⬆️ Updates bcryptjs to v3 #2397
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Branch automerge failureThis PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
|
|
Thanks for the PR! This section of the codebase is owner by https://github.com/AlexRogalskiy/ - if they write a comment saying "LGTM" then it will be merged. |
|
Thanks for opening an issue! Make sure you've followed CONTRIBUTING.md. |
Hello from PR HelperIs your PR ready for review and processing? Mark the PR ready by including If you still have work to do, even after marking this ready. Put the PR on hold by including |
|
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again.
Next stepsWhat is protestware?This package is a joke, parody, or includes undocumented or hidden behavior unrelated to its primary function. Consider that consuming this package may come along with functionality unrelated to its primary purpose. What is a critical CVE?Contains a Critical Common Vulnerability and Exposure (CVE). Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
This PR contains the following updates:
^2.4.3->^3.0.0Release Notes
dcodeIO/bcrypt.js (bcryptjs)
v3.0.0Compare Source
Breaking changes
2f45985)The project now exports an ECMAScript module by default, albeit with an UMD fallback, ships with types, the dist/ directory no longer exists in version control, and Closure Compiler externs have been removed.
d36bfb4)This library was not affected by the bug that led to incrementing the bcrypt version from 2a to 2b, but nowadays most
implementations use 2b, including the native bcrypt binding, so this change aligns with them. Existing hashes will continue to work, but
test logic that generates hashes and compares them literally might need to be updated to account for the new default.
Features
d5656b3)Other
2a9bea9)e09eb9a)58333a1)2e3b176)ec02e8a)9db275f)ac70ac5)574d690)e746547)548559d)4977df0)a84d4e4)c8c9c01)1b54cc4)7e2e93a)The npm package does not need externs as it is needed only for closure compiler. Added it in .npmignore since bcryptjs overrides global module and process in WebStorm IDE.
684fac6)b09f7f2)648482a)49a1d1a)Configuration
📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.