Skip to content

chore(deps): Bump pbkdf2 to 3.1.2 #12057

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 28, 2025
Merged

Conversation

Tobbe
Copy link
Contributor

@Tobbe Tobbe commented Jun 28, 2025

This PR fixes https://nvd.nist.gov/vuln/detail/CVE-2025-6547 and https://nvd.nist.gov/vuln/detail/CVE-2025-6545

Superseeds #12048

https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md

Only apps should have lockfiles 8b06730
[lint] fix whitespace 9a76e2f
[lint] fix parens/curlies/semis/etc 6fd84bf
[meta] add auto-changelog 796c38d
[Tests] fix tests in node 17 3661fb0
Revert "[Tests] fix tests in node < 3" 7431b57
[Tests] fix tests in node < 3 eb9f97a
[Fix] ensure unknown algorithms throw + known ones match node 26d4fd3
[Tests] add GHA, always run nyc 513906a
[lint] fix a few more rules ab04da8
[lint] switch to eslint 89694cf
[Tests] add coverage d0d534b
[Refactor] use to-buffer e3102a8
[readme] improve badges fca0c9d
[Tests] remove unused travis file a2c7d93
[meta] switch from files to npmignore 7f31fbc
[Tests] use .nycrc 8d628e8
[Refactor] minor tweaks fc61005
[Deps] update create-hmac, safe-buffer, sha.js ae2a7d0
[Fix] pin create-hash, ripemd160 due to breaking changes e079968
[Tests] fix tests in node 3 45fbcf3
[meta] skip publishing benchmarks 19ea57b
[Dev Deps] add missing peer dep 645e252

@Tobbe Tobbe added the release:dependency This PR only updates dependencies label Jun 28, 2025
@Tobbe Tobbe added this to the next-release-patch milestone Jun 28, 2025
@Tobbe Tobbe added the changesets-ok Override the changesets check label Jun 28, 2025
@Tobbe
Copy link
Contributor Author

Tobbe commented Jun 28, 2025

CI fails because of fb55/css-select#1592, not anything related to this PR

@Tobbe Tobbe merged commit ed67601 into redwoodjs:main Jun 28, 2025
44 of 60 checks passed
@ChALkeR
Copy link

ChALkeR commented Jun 28, 2025

it is unlikely that you need pbkdf2 dep at all, using crypto.subtle.deriveBits should be fine in all modern envs

vite-plugin-node-polyfills is catastrophically misconfigured

@Tobbe
Copy link
Contributor Author

Tobbe commented Jun 28, 2025

@ChALkeR Thanks for the heads-up! Do you mean vite-plugin-node-polyfills is misconfigured in general, or specifically in our setup?

@Tobbe Tobbe deleted the tobbe-deps-pbkdf2-3-1-2 branch June 28, 2025 19:00
Tobbe added a commit that referenced this pull request Jun 28, 2025
Superseeds #12048

https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md

Only apps should have lockfiles
[8b06730](browserify/pbkdf2@8b06730)
[lint] fix whitespace
[9a76e2f](browserify/pbkdf2@9a76e2f)
[lint] fix parens/curlies/semis/etc
[6fd84bf](browserify/pbkdf2@6fd84bf)
[meta] add auto-changelog
[796c38d](browserify/pbkdf2@796c38d)
[Tests] fix tests in node 17
[3661fb0](browserify/pbkdf2@3661fb0)
Revert "[Tests] fix tests in node < 3"
[7431b57](browserify/pbkdf2@7431b57)
[Tests] fix tests in node < 3
[eb9f97a](browserify/pbkdf2@eb9f97a)
[Fix] ensure unknown algorithms throw + known ones match node
[26d4fd3](browserify/pbkdf2@26d4fd3)
[Tests] add GHA, always run nyc
[513906a](browserify/pbkdf2@513906a)
[lint] fix a few more rules
[ab04da8](browserify/pbkdf2@ab04da8)
[lint] switch to eslint
[89694cf](browserify/pbkdf2@89694cf)
[Tests] add coverage
[d0d534b](browserify/pbkdf2@d0d534b)
[Refactor] use to-buffer
[e3102a8](browserify/pbkdf2@e3102a8)
[readme] improve badges
[fca0c9d](browserify/pbkdf2@fca0c9d)
[Tests] remove unused travis file
[a2c7d93](browserify/pbkdf2@a2c7d93)
[meta] switch from files to npmignore
[7f31fbc](browserify/pbkdf2@7f31fbc)
[Tests] use .nycrc
[8d628e8](browserify/pbkdf2@8d628e8)
[Refactor] minor tweaks
[fc61005](browserify/pbkdf2@fc61005)
[Deps] update create-hmac, safe-buffer, sha.js
[ae2a7d0](browserify/pbkdf2@ae2a7d0)
[Fix] pin create-hash, ripemd160 due to breaking changes
[e079968](browserify/pbkdf2@e079968)
[Tests] fix tests in node 3
[45fbcf3](browserify/pbkdf2@45fbcf3)
[meta] skip publishing benchmarks
[19ea57b](browserify/pbkdf2@19ea57b)
[Dev Deps] add missing peer dep
[645e252](browserify/pbkdf2@645e252)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
changesets-ok Override the changesets check release:dependency This PR only updates dependencies
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants