source: trip-planner-front/node_modules/node-forge/CHANGELOG.md@ 8d391a1

Last change on this file since 8d391a1 was 6a3a178, checked in by Ema <ema_spirova@…>, 3 years ago

initial commit

  • Property mode set to 100644
File size: 9.3 KB
Line 
1Forge ChangeLog
2===============
3
4## 0.10.0 - 2019-09-01
5
6### Changed
7- **BREAKING**: Node.js 4 no longer supported. The code *may* still work, and
8 non-invasive patches to keep it working will be considered. However, more
9 modern tools no longer support old Node.js versions making testing difficult.
10
11### Removed
12- **BREAKING**: Remove `util.getPath`, `util.setPath`, and `util.deletePath`.
13 `util.setPath` had a potential prototype pollution security issue when used
14 with unsafe inputs. These functions are not used by `forge` itself. They date
15 from an early time when `forge` was targeted at providing general helper
16 functions. The library direction changed to be more focused on cryptography.
17 Many other excellent libraries are more suitable for general utilities. If
18 you need a replacement for these functions, consier `get`, `set`, and `unset`
19 from [lodash](https://lodash.com/). But also consider the potential similar
20 security issues with those APIs.
21
22## 0.9.2 - 2019-09-01
23
24### Changed
25- Added `util.setPath` security note to function docs and to README.
26
27### Notes
28- **SECURITY**: The `util.setPath` function has the potential to cause
29 prototype pollution if used with unsafe input.
30 - This function is **not** used internally by `forge`.
31 - The rest of the library is unaffected by this issue.
32 - **Do not** use unsafe input with this function.
33 - Usage with known input should function as expected. (Including input
34 intentionally using potentially problematic keys.)
35 - No code changes will be made to address this issue in 0.9.x. The current
36 behavior *could* be considered a feature rather than a security issue.
37 0.10.0 will be released that removes `util.getPath` and `util.setPath`.
38 Consider `get` and `set` from [lodash](https://lodash.com/) if you need
39 replacements. But also consider the potential similar security issues with
40 those APIs.
41 - https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677
42 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720
43
44## 0.9.1 - 2019-09-26
45
46### Fixed
47- Ensure DES-CBC given IV is long enough for block size.
48
49## 0.9.0 - 2019-09-04
50
51### Added
52- Add ed25519.publicKeyFromAsn1 and ed25519.privateKeyFromAsn1 APIs.
53- A few OIDs used in EV certs.
54
55### Fixed
56- Improve ed25519 NativeBuffer check.
57
58## 0.8.5 - 2019-06-18
59
60### Fixed
61- Remove use of `const`.
62
63## 0.8.4 - 2019-05-22
64
65### Changed
66- Replace all instances of Node.js `new Buffer` with `Buffer.from` and `Buffer.alloc`.
67
68## 0.8.3 - 2019-05-15
69
70### Fixed
71- Use basic character set for code.
72
73## 0.8.2 - 2019-03-18
74
75### Fixed
76- Fix tag calculation when continuing an AES-GCM block.
77
78### Changed
79- Switch to eslint.
80
81## 0.8.1 - 2019-02-23
82
83### Fixed
84- Fix off-by-1 bug with kem random generation.
85
86## 0.8.0 - 2019-01-31
87
88### Fixed
89- Handle creation of certificates with `notBefore` and `notAfter` dates less
90 than Jan 1, 1950 or greater than or equal to Jan 1, 2050.
91
92### Added
93- Add OID 2.5.4.13 "description".
94- Add OID 2.16.840.1.113730.1.13 "nsComment".
95 - Also handle extension when creating a certificate.
96- `pki.verifyCertificateChain`:
97 - Add `validityCheckDate` option to allow checking the certificate validity
98 period against an arbitrary `Date` or `null` for no check at all. The
99 current date is used by default.
100- `tls.createConnection`:
101 - Add `verifyOptions` option that passes through to
102 `pki.verifyCertificateChain`. Can be used for the above `validityCheckDate`
103 option.
104
105### Changed
106- Support WebCrypto API in web workers.
107- `rsa.generateKeyPair`:
108 - Use `crypto.generateKeyPair`/`crypto.generateKeyPairSync` on Node.js if
109 available (10.12.0+) and not in pure JS mode.
110 - Use JS fallback in `rsa.generateKeyPair` if `prng` option specified since
111 this isn't supported by current native APIs.
112 - Only run key generation comparison tests if keys will be deterministic.
113- PhantomJS is deprecated, now using Headless Chrome with Karma.
114- **Note**: Using Headless Chrome vs PhantomJS may cause newer JS features to
115 slip into releases without proper support for older runtimes and browsers.
116 Please report such issues and they will be addressed.
117- `pki.verifyCertificateChain`:
118 - Signature changed to `(caStore, chain, options)`. Older `(caStore, chain,
119 verify)` signature is still supported. New style is to to pass in a
120 `verify` option.
121
122## 0.7.6 - 2018-08-14
123
124### Added
125- Test on Node.js 10.x.
126- Support for PKCS#7 detached signatures.
127
128### Changed
129- Improve webpack/browser detection.
130
131## 0.7.5 - 2018-03-30
132
133### Fixed
134- Remove use of `const`.
135
136## 0.7.4 - 2018-03-07
137
138### Fixed
139- Potential regex denial of service in form.js.
140
141### Added
142- Support for ED25519.
143- Support for baseN/base58.
144
145## 0.7.3 - 2018-03-05
146
147- Re-publish with npm 5.6.0 due to file timestamp issues.
148
149## 0.7.2 - 2018-02-27
150
151### Added
152- Support verification of SHA-384 certificates.
153- `1.2.840.10040.4.3'`/`dsa-with-sha1` OID.
154
155### Fixed
156- Support importing PKCS#7 data with no certificates. RFC 2315 sec 9.1 states
157 certificates are optional.
158- `asn1.equals` loop bug.
159- Fortuna implementation bugs.
160
161## 0.7.1 - 2017-03-27
162
163### Fixed
164
165- Fix digestLength for hashes based on SHA-512.
166
167## 0.7.0 - 2017-02-07
168
169### Fixed
170
171- Fix test looping bugs so all tests are run.
172- Improved ASN.1 parsing. Many failure cases eliminated. More sanity checks.
173 Better behavior in default mode of parsing BIT STRINGs. Better handling of
174 parsed BIT STRINGs in `toDer()`. More tests.
175- Improve X.509 BIT STRING handling by using new capture modes.
176
177### Changed
178
179- Major refactor to use CommonJS plus a browser build system.
180- Updated tests, examples, docs.
181- Updated dependencies.
182- Updated flash build system.
183- Improve OID mapping code.
184- Change test servers from Python to JavaScript.
185- Improve PhantomJS support.
186- Move Bower/bundle support to
187 [forge-dist](https://github.com/digitalbazaar/forge-dist).
188- **BREAKING**: Require minimal digest algorithm dependencies from individual
189 modules.
190- Enforce currently supported bit param values for byte buffer access. May be
191 **BREAKING** for code that depended on unspecified and/or incorrect behavior.
192- Improve `asn1.prettyPrint()` BIT STRING display.
193
194### Added
195
196- webpack bundler support via `npm run build`:
197 - Builds `.js`, `.min.js`, and basic sourcemaps.
198 - Basic build: `forge.js`.
199 - Build with extra utils and networking support: `forge.all.js`.
200 - Build WebWorker support: `prime.worker.js`.
201- Browserify support in package.json.
202- Karma browser testing.
203- `forge.options` field.
204- `forge.options.usePureJavaScript` flag.
205- `forge.util.isNodejs` flag (used to select "native" APIs).
206- Run PhantomJS tests in Travis-CI.
207- Add "Donations" section to README.
208- Add IRC to "Contact" section of README.
209- Add "Security Considerations" section to README.
210- Add pbkdf2 usePureJavaScript test.
211- Add rsa.generateKeyPair async and usePureJavaScript tests.
212- Add .editorconfig support.
213- Add `md.all.js` which includes all digest algorithms.
214- Add asn1 `equals()` and `copy()`.
215- Add asn1 `validate()` capture options for BIT STRING contents and value.
216
217### Removed
218
219- **BREAKING**: Can no longer call `forge({...})` to create new instances.
220- Remove a large amount of old cruft.
221
222### Migration from 0.6.x to 0.7.x
223
224- (all) If you used the feature to create a new forge instance with new
225 configuration options you will need to rework your code. That ability has
226 been removed due to implementation complexity. The main rare use was to set
227 the option to use pure JavaScript. That is now available as a library global
228 flag `forge.options.usePureJavaScript`.
229- (npm,bower) If you used the default main file there is little to nothing to
230 change.
231- (npm) If you accessed a sub-resource like `forge/js/pki` you should either
232 switch to just using the main `forge` and access `forge.pki` or update to
233 `forge/lib/pki`.
234- (bower) If you used a sub-resource like `forge/js/pki` you should switch to
235 just using `forge` and access `forge.pki`. The bower release bundles
236 everything in one minified file.
237- (bower) A configured workerScript like
238 `/bower_components/forge/js/prime.worker.js` will need to change to
239 `/bower_components/forge/dist/prime.worker.min.js`.
240- (all) If you used the networking support or flash socket support, you will
241 need to use a custom build and/or adjust where files are loaded from. This
242 functionality is not included in the bower distribution by default and is
243 also now in a different directory.
244- (all) The library should now directly support building custom bundles with
245 webpack, browserify, or similar.
246- (all) If building a custom bundle ensure the correct dependencies are
247 included. In particular, note there is now a `md.all.js` file to include all
248 digest algorithms. Individual files limit what they include by default to
249 allow smaller custom builds. For instance, `pbdkf2.js` has a `sha1` default
250 but does not include any algorithm files by default. This allows the
251 possibility to include only `sha256` without the overhead of `sha1` and
252 `sha512`.
253
254### Notes
255
256- This major update requires updating the version to 0.7.x. The existing
257 work-in-progress "0.7.x" branch will be painfully rebased on top of this new
258 0.7.x and moved forward to 0.8.x or later as needed.
259- 0.7.x is a start of simplifying forge based on common issues and what has
260 appeared to be the most common usage. Please file issues with feedback if the
261 changes are problematic for your use cases.
262
263## 0.6.x - 2016 and earlier
264
265- See Git commit log or https://github.com/digitalbazaar/forge.
Note: See TracBrowser for help on using the repository browser.