Release JavaScript SDK v18.0.0 - #1126
Draft
stas-schaller wants to merge 12 commits into
Draft
Conversation
…stead of throwing
#1079) * chore(javascript): humanize comments and test names on the release branch Ticket refs belong in commit messages, not code; test names now describe the behavior under test instead of the ticket that prompted it. No behavior change.
…flat response array (#1076) Records created via non-SDK clients inside shared folders arrive in the flat response.records[] with innerFolderUid set, but recordKey is wrapped with the folder key, not the app key. The unconditional KEY_APP_KEY unwrap caused these records to be silently skipped. Mirrors the folderKeyMap pattern already shipped in the Java SDK (KSM-753).
…ap (#1077) * fix(javascript): KSM-1035 one-sided throttle jitter and retry_after cap throttleJitter previously returned [-0.25, 0.25), so a retry could fire before the computed backoff floor and immediately re-trigger the same throttle window. Narrowed to [0, 0.25), one-sided like the already-shipped Ruby fix (KSM-883). Also caps a server-supplied retry_after at MAX_THROTTLE_DELAY_SEC (176s), the same ceiling the exponential branch already reaches on its last retry. * fix(javascript): address KSM-1035 review feedback - Fix stale JSDoc on throttleDelay: jitter range is [0, 0.25) not [-0.25, 0.25) - Update jitter-bounds unit test to reflect one-sided range (floor is 11s not 8.25s) - Add 17.6.0 CHANGELOG entry for KSM-1035
All three are dev-only in this package (ts-jest transitive chain), never shipped: - minimatch -> 9.0.9 (CVE-2026-27903, CVE-2026-27904 ReDoS) - @babel/core -> 7.29.7 (CVE-2026-49356, arbitrary file read via sourceMappingURL) - handlebars -> 4.7.9 (CVE-2026-33938, CVE-2026-33941) Lockfile-only, no package.json range changes. Cherry-picked and scoped to sdk/javascript/packages/core/package-lock.json from 831b7b48, efde007d, and b9aef2fa (Sergey Aldoukhov). KSM-1217
createFolder was encrypting folder keys and data with AES-CBC (128-byte IV block cipher output). The server expects GCM (60-byte output: 12-byte IV + ciphertext + 16-byte tag). CBC-created folders were rejected silently or produced corrupted data on read-back. Changes: - prepareCreateFolderPayload: drop useCBC=true from both encryptWithKey and encrypt calls so new folders use GCM by default - fetchAndDecryptFolders: detect cipher from encrypted key length (60 bytes = GCM, 64 bytes = CBC) and set decryptedFolder.useGcm; pass the derived useCBC flag to unwrap and decrypt so existing CBC folders continue to decrypt correctly - KeeperFolder type: add optional useGcm field - prepareUpdateFolderPayload / updateFolder: accept optional useGcm parameter so callers updating a folder can match the cipher used at creation time
stas-schaller
marked this pull request as draft
August 31, 2026 19:12
…anch
KSM-1058 landed with package.json left at 17.6.0, inconsistent with
the release/sdk/javascript/core/v18.0.0 branch name. The wire-level
clientVersion ('ms' + packageVersion) is derived from this field at
build time, so this also fixes what the SDK reports over the wire.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release branch for v18.0.0 of the JavaScript SDK. Bundles bug fixes for folder key handling, getFolders crash safety, per-item delete error surfacing, and throttle retry behavior.
Changes
Bug Fixes
getFolders()failed with "appKey missing" when called as the first method on a freshly bound application. It now processesencryptedAppKeyfrom the server binding response the same waygetSecrets()does.getSecrets()silently dropped records created by Commander or the Vault UI inside shared folders. The SDK now uses the folder key to decrypt the record key for any flat record that hasinnerFolderUidset.getFolders()threw when any folder in the response had a corrupted or missing key. The SDK now skips undecryptable folders and returns the rest normally.deleteSecret()anddeleteFolder()silently reported success when the server rejected some UIDs. The SDK now surfaces per-item error messages from the server.retry_afterat 176s.New Features
dbConnectionMethodtoPamSettingsConnection.Maintenance
minimatch,@babel/core, andhandlebarsdev dependencies.Breaking Changes
None.
Security Impact
KSM-1042 touches the initial key derivation path:
fetchAndDecryptFoldersnow decryptsencryptedAppKeyusing the client key and stores the result as the app master key, matching the behavior already infetchAndDecryptSecrets. The fix introduces no new cryptographic operations; it applies the same unwrap call that secrets binding already uses.Related Issues