Unlisted dependency on assert in the browser

[Vinnl]

Describe the bug

No dependencies are listed in package.json, however, the browser package appears to depend on assert.

To Reproduce

See https://unpkg.com/browse/[email protected]/dist/browser/util/decode_protected_header.js

There's a non-relative import on the first line:

import { ok as assert } from 'assert';

If the assert npm module is not present, this will not resolve.

Expected behaviour

Either for there to not be a dependency on assert, or for assert to be listed as a dependency in package.json.

Environment:

• jose version: 3.12.2
• affected runtime is: all browsers
• other relevant library versions: Webpack 5.38.1

Additional context

• the bug is happening on latest jose too. - looks like it
• i have searched the issues tracker on github for similar issues and couldn't find anything related.

[panva]

The intention is to not have a dependency, this is an oversight i'll get fixed.

[panva]

Fixed in https://github.com/panva/jose/releases/tag/v3.12.3

[Vinnl]

Quick as usual - thanks!