Visitar URL original
Comparing v3.1.6...v3.1.7 · browserify/pbkdf2 · GitHub
Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: browserify/pbkdf2
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v3.1.6
Choose a base ref
...
head repository: browserify/pbkdf2
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v3.1.7
Choose a head ref
  • 4 commits
  • 4 files changed
  • 1 contributor

Commits on Sep 29, 2026

  1. [Fix] hash long passwords once, not on every iteration 

    `lib/sync.js` passed the raw password to `createHmac` on every iteration,
and HMAC hashes any key longer than the digest's block size (RFC 2104),
so a long password was rehashed on every iteration: O(iterations × password length).
Pre-hash it once up front, which produces identical output.

This path is used on node < 0.12, on Bun and Deno (whose `pbkdf2Sync` fails the native check),
and via direct imports of `pbkdf2/lib/sync`.
`lib/sync-browser.js` already did this.

See GHSA-477h-4r7f-fvrx
    @ljharb
    ljharb committed Sep 29, 2026
    Configuration menu
    Copy the full SHA
    493d8d8 View commit details
    Browse the repository at this point in the history

  2. [Dev Deps] update @arethetypeswrong/cli, @ljharb/eslint-config, `… 

    …@types/node`, `auto-changelog`, `tape`

Also run `npx dt-clean --setup
    @ljharb
    ljharb committed Sep 29, 2026
    Configuration menu
    Copy the full SHA
    bbc305e View commit details
    Browse the repository at this point in the history

  3. [Tests] skip rmd160 in the long-password test on node 17

    @ljharb
    ljharb committed Sep 29, 2026
    Configuration menu
    Copy the full SHA
    3905818 View commit details
    Browse the repository at this point in the history

  4. v3.1.7

    @ljharb
    ljharb committed Sep 29, 2026
    Configuration menu
    Copy the full SHA
    e09b47a View commit details
    Browse the repository at this point in the history
Loading