Remove discontinued crypto-js
package
#2608
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What is the purpose of this pull request?
Partially addresses #2607.
Overview of changes:
As brought up with #2607, there are several
npm
vulnerabilities we could take a look at and potentially address.This PR resolves the critical vulnerability caused by the
crypto-js
package in particular (mainly because it stands out as the only critical vulnerability).Anything you'd like to highlight/discuss:
We started using the native
crypto
module in Node.js in #113, for themarkdown-it
radio buttons.After PlantUML was introduced as a plugin, we started using
crypto-js
instead of thecrypto
module in #1403, which was a massive PR (and likely was overlooked). Since then, thecrypto-js
package was discontinued, and thenpm
package webpage even directly suggests using the nativecrypto
module instead.The vulnerability introduced by
crypto-js
is as seen here.Given the use case for
crypto-js
in MarkBind was just for generating MD5 hashes in the PlantUML plugin (where security is not really a huge concern), it is not a critical issue on our end. Still, keeping the standard consistent and removing the scary critical keyword, in my opinion, is still a worthwhile improvement.This PR simply removes the package and replaces the usage of
crypto-js
for MD5 hashes with that of the nativecrypto
module.Testing instructions:
Proposed commit message: (wrap lines at 72 characters)
Remove discontinued
crypto-js
packageChecklist: ☑️
Reviewer checklist:
Indicate the SEMVER impact of the PR:
At the end of the review, please label the PR with the appropriate label:
r.Major
,r.Minor
,r.Patch
.Breaking change release note preparation (if applicable):