mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-27 16:41:25 +00:00
thePR0M3TH3ANandClaude Fable 5
6eb1d7d640
A Dependabot PR failed the build by bundling @noble/hashes 1.8->2.2, @noble/curves 1.9->2.2, @scure/base 1.2->2.2, @scure/bip39 1.6->2.2, TypeScript 5->7, Vite 6->8 and Vitest 3->4 into a single change. Production was never affected -- only that preview -- and the cause is real rather than flaky: noble v2 exports only ".js"-suffixed subpaths, while this code imports the extensionless "@noble/hashes/sha2" that 1.8 provides. Failing to compile was the LUCKY outcome. The tests could not have caught the dangerous version of this. Account capsules live on public relays, and the login name plus password derive the locator, signing scalar and capsule key deterministically -- so those outputs are a compatibility contract with every account that already exists. The crypto suite only checked self-consistency (same input, same output within one run), which stays green even if HKDF, base64url framing, BIP-39 seeding or JCS ordering all change. A grouped major that compiled would have shipped and locked every existing user out, with no server-side record to migrate them from. So this adds knownAnswer.test.ts, pinning the actual outputs of HKDF-Extract, HKDF-Expand, ScalarExpand (scalar, counter and resulting public key), BIP-39 phrase and seed, base64url, and JCS ordering. The vectors are captured from the shipping implementation, and the header says plainly what a failure means: not "update the expected value", but "this upgrade is account-breaking". dependabot.yml now groups only minor and patch updates. Majors are still proposed, individually, so each can be judged on its own. Majors of the derivation chain itself (@noble/*, @scure/*, hash-wasm, canonicalize) are ignored entirely -- that is deliberate work with the vectors green, not an automated PR waiting to be merged on a quiet afternoon. 172/172 tests, typecheck clean. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CMr9Yt8SYmZcfgrg3CV2G1
53 lines
2.2 KiB
YAML
53 lines
2.2 KiB
YAML
# Dependency updates.
|
|
#
|
|
# The original config grouped `*` with no update-type restriction, so its very
|
|
# first PR bundled @noble/hashes 1.8->2.2, @noble/curves 1.9->2.2, @scure/base
|
|
# 1.2->2.2, @scure/bip39 1.6->2.2, TypeScript 5->7, Vite 6->8 and Vitest 3->4
|
|
# into one change. It failed the build outright (noble v2 dropped the
|
|
# extensionless subpath exports this code imports), which was the lucky
|
|
# outcome -- a grouped major that COMPILED would have been far worse.
|
|
#
|
|
# The reason to be careful here is specific to this project. Account capsules
|
|
# live on public relays and the login name plus password derive the locator,
|
|
# signing scalar and capsule key deterministically. Those outputs are a
|
|
# compatibility contract with every account that already exists: change HKDF,
|
|
# the scalar loop, base64url framing, BIP-39 seeding or JCS ordering and users
|
|
# are locked out permanently, with no server-side record to migrate. See
|
|
# packages/core/src/crypto/knownAnswer.test.ts, which pins those values so an
|
|
# upgrade that alters them fails loudly instead of shipping.
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: npm
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
# Only non-breaking updates travel together. Majors still get proposed,
|
|
# but individually, so each can be judged on its own merits instead of
|
|
# arriving as one unreviewable pile.
|
|
minor-and-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
ignore:
|
|
# The derivation chain. A major here is an account-compatibility event,
|
|
# not a maintenance chore, so it should be a deliberate piece of work
|
|
# with the known-answer vectors green -- never an automated PR waiting to
|
|
# be merged on a quiet afternoon.
|
|
- dependency-name: "@noble/*"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "@scure/*"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "hash-wasm"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "canonicalize"
|
|
update-types: ["version-update:semver-major"]
|
|
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|