Repository navigation
chore(deps): bump pbkdf2, sha.js and cipher-base in yarn.lock - #258
Merged
Merged
Conversation
Lockfile-only refresh of transitive dependencies: - pbkdf2 3.1.2 -> 3.1.7 (via crypto-browserify) - sha.js 2.4.11 -> 2.4.12 (via create-hash, @ledgerhq/hw-app-str) - cipher-base 1.0.4 -> 1.0.7 (via create-hash / browserify-aes) No package.json changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.
JiahuiWho
approved these changes
Oct 14, 2026
Merged
CassioMG
added a commit
that referenced
this pull request
Oct 19, 2026
* Release/5.1.0 Bumps all three packages to `5.1.0` and updates their changelogs. * fix(recovery): validate SEP-30 signer set before locking the master key (#255) * fix(km): make changePassword work with BrowserStorageKeyStore (#257) * chore(deps): bump pbkdf2, sha.js and cipher-base in yarn.lock (#258) * fix(km): make Albedo and Freighter signing follow the configured network (#259) A minor release rather than a patch: #255 adds four exported error classes, and #255 and #259 make calls that used to succeed throw. `@stellar/typescript-wallet-sdk-soroban` has no shipped changes since 5.0.0 and is bumped to stay in lockstep, matching #250. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: raise testnet test timeouts to 30s Unit tests that fund accounts through friendbot or authenticate against testanchor kept timing out in CI: friendbot fundings were taking 4-30s, against hook and test limits of 5-20s and Jest's 5s default. The timeouts fail `yarn test:ci` in the npm publish workflows before the publish step runs. - Set `testTimeout: 30000` at the top level of jest.config.js. It's a global option, so it can't go in the per-project config. - Raise every explicit test and hook timeout under 30s to 30s. Those already at 30s or more are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Lockfile-only refresh that moves three browserify crypto polyfill packages to newer patch versions:
pbkdf2,sha.jsandcipher-base. Nopackage.jsonchanges and no behavior changes. The goal is to clear the open Dependabot alerts.Implementation details (for agents)
What changed: only
yarn.lock. The three entries were dropped and re-resolved byyarn installwithin their existing semver ranges. The new lock entries are the helper packages the newer versions depend on (to-buffer,hash-base@3.1.2,ripemd160@2.0.3,typed-array-buffer,call-bound, …), added alongside the existing ones. No other package changed version.pbkdf2crypto-browserifysha.jscreate-hash,@ledgerhq/hw-app-strcipher-basecreate-hash,browserify-aesDownstream impact: consumers who install from npm resolve their own versions of these packages, so the lockfile has no effect on them. Only the contents of our prebuilt bundles change, at the next release.
Verification:
yarn whyreports a single resolved version for each package:pbkdf2@3.1.7,sha.js@2.4.12,cipher-base@1.0.7.yarn buildsucceeds for all three packages.npx jest --ci: 17 suites passed (1 skipped), 343 tests passed, 5 skipped.sha.js@2.4.12sha256on a randomBuffermatches Node'scrypto.createHash('sha256').Follow-ups / out of scope: core's
crypto-browserifypolyfill exists only becausejws→jwaimportscrypto, and core only usesjws.decode. A small base64url JWT decoder would let us dropjwsand the polyfill (about 600 KB of browserify code) from the core browser bundle.🤖 Generated with Claude Code