I think I've changed it to ES5, but I'm not super familiar with what is ES5 and what came after so I could have missed things.
We use a package called localflare to run Cloudflare Workers for testing which depends on this package. I discovered the different behavior between atob and buffer when looking at b64url in our code.
For us making the change is beneficial because the closer we can get our environment to Cloudflare the better (and I'm really against Node's behavior on this) but I also understand being cautious about versioning. I'll just have to make a PR to localflare to update their version :)
(Wrangler is on our roadmap but it will be a little while before we get there)
I've scheduled review, update, merge, and publish this on Saturday.
This pull request is broken due to missing fork information.