2key-ratchet

2key-ratchet copied to clipboard

Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 6.8.9 to 6.11.3. Release notes Sourced from protobufjs's releases. v6.11.3 6.11.3 (2022-05-20) Bug Fixes deps: use eslint 8.x (#1728) (a8681ce) do not let setProperty change the prototype...

dependabot[bot]

Bumps [minimist](https://github.com/substack/minimist) from 1.2.5 to 1.2.6. Commits 7efb22a 1.2.6 ef88b93 security notice for additional prototype pollution issue c2b9819 isConstructorOrProto adapted from PR bc8ecee test from prototype pollution PR See full...

dependabot[bot]

Bumps [ajv](https://github.com/ajv-validator/ajv) from 6.12.2 to 6.12.6. Release notes Sourced from ajv's releases. v6.12.6 Fix performance issue of "url" format. v6.12.5 Fix uri scheme validation (@​ChALkeR). Fix boolean schemas with strictKeywords...

dependabot[bot]

Bumps [pathval](https://github.com/chaijs/pathval) from 1.1.0 to 1.1.1. Release notes Sourced from pathval's releases. v1.1.1 Fixes a security issue around prototype pollution. Commits db6c3e3 chore: v1.1.1 7859e0e Merge pull request #60 from...

dependabot[bot]

Bumps [path-parse](https://github.com/jbgutierrez/path-parse) from 1.0.6 to 1.0.7. Commits See full diff in compare view [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter...

dependabot[bot]

Bump lodash from 4.17.15 to 4.17.21

1

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.15 to 4.17.21. Commits f299b52 Bump to v4.17.21 c4847eb Improve performance of toNumber, trim and trimEnd on large input strings 3469357 Prevent command injection through _.template's variable...

dependabot[bot]

Bump y18n from 4.0.0 to 4.0.1

1

Bumps [y18n](https://github.com/yargs/y18n) from 4.0.0 to 4.0.1. Changelog Sourced from y18n's changelog. Change Log All notable changes to this project will be documented in this file. See standard-version for commit guidelines....

dependabot[bot]

Validate the exchange key is a unique key and in appropriate group

1

Since we do not control the peer we should have a check to ensure that the peer does not send us the identity key as the exchange key. We should...

rmhrisk

https://threatpost.com/breaking-signal-a-six-month-journey/124888/

rmhrisk

Right now we hard code to secp256r1 and SHA2-256, maybe we should allow consumers to specify which curve and hash algorithm to use.

rmhrisk