michaellperry / jinaga

Universal web back-end, offering an application-agnostic API, real-time collaboration, and conflict resolution.
http://jinaga.com
MIT License
35 stars 3 forks source link

An in-range update of tweetnacl is breaking the build 🚨 #55

Closed greenkeeper[bot] closed 4 years ago

greenkeeper[bot] commented 4 years ago

The dependency tweetnacl was updated from 1.0.2 to 1.0.3.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

tweetnacl is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details - ❌ **Jinaga-CI:** #1770 failed ([Details](https://michaellperry.visualstudio.com/97552985-6bac-4aed-9654-6b583e381b75/_build/results?buildId=1770)).

Release Notes for Important security fix

IMPORTANT BUG FIX. Due to a bug in calculating carry in
modulo reduction that used bit operations on integers larger than
32 bits, nacl.sign or nacl.sign.detached could have created
incorrect signatures.

This only affects signing, not verification.

Thanks to @valerini on GitHub for finding and reporting the bug.

Commits

The new version differs by 4 commits.

See the full diff

FAQ and help There is a collection of [frequently asked questions](https://greenkeeper.io/faq.html). If those don’t help, you can always [ask the humans behind Greenkeeper](https://github.com/greenkeeperio/greenkeeper/issues/new).

Your Greenkeeper Bot :palm_tree:

greenkeeper[bot] commented 4 years ago

After pinning to 1.0.2 your tests are passing again. Downgrade this dependency πŸ“Œ.

michaellperry commented 4 years ago

False positive.