website icon indicating copy to clipboard operation
website copied to clipboard
verified publisher icon datenanfragen

Bump openpgp from 5.11.2 to 6.1.1

Open dependabot[bot] opened this issue 3 months ago • 2 comments

Bumps openpgp from 5.11.2 to 6.1.1.

Release notes

Sourced from openpgp's releases.

v6.1.1 - Security Patch

  • Address CVE-2025-47934 (Message signature verification could be spoofed)

v6.1.0

What's Changed

  • Fix decryption support for non-standard, legacy AEAD-encrypted messages and keys that used experimentalGCM from OpenPGP.js v5 (openpgpjs/openpgpjs#1811)
  • Throw on encryption using the non-standard experimentalGCM AEAD algorithm (The enums.aead.gcm ID standardized by RFC9580 should be used instead.)
  • Improve internal tree-shaking and lazy load md5 (openpgpjs/openpgpjs#1812)
  • Fix signing using keys without preferred hash algorithms (openpgpjs/openpgpjs#1820)

Full Changelog: https://github.com/openpgpjs/openpgpjs/compare/v6.0.1...v6.1.0

v6.0.1

What's Changed

  • Fix ES imports for webpack: declare exports.browser entrypoint as higher priority than import
  • Fix openpgp.verify/decrypt with expectSigned: true and format: 'binary' (#1805)
  • TS: fix generateKey (options.type) and PrivateKey.getDecryptionKeys() type declarations (#1807)
  • Update hash algorithm preferences order by (#1804)

Full Changelog: https://github.com/openpgpjs/openpgpjs/compare/v6.0.0...v6.0.1

v6.0.0

What's Changed

OpenPGP.js v6 adds support for the new version of the OpenPGP specification, RFC 9580. It also increases compliance with the specification, as demonstrated by the OpenPGP interoperability test suite.

OpenPGP.js v6 only makes minor API changes. This is the first stable release of OpenPGP.js v6: no more breaking changes to the high-level API will be made until the next major release.

For the changes since the previous pre-release (v6.0.0-beta.3.patch.1), see the end of this message. Here we list a summary of the main changes since v5:

Platform support changes

  • The library is now declared as a module (type: module in package.json), and declares exports, alongside the legacy package.json entrypoints, which should ensure backwards compatibility. Still, bundlers might be affected by the package.json changes depending on how they load the library.
  • Node.js:
    • Drop support for Node.js versions below 18 (OpenPGP.js v5 supported Node.js v14 and above).
    • Streaming: drop support for native Node Readable stream: require passing Node Web Streams (#1716)
  • Web:
    • Require availability of the Web Crypto API's SubtleCrypto (insecure contexts are no longer supported, as SubtleCrypto is not available there)
    • Require availability of the Web Streams API, since it's now supported in all browsers (applications can load a polyfill if they need to support older browser versions: see README)
    • Require availability of native BigInts (not supported by e.g. Safari 13 and below, see full compatibility table)
    • Argon2 has been added as S2K algorithm (on all platforms). For performance reasons, the implementation relies on a WASM module, thus web apps might need to make changes to their CSP policy in order to use the feature. Alternatively, since the Argon2 WASM module is only loaded if needed, apps can manually reject password-encrypted messages and private keys which use Argon2 by checking e.g. SymEncryptedSessionKeyPacket.s2k?.type === 'argon2' or SecretKeyPacket|SecretSubkeyPacket.keyPacket.s2k?.type === 'argon2'.

Breaking API changes

  • Ensure primary key meets strength and algo requirements when encrypting/verifying/signing using subkeys (#1719)
  • read[Private]Key: support parsing key blocks (return first parsable key); previously, parsing would fail if a block with more than one key was given in input (#1755)
  • PrivateKey.getDecryptionKeys will now throw if no decryption key is found (#1789). Previously, an empty array was returned. As a consequence of this change, some openpgp.decrypt errors will be more specific.
  • Refuse to use keys without key flags (see config.allowMissingKeyFlags below)

... (truncated)

Commits
  • cacf5c4 6.1.1
  • bd54e85 Don't mutate message during verification
  • 96b13a4 6.1.0
  • 432856f Fix signing using keys without preferred hash algorithms (#1820)
  • b2bd8a0 Merge pull request #1812
  • 6db98f1 Internal: improve tree-shaking in armor module
  • 8e5da78 Internal: improve tree-shaking of web-stream-tools
  • a5d894f Internal: avoid importing enums in legacy_cipher chunk
  • a16160f Use noble-hashes for md5
  • abe750c Lightweight build: lazy load md5 hashing module
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by twiss, a new releaser for openpgp since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

dependabot[bot] avatar Oct 08 '25 22:10 dependabot[bot]

12:05:18 AM: error [email protected]: The engine "node" is incompatible with this module. Expected version ">= 18.0.0". Got "14.17.0"

blocked on node bump, e.g. , #1205

mal-tee avatar Oct 21 '25 21:10 mal-tee

Just for the record: I did verify that the security fixes in the newer version don't affect our use case.

baltpeter avatar Oct 22 '25 10:10 baltpeter