[Security] pbkdf2

[FatahChan]

https://nvd.nist.gov/vuln/detail/CVE-2025-6545

need to upgrade pbkdf2

[priyankarkoley]

A very high security vulnerability has been detected please upgrade pbkdf to v3.1.3 as soon as possible.
GHSA-v62p-rq8g-8h59
GHSA-h7cp-r72f-jxh6

[ChALkeR]

1. crypto-browserify is not blocking pbkdf2 update downstream, patched pbkdf2 is compatible with crypto-browserify requested version range

restricting the minimum version here to non-vulnerable makes sense, but is no way urgent and won't make much difference

new installs would be on 3.1.3 anyway, old installs would still need to update the lockfile, and crypto-browserify is not blocking pbkdf2 bump in the lockfile

2. (read the advisory and) ideally avoid using crypto-browserify at all in favor of crypto.subtle and audited cryptography primitives

[patweb99]

I see the technical validity in your assessment that crypto-browserify isn't actively blocking pbkdf2 updates and that npm audit fix provides a mitigation path for existing projects.

I'd like to consider both the immediate workarounds and longer-term best practices:

While you're right that new installations will get v3.1.3+ and existing projects can run npm audit fix, many teams face practical challenges with this approach:

1. Automated security scanning tools in CI/CD pipelines (like AWS's Automated Security Helper) will continue flagging the critical vulnerability until the minimum required version is updated
2. Projects that regenerate lock files will repeatedly encounter this issue, requiring manual intervention each time

The industry standard for addressing known vulnerabilities in dependencies is typically to update the minimum required version, which provides both clarity and security by design.

Perhaps we could take a balanced approach: acknowledge that this isn't blocking urgent functionality, while still planning to update the minimum dependency version in an upcoming release to align with security best practices and improve developer experience?

This would address both the immediate technical reality while also working toward the cleaner long-term solution. Would that approach make sense?

[ChALkeR]

Both 1 and 2 are likely false?

Security scanners look at the lockfile, not at the minimum satisfying subdep range (or pls link to the documentation of the one that looks at subdep range instead )

A regenerated lockfile should use 3.1.3, not 3.1.2

As already mentioned, updating this in the next release makes sense, but cutting a new release just for this is unlikely to make any difference at all

[ljharb]

Semver ranges mean that issues like these asking to upgrade dependencies unnecessarily are always a waste of everyone’s time. You can update pbkdf2 in your own lockfile without anyone’s help, so there’s no point in creating more work for others.

[AtofStryker]

@ljharb I know this is closed as unplanned but I created a PR for whenever you all decide to cut the next release #243

For posterity for myself: Updating the lock file to resolve the issue in the meantime cypress-io/cypress#31941

[ljharb]

@AtofStryker please don't do that. a PR isn't needed and I don't plan a next release any time soon - there's no need for it whatsoever.

[patweb99]

I was able to get around the issue using overrides as mentioned here https://docs.npmjs.com/cli/v8/configuring-npm/package-json, which prevented me from needing to touch the lock file.

[ljharb]

@patweb99 you should be touching the lockfile; using an override is an unnecessary workaround.

[sblaisot]

Unfortunately, overrrides are not possible when transitive dependencies are bundled into one of your direct dependency package

[ljharb]

You also shouldn't be using any packages that bundle/vendor things :-)

[sblaisot]

Excuse me, but I think your peremptory responses are completely irrelevant and unprofessional.

Don't you see that your behavior is causing problems to your users?

[ljharb]

@sblaisot no, it's not. if you have a bundled dep, you're screwed anyways until you update that dep, and that update can include updating to the patched version of pbkdf2. If it's not bundled, you can easily update your lockfile.

Nothing I do here will make it any easier for you to get the patched version in your dep tree.

Separately, my responses, while perhaps overly curt, are still good advice and best practices. If you aren't interested in that, that's fine, but perhaps the next thousand people who come through will be.