Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 27, 2025

Bumps the npm_and_yarn group with 2 updates in the / directory: openpgp and renovate.

Updates openpgp from 5.11.1 to 6.2.0

Release notes

Sourced from openpgp's releases.

v6.2.0

What's Changed

  • Implement OpenPGP message grammar validation (add config.enforceGrammar, enabled by default) (#1853)
  • Enable using WebCrypto for X25519 when available (#1829)
  • Prefer subkeys with higher algorithm IDs (in case of equal creation timestamps), on the assumption that that's the most modern/secure algorithm (#1854)
  • Improve packet stream & error handling (#1856):
    • Packet parsing errors in not-yet-authenticated streams (i.e. SEIPDv1 with allowUnauthenticatedStream: true) get delayed until the decrypted data stream is authenticated
    • Non-critical unknown packets get turned into UnparseablePacket` objects on the packet stream instead of being ignored
  • Make Issuer Key ID signature subpacket non-critical (#1828)
  • Improve type definition for the User class (#1857)

New Contributors

Full Changelog: openpgpjs/openpgpjs@v6.1.0...v6.2.0

v6.1.1 - Security Patch

  • Address CVE-2025-47934 (Message signature verification could be spoofed)

v6.1.0

What's Changed

  • Fix decryption support for non-standard, legacy AEAD-encrypted messages and keys that used experimentalGCM from OpenPGP.js v5 (openpgpjs/openpgpjs#1811)
  • Throw on encryption using the non-standard experimentalGCM AEAD algorithm (The enums.aead.gcm ID standardized by RFC9580 should be used instead.)
  • Improve internal tree-shaking and lazy load md5 (openpgpjs/openpgpjs#1812)
  • Fix signing using keys without preferred hash algorithms (openpgpjs/openpgpjs#1820)

Full Changelog: openpgpjs/openpgpjs@v6.0.1...v6.1.0

v6.0.1

What's Changed

  • Fix ES imports for webpack: declare exports.browser entrypoint as higher priority than import
  • Fix openpgp.verify/decrypt with expectSigned: true and format: 'binary' (#1805)
  • TS: fix generateKey (options.type) and PrivateKey.getDecryptionKeys() type declarations (#1807)
  • Update hash algorithm preferences order by (#1804)

Full Changelog: openpgpjs/openpgpjs@v6.0.0...v6.0.1

v6.0.0

What's Changed

OpenPGP.js v6 adds support for the new version of the OpenPGP specification, RFC 9580. It also increases compliance with the specification, as demonstrated by the OpenPGP interoperability test suite.

OpenPGP.js v6 only makes minor API changes. This is the first stable release of OpenPGP.js v6: no more breaking changes to the high-level API will be made until the next major release.

... (truncated)

Commits
  • c30404c 6.2.0
  • 732f3c8 Tests: bump playwright from 1.53.0 to 1.54.1 (#1872)
  • 24f776a Merge pull request #1870
  • 9703ab8 Add workaround for WebCrypto X25519 key generation bug on WebKit Linux
  • b927564 Add workaround for WebCrypto X25519 key export bug on WebKit Linux
  • d155da2 Revert "CI: do not test Webkit on Linux"
  • 448418a Bump @​noble/curves from 1.9.0 to 1.9.2 in the noble group (#1855)
  • 208402e Merge pull request #1850
  • 232da14 Tests: revert update to chai v5
  • cabc91c Bump dev dependencies to latest versions
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by larabr, a new releaser for openpgp since your current version.


Updates renovate from 37.374.1 to 41.43.5

Release notes

Sourced from renovate's releases.

41.43.5

41.43.5 (2025-07-26)

Bug Fixes

  • deps: update dependency mkdocs-material to v9.6.16 (main) (#37175) (46433cd)

41.43.4

41.43.4 (2025-07-26)

Bug Fixes

  • deps: update ghcr.io/renovatebot/base-image docker tag to v10.22.3 (main) (#37174) (effad5a)

Miscellaneous Chores

  • deps: update dependency @​types/node to v22.16.5 (main) (#37171) (67fb5e9)
  • deps: update dependency esbuild to v0.25.7 (main) (#37170) (9ceca6e)
  • deps: update dependency eslint-config-prettier to v10.1.8 (main) (#37169) (d174570)
  • deps: update dependency nock to v14.0.6 (main) (#37173) (b14b29c)

41.43.3

41.43.3 (2025-07-25)

Bug Fixes

  • deps: update ghcr.io/renovatebot/base-image docker tag to v10.22.2 (main) (#37163) (b36be80)

Documentation

Code Refactoring

41.43.2

41.43.2 (2025-07-24)

Bug Fixes

  • deps: update ghcr.io/renovatebot/base-image docker tag to v10.22.1 (main) (#37154) (941fea1)

41.43.1

41.43.1 (2025-07-24)

Miscellaneous Chores

  • deps: update python:3.13 docker digest to 4ea7712 (main) (#37144) (c8203e6)

... (truncated)

Commits
  • 46433cd fix(deps): update dependency mkdocs-material to v9.6.16 (main) (#37175)
  • effad5a fix(deps): update ghcr.io/renovatebot/base-image docker tag to v10.22.3 (main...
  • b14b29c chore(deps): update dependency nock to v14.0.6 (main) (#37173)
  • 67fb5e9 chore(deps): update dependency @​types/node to v22.16.5 (main) (#37171)
  • 9ceca6e chore(deps): update dependency esbuild to v0.25.7 (main) (#37170)
  • d174570 chore(deps): update dependency eslint-config-prettier to v10.1.8 (main) (#37169)
  • b36be80 fix(deps): update ghcr.io/renovatebot/base-image docker tag to v10.22.2 (main...
  • b2a51c5 docs(configuration-overview): delete duplication (#37156)
  • 639d259 refactor: unify more types (#37148)
  • 941fea1 fix(deps): update ghcr.io/renovatebot/base-image docker tag to v10.22.1 (main...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates

Bumps the npm_and_yarn group with 2 updates in the / directory: [openpgp](https://github.com/openpgpjs/openpgpjs) and [renovate](https://github.com/renovatebot/renovate).


Updates `openpgp` from 5.11.1 to 6.2.0
- [Release notes](https://github.com/openpgpjs/openpgpjs/releases)
- [Commits](openpgpjs/openpgpjs@v5.11.1...v6.2.0)

Updates `renovate` from 37.374.1 to 41.43.5
- [Release notes](https://github.com/renovatebot/renovate/releases)
- [Changelog](https://github.com/renovatebot/renovate/blob/main/.releaserc.json)
- [Commits](renovatebot/renovate@37.374.1...41.43.5)

---
updated-dependencies:
- dependency-name: openpgp
  dependency-version: 6.2.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: renovate
  dependency-version: 41.43.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 27, 2025
@dependabot dependabot bot requested a review from a team as a code owner July 27, 2025 00:34
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant