing node:buffer in client-side code will usually fail unless you have a bundler/polyfill that maps it to a browser shim.
  • The npm package buffer is a browser-compatible shim that implements the same API. Importing from 'buffer' resolves to that package (or a bundler-provided polyfill) and is the correct choice for code that may run in the browser.

is this assumption not right and is this an error in Sonarqube?

2

Hey @codingChewie, welcome to the Community! Could you clarify which version of SonarQube for VS Code are you using? Are you using it in connected mode, and, if so, which product and version are you connecting to (SonarQube Server version XXXX, SonarQube Cloud)?

3

SonarQube for IDE version 5.4.0 and VSCode version 1.125.1

5

Hi @codingChewie, welcome to the community!

Thank you for the detailed first report. This is indeed a false positive: in client-side code, importing Buffer from buffer can be the correct way to use the browser-compatible shim, so suggesting node:buffer is not appropriate there.

We’ve created Jira to track the fix.
Thanks again for taking the time to report this. Feedback like yours helps us make the tool better.