Mirroristas/openpgpjs
2
0
Fork 0
mirror of https://github.com/openpgpjs/openpgpjs.git synced 2026-03-22 08:03:33 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,692 Commits 9 Branches 189 Tags
10e2e4fb65e11a6de07c9c53dddc86afe2c222ed
Commit Graph

2692 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
larabr
10e2e4fb65 Use constant-time select in modExp (#1984) 
modExp is used in some RSA, DSA and ElGamal operations.
With native bigints, the constant-time select no longer introduces
a considerable slowdown, so we switch to that to avoid secret-dependent branching,
which in principle enables e.g. cache timing attacks
(NB: these are still not relevant for our threat model).

Thanks to Yayu Wang, Kjell Dankert and Aastha Mehta from the
University of British Columbia for reporting the potential security
issue and validating the fix.
 2026-03-12 17:27:08 +01:00
dependabot[bot]
0e9eff6272 CI: Bump actions/upload-artifact from 6 to 7 (#1980) 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 17:18:58 +01:00
dependabot[bot]
7e05fc8c3d CI: Bump actions/download-artifact from 7 to 8 (#1979) 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v7...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 17:18:42 +01:00
dependabot[bot]
65e56d3cf9 Bump eslint-plugin-jsdoc from 61.7.1 to 62.5.0 (#1978) 
Bumps [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) from 61.7.1 to 62.5.0.
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v61.7.1...v62.5.0)

---
updated-dependencies:
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 62.5.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 17:18:26 +01:00
dependabot[bot]
3d818e7c1d Bump globals from 16.5.0 to 17.2.0 (#1977) 
Bumps [globals](https://github.com/sindresorhus/globals) from 16.5.0 to 17.2.0.
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v16.5.0...v17.2.0)

---
updated-dependencies:
- dependency-name: globals
  dependency-version: 17.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 17:17:56 +01:00
dependabot[bot]
0e84a14845 Bump the dev-dependencies group with 7 updates (#1976) 
Bumps the dev-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.2` | `9.39.3` |
| [@stylistic/eslint-plugin](https://github.com/eslint-stylistic/eslint-stylistic/tree/HEAD/packages/eslint-plugin) | `5.7.1` | `5.9.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.10.9` | `24.10.15` |
| [bn.js](https://github.com/indutny/bn.js) | `5.2.2` | `5.2.3` |
| [eslint](https://github.com/eslint/eslint) | `9.39.2` | `9.39.3` |
| [rollup](https://github.com/rollup/rollup) | `4.57.1` | `4.59.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.54.0` | `8.56.1` |


Updates `@eslint/js` from 9.39.2 to 9.39.3
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v9.39.3/packages/js)

Updates `@stylistic/eslint-plugin` from 5.7.1 to 5.9.0
- [Release notes](https://github.com/eslint-stylistic/eslint-stylistic/releases)
- [Changelog](https://github.com/eslint-stylistic/eslint-stylistic/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint-stylistic/eslint-stylistic/commits/v5.9.0/packages/eslint-plugin)

Updates `@types/node` from 24.10.9 to 24.10.15
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `bn.js` from 5.2.2 to 5.2.3
- [Release notes](https://github.com/indutny/bn.js/releases)
- [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/indutny/bn.js/compare/v5.2.2...v5.2.3)

Updates `eslint` from 9.39.2 to 9.39.3
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v9.39.2...v9.39.3)

Updates `rollup` from 4.57.1 to 4.59.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v4.57.1...v4.59.0)

Updates `typescript-eslint` from 8.54.0 to 8.56.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.56.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 9.39.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@stylistic/eslint-plugin"
  dependency-version: 5.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 24.10.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: bn.js
  dependency-version: 5.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 9.39.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: rollup
  dependency-version: 4.59.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.56.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-12 17:17:27 +01:00
dependabot[bot]
343a527615 Bump qs from 6.14.1 to 6.15.0 (#1972) 
Bumps [qs](https://github.com/ljharb/qs) from 6.14.1 to 6.15.0.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/qs/compare/v6.14.1...v6.15.0)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.15.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-22 16:44:29 +05:00
dependabot[bot]
403c7d669b Bump browserstack-local from 1.5.6 to 1.5.10 (#1971) 
Bumps [browserstack-local](https://github.com/browserstack/browserstack-local-nodejs) from 1.5.6 to 1.5.10.
- [Release notes](https://github.com/browserstack/browserstack-local-nodejs/releases)
- [Commits](https://github.com/browserstack/browserstack-local-nodejs/compare/v1.5.6...v1.5.10)

---
updated-dependencies:
- dependency-name: browserstack-local
  dependency-version: 1.5.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-22 15:56:02 +05:00
Daniel Huigens
b3b6600409 Allow creating signature notations when generating/reformatting keys (#1953) 
When generating or reformatting keys, allow setting signature notations
on the primary self-signature (i.e. the User ID self-signature for v4
keys and the direct-key signature for v6 keys).
 2026-02-06 16:33:33 +01:00
Daniel Huigens
39f621c94e Fix RSA signing using SHA3 (#1952) 
Add missing OIDs / hash prefixes.
 2026-02-06 16:33:04 +01:00
dependabot[bot]
b62ea07fa3 Bump @types/node in the dev-dependencies group across 1 directory (#1968) 
Bumps the dev-dependencies group with 1 update in the / directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `@types/node` from 24.10.4 to 24.10.9
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 24.10.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-06 16:32:34 +01:00
dependabot[bot]
f0751fcb3d Bump lodash from 4.17.21 to 4.17.23 (#1967) 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-06 16:29:35 +01:00
dependabot[bot]
16481c9d5f Bump @types/chai from 4.3.20 to 5.2.3 (#1964) 
Bumps [@types/chai](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/chai) from 4.3.20 to 5.2.3.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/chai)

---
updated-dependencies:
- dependency-name: "@types/chai"
  dependency-version: 5.2.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-03 15:10:36 +01:00
dependabot[bot]
3e24462e05 Bump the dev-dependencies group with 4 updates (#1963) 
Bumps the dev-dependencies group with 4 updates: [@stylistic/eslint-plugin](https://github.com/eslint-stylistic/eslint-stylistic/tree/HEAD/packages/eslint-plugin), [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc), [rollup](https://github.com/rollup/rollup) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint).


Updates `@stylistic/eslint-plugin` from 5.6.1 to 5.7.1
- [Release notes](https://github.com/eslint-stylistic/eslint-stylistic/releases)
- [Changelog](https://github.com/eslint-stylistic/eslint-stylistic/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint-stylistic/eslint-stylistic/commits/v5.7.1/packages/eslint-plugin)

Updates `eslint-plugin-jsdoc` from 61.5.0 to 61.7.1
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v61.5.0...v61.7.1)

Updates `rollup` from 4.54.0 to 4.57.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v4.54.0...v4.57.0)

Updates `typescript-eslint` from 8.51.0 to 8.54.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.54.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@stylistic/eslint-plugin"
  dependency-version: 5.7.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 61.7.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: rollup
  dependency-version: 4.57.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.54.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-03 15:05:59 +01:00
dependabot[bot]
c23694d38a Bump @rollup/plugin-commonjs from 28.0.9 to 29.0.0 (#1958) 
Bumps [@rollup/plugin-commonjs](https://github.com/rollup/plugins/tree/HEAD/packages/commonjs) from 28.0.9 to 29.0.0.
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/commonjs/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/commonjs-v29.0.0/packages/commonjs)

---
updated-dependencies:
- dependency-name: "@rollup/plugin-commonjs"
  dependency-version: 29.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-03 15:05:37 +01:00
dependabot[bot]
fbbac861af Bump playwright from 1.57.0 to 1.58.1 (#1966) 
Bumps [playwright](https://github.com/microsoft/playwright) from 1.57.0 to 1.58.1.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.57.0...v1.58.1)

---
updated-dependencies:
- dependency-name: playwright
  dependency-version: 1.58.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-03 14:07:50 +01:00
dependabot[bot]
ffea6ee37d Bump qs from 6.14.0 to 6.14.1 (#1960) 
Bumps [qs](https://github.com/ljharb/qs) from 6.14.0 to 6.14.1.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/qs/compare/v6.14.0...v6.14.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-01-08 18:41:34 +01:00
dependabot[bot]
178efd8c9e Bump eslint-plugin-jsdoc from 60.8.3 to 61.4.1 (#1957) 
Bumps [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) from 60.8.3 to 61.4.1.
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v60.8.3...v61.4.1)

---
updated-dependencies:
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 61.4.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-01-08 18:41:07 +01:00
dependabot[bot]
c65ed58e46 Bump @rollup/plugin-alias from 5.1.1 to 6.0.0 (#1956) 
Bumps [@rollup/plugin-alias](https://github.com/rollup/plugins/tree/HEAD/packages/alias) from 5.1.1 to 6.0.0.
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/alias/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/url-v6.0.0/packages/alias)

---
updated-dependencies:
- dependency-name: "@rollup/plugin-alias"
  dependency-version: 6.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-01-08 18:40:52 +01:00
dependabot[bot]
66d2d6082c Bump eslint-plugin-unicorn from 61.0.2 to 62.0.0 (#1955) 
Bumps [eslint-plugin-unicorn](https://github.com/sindresorhus/eslint-plugin-unicorn) from 61.0.2 to 62.0.0.
- [Release notes](https://github.com/sindresorhus/eslint-plugin-unicorn/releases)
- [Commits](https://github.com/sindresorhus/eslint-plugin-unicorn/compare/v61.0.2...v62.0.0)

---
updated-dependencies:
- dependency-name: eslint-plugin-unicorn
  dependency-version: 62.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-01-08 15:54:58 +01:00
dependabot[bot]
6fa5f75bdf Bump the dev-dependencies group with 12 updates (#1954) 
Bumps the dev-dependencies group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.38.0` | `9.39.2` |
| [@stylistic/eslint-plugin](https://github.com/eslint-stylistic/eslint-stylistic/tree/HEAD/packages/eslint-plugin) | `5.5.0` | `5.6.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.9.2` | `24.10.4` |
| [chai](https://github.com/chaijs/chai) | `6.2.1` | `6.2.2` |
| [eslint](https://github.com/eslint/eslint) | `9.38.0` | `9.39.2` |
| [globals](https://github.com/sindresorhus/globals) | `16.4.0` | `16.5.0` |
| [mocha](https://github.com/mochajs/mocha) | `11.7.4` | `11.7.5` |
| [rollup](https://github.com/rollup/rollup) | `4.52.5` | `4.54.0` |
| [sinon](https://github.com/sinonjs/sinon) | `21.0.0` | `21.0.1` |
| [@types/sinon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sinon) | `17.0.4` | `21.0.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.20.6` | `4.21.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.46.2` | `8.51.0` |


Updates `@eslint/js` from 9.38.0 to 9.39.2
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v9.39.2/packages/js)

Updates `@stylistic/eslint-plugin` from 5.5.0 to 5.6.1
- [Release notes](https://github.com/eslint-stylistic/eslint-stylistic/releases)
- [Changelog](https://github.com/eslint-stylistic/eslint-stylistic/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint-stylistic/eslint-stylistic/commits/v5.6.1/packages/eslint-plugin)

Updates `@types/node` from 24.9.2 to 24.10.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `chai` from 6.2.1 to 6.2.2
- [Release notes](https://github.com/chaijs/chai/releases)
- [Changelog](https://github.com/chaijs/chai/blob/main/History.md)
- [Commits](https://github.com/chaijs/chai/compare/v6.2.1...v6.2.2)

Updates `eslint` from 9.38.0 to 9.39.2
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v9.38.0...v9.39.2)

Updates `globals` from 16.4.0 to 16.5.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v16.4.0...v16.5.0)

Updates `mocha` from 11.7.4 to 11.7.5
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/v11.7.5/CHANGELOG.md)
- [Commits](https://github.com/mochajs/mocha/compare/v11.7.4...v11.7.5)

Updates `rollup` from 4.52.5 to 4.54.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v4.52.5...v4.54.0)

Updates `sinon` from 21.0.0 to 21.0.1
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md)
- [Commits](https://github.com/sinonjs/sinon/compare/v21.0.0...v21.0.1)

Updates `@types/sinon` from 17.0.4 to 21.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sinon)

Updates `tsx` from 4.20.6 to 4.21.0
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.20.6...v4.21.0)

Updates `typescript-eslint` from 8.46.2 to 8.51.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.51.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 9.39.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@stylistic/eslint-plugin"
  dependency-version: 5.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 24.10.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: chai
  dependency-version: 6.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 9.39.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: globals
  dependency-version: 16.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: mocha
  dependency-version: 11.7.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: rollup
  dependency-version: 4.54.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: sinon
  dependency-version: 21.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@types/sinon"
  dependency-version: 21.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: tsx
  dependency-version: 4.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.51.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-01-08 15:54:01 +01:00
dependabot[bot]
9474f28950 CI: Bump actions/cache, upload-artifact and download-artifact (#1949) 
* CI: Bump actions/cache from 4 to 5

Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* CI: Bump actions/download-artifact from 6 to 7

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* CI: Bump actions/upload-artifact from 5 to 6

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-16 16:59:16 +01:00
larabr
6a8414d4c4 Merge pull request #1946 
CI: Browserstack stability improvements
 2025-12-15 11:24:49 +01:00
larabr
8801df51ec CI: Browserstack: enable retrial on unexpected test interruption 
Caused by page reloads in Safari, for unclear reasons.

Also, post test success status to Browserstack.
 2025-12-12 16:33:28 +01:00
larabr
7f0eec03ce Tests: Browserstack: set unique build id for local runs 
Useful for debugging
 2025-12-12 16:33:28 +01:00
dependabot[bot]
bfa569cc96 CI: Bump actions/checkout from 5 to 6 (#1944) 
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-12 14:43:12 +01:00
larabr
81d8639060 Merge pull request #1943 
Add `config.maxArgon2MemoryExponent` for argon2 memory limit
 2025-12-11 12:26:36 +01:00
larabr
870e383a38 Add config.maxArgon2MemoryExponent for argon2 memory limit 
This limit is applied both on encryption (if `config.s2kType` is set to `enums.s2k.argon2`)
and decryption.
If the input memory exponent exceeds this value, the library will not attempt the argon2 key
derivation and instead directly throw an `Argon2OutOfMemoryError` error.
 2025-12-09 15:08:08 +01:00
larabr
c796aa5163 CI: update mobile Safari 'latest' target to iOS 26 2025-12-09 15:08:08 +01:00
Daniel Huigens
e1cab74d1b 6.3.0 v6.3.0 2025-12-09 13:44:36 +01:00
Daniel Huigens
fccbc3ec42 Use native Compression Streams API when not streaming (#1935) 
Convert data to a web stream internally when (de)compressing, so that we
can use the native Compression Streams API, and then convert it back to
an ArrayStream, so that the output remains a non-stream.
 2025-12-09 11:58:13 +01:00
Daniel Huigens
a61cf1fcc8 Add config option to limit decompressed message size (#1933) 
Since decompression can increase the memory usage non-linearly, add a
`config.maxDecompressedMessageSize` option to limit the decompressed
message size. By default it's set to `Infinity`, i.e. no limit.
Set the config option to a number of bytes to limit the size of data
that gets decompressed.

Also, handle backpressure in fflate fallback; don't start
(de)compressing more data if the (de)compressed data stream reader
hasn't asked for more data yet.

Finally, split the input chunks so that we don't overwhelm the output
stream with a lot of data if the input chunks are very large, as the
fflate fallback and WebKit's implementation of the native Compression
API seem to decompress the input chunks completely before producing an
output chunk, which doesn't give us a chance to cancel the
decompression if too much data is provided.
 2025-12-09 11:51:51 +01:00
Daniel Huigens
6ab6b9c842 Tests: use native web streams when TransformStream is available (#1934) 
Only load the web streams ponyfill when necessary (e.g. Safari <14.5 and Mobile Safari <14.1)
 2025-12-05 13:59:08 +01:00
dependabot[bot]
1b2c842e60 [npm audit fix] bump glob and js-yaml (#1939) 
* Bump glob from 10.4.5 to 10.5.0

Bumps [glob](https://github.com/isaacs/node-glob) from 10.4.5 to 10.5.0.
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/node-glob/compare/v10.4.5...v10.5.0)

---
updated-dependencies:
- dependency-name: glob
  dependency-version: 10.5.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump js-yaml from 4.1.0 to 4.1.1

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-03 12:02:09 +01:00
Daniel Huigens
341354f6a8 Tests: Stub navigator.hardwareConcurrency in Node v21+ 
When running the tests in newer versions of Node.js, which support
navigator.hardwareConcurrency, stub the value to make the streaming
decryption test consistent on hardware with many CPU cores.
 2025-12-03 11:49:02 +01:00
Daniel Huigens
db9531df0f Tests: Bump mocha timeout for browser tests (#1941) 
The Argon2 memory-heavy test takes longer in Firefox.

Follow up fix to:
- 04c59a297a
- 4aad1d1e34
 2025-12-03 11:48:13 +01:00
larabr
d00821b49b CI: add workflow permissions (#1937) 2025-12-03 11:47:10 +01:00
dependabot[bot]
d27ef927b5 Bump playwright from 1.56.0 to 1.57.0 (#1936) 
Bumps [playwright](https://github.com/microsoft/playwright) from 1.56.0 to 1.57.0.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.56.0...v1.57.0)

---
updated-dependencies:
- dependency-name: playwright
  dependency-version: 1.57.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-01 14:40:12 +01:00
Daniel Huigens
1af590a417 Switch from seek-bzip to unbzip2-stream (#1887) 
To allow streaming decompression of bzip2 data.
 2025-11-17 14:52:28 +01:00
larabr
04c59a297a CI: increase browser timeout (all browsers) 
4aad1d1e34 was only targeting
Browserstack (by mistake). This applies the change to all browsers.
 2025-11-14 12:46:02 +01:00
dependabot[bot]
b374d37d4b Bump chai from 4.5.0 to 6.2.1 (#1929) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: larabr <7375870+larabr@users.noreply.github.com>
 2025-11-14 12:31:06 +01:00
larabr
7da8b81391 Merge pull request #1893 2025-11-13 16:57:59 +01:00
larabr
4aad1d1e34 CI: increase browser timeout 
To address argon2 large memory tests timing out on Firefox in macos runners.
 2025-11-13 16:08:05 +01:00
larabr
1e2b8290d8 Internal: use transformAsync over transform with async callbacks 2025-11-13 15:13:28 +01:00
Daniel Huigens
afa7e083de Use bufferless transforms 
Don't pull the input stream as much while the output stream isn't being
read yet.

This should reduce memory usage somewhat when streaming.
 2025-11-13 14:53:20 +01:00
dependabot[bot]
9764b268b3 Bump the dev-dependencies group with 10 updates (#1927) 
* Bump the dev-dependencies group with 10 updates

Bumps the dev-dependencies group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.37.0` | `9.38.0` |
| [@openpgp/web-stream-tools](https://github.com/openpgpjs/web-stream-tools) | `0.2.0` | `0.2.1` |
| [@rollup/plugin-commonjs](https://github.com/rollup/plugins/tree/HEAD/packages/commonjs) | `28.0.7` | `28.0.9` |
| [@rollup/plugin-replace](https://github.com/rollup/plugins/tree/HEAD/packages/replace) | `6.0.2` | `6.0.3` |
| [@rollup/plugin-typescript](https://github.com/rollup/plugins/tree/HEAD/packages/typescript) | `12.1.4` | `12.3.0` |
| [@stylistic/eslint-plugin](https://github.com/eslint-stylistic/eslint-stylistic/tree/HEAD/packages/eslint-plugin) | `5.4.0` | `5.5.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.7.2` | `24.9.2` |
| [eslint](https://github.com/eslint/eslint) | `9.37.0` | `9.38.0` |
| [rollup](https://github.com/rollup/rollup) | `4.52.4` | `4.52.5` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.46.1` | `8.46.2` |


Updates `@eslint/js` from 9.37.0 to 9.38.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v9.38.0/packages/js)

Updates `@openpgp/web-stream-tools` from 0.2.0 to 0.2.1
- [Commits](https://github.com/openpgpjs/web-stream-tools/compare/v0.2.0...v0.2.1)

Updates `@rollup/plugin-commonjs` from 28.0.7 to 28.0.9
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/commonjs/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/commonjs-v28.0.9/packages/commonjs)

Updates `@rollup/plugin-replace` from 6.0.2 to 6.0.3
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/replace/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/babel-v6.0.3/packages/replace)

Updates `@rollup/plugin-typescript` from 12.1.4 to 12.3.0
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/typescript/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/typescript-v12.3.0/packages/typescript)

Updates `@stylistic/eslint-plugin` from 5.4.0 to 5.5.0
- [Release notes](https://github.com/eslint-stylistic/eslint-stylistic/releases)
- [Changelog](https://github.com/eslint-stylistic/eslint-stylistic/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint-stylistic/eslint-stylistic/commits/v5.5.0/packages/eslint-plugin)

Updates `@types/node` from 24.7.2 to 24.9.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 9.37.0 to 9.38.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v9.37.0...v9.38.0)

Updates `rollup` from 4.52.4 to 4.52.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v4.52.4...v4.52.5)

Updates `typescript-eslint` from 8.46.1 to 8.46.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.2/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 9.38.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@openpgp/web-stream-tools"
  dependency-version: 0.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@rollup/plugin-commonjs"
  dependency-version: 28.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@rollup/plugin-replace"
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@rollup/plugin-typescript"
  dependency-version: 12.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@stylistic/eslint-plugin"
  dependency-version: 5.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 24.9.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 9.38.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: rollup
  dependency-version: 4.52.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.46.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* Tests: Rollup: drop unused rollup-typescript exception

It messed with the resolution of tweet-nacl for some reason,
where node:crypto references weren't properly dropped.

* Tests: Rollup: drop leftover requireReturnsDefault option in commonjs plugin

* Fix TS errors in eslint config file

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: larabr <7375870+larabr@users.noreply.github.com>
 2025-11-06 11:43:49 +01:00
dependabot[bot]
02aa1f788f Bump eslint-plugin-unicorn from 48.0.1 to 61.0.2 (#1928) 
Bumps [eslint-plugin-unicorn](https://github.com/sindresorhus/eslint-plugin-unicorn) from 48.0.1 to 61.0.2.
- [Release notes](https://github.com/sindresorhus/eslint-plugin-unicorn/releases)
- [Commits](https://github.com/sindresorhus/eslint-plugin-unicorn/compare/v48.0.1...v61.0.2)

---
updated-dependencies:
- dependency-name: eslint-plugin-unicorn
  dependency-version: 61.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-11-05 12:08:17 +01:00
larabr
eceda87110 JSDoc: make sure only user-facing entities are included in the docs, and add TS support (#1923) 
To make sure only user-facing entities are included in the docs,
since access is public by default.

NB: the top-level access directive seems to work to hide index entrypoint files,
but in other cases (e.g. s2k submodules), exported functions may need to
manually be marked as private.

Also, the 'initialCommentsOnly' rule sometimes reports false positives
in case of multiple comment blocks separated by new lines. The solution
is to remove the new lines.
 2025-11-05 12:01:56 +01:00
larabr
d88b842e11 JSDoc: update to v4.0.4 2025-11-05 12:01:02 +01:00
larabr
97d341a11f Linter: enforce JSDoc @access directive 
To make sure only user-facing entities are included in the docs,
since access is public by default.

NB: the top-level access directive seems to work to hide index entrypoint files,
but in other cases (e.g. s2k submodules), exported functions may need to
manually be marked as private.

Also, the 'initialCommentsOnly' rule sometimes reports false positives
in case of multiple comment blocks separated by new lines. The solution
is to remove the new lines.
 2025-11-05 12:01:02 +01:00