Release JavaScript SDK v17.5.0#1047
Open
stas-schaller wants to merge 32 commits into
Open
Conversation
KSM-901: add IL5 region mapping (il5.keepersecurity.us)
…7-4-1 KSM-758: replace rollup-plugin-sourcemaps with rollup-plugin-sourcemaps2
…add KSM-758 entry
…VE, 4.0.0-4.58.0)
…e picomatch HIGH (dev only)
- OTT parser: 4-segment IL5 format (IL5:clientKey:keyId:pubKey); save both serverPublicKeyId and serverPublicKey; non-IL5 regions unchanged - Rotation suppression: ignore server-pushed key_id hints when serverPublicKey is in storage (override mode) to prevent bricking - Constructor: add serverPublicKeyId to SecretManagerOptions; persist alongside serverPublicKey on first use - Tests: update Layer 2/3 tests for new format; add non-IL5 isolation test and rotation suppression test (16 tests pass) Closes KSM-901
KSM-901: JavaScript IL5 dynamic server public key support
- Add top-level permissions: contents: read - Pin actions/checkout and actions/setup-node to SHAs (v6.0.2, v6.3.0) - Add persist-credentials: false to all checkout steps - Pin ksm-action to SHA 37abbada (KSM-872 ReDoS fix) - Bump Node.js from EOL 18 to 22 in build and publish jobs - Bump Syft v1.18.1 -> v1.32.0; Manifest CLI v0.18.3 -> v0.31.0 - Pin actions/upload-artifact to SHA (v7.0.1) - Add get-version job to extract version once and share via outputs - Add test job (Node 22+24 matrix) as gate before build and SBOM - Add validate-version job to abort if version already on npm
validate-version now runs unconditionally (not just when publish=true) and both test and generate-sbom depend on it. A duplicate-version error fails fast before the test matrix or SBOM generation starts.
keeper.ts:
- Validate IL5 OTT token: reject >4 segments, non-integer keyId, short
public key; fixes silent misconfiguration on malformed tokens
- Throw clear error when server rejects a custom IL5 public key instead
of surfacing raw JSON error message
- Persist serverPublicKeyId in postQuery so write operations
(createSecret, updateSecret, etc.) honour the option, not only getSecrets
- Keep writes in fetchAndDecryptSecrets so they are available before
prepareGetPayload runs
keeper.test.ts:
- Replace bare catch{} in Layer 3 test with explicit rejects.toThrow
- Update rotation suppression test comment to note e2e coverage gap
- Replace localConfigStorage() with inMemoryStorage({}) in e2e test
- Remove unused localConfigStorage import
- Add IL5 OTT negative-path tests: >4 segments, non-integer keyId,
short public key, lowercase il5 prefix
test.js.yml: add Node 20 to test matrix (still Active LTS)
package.json: add engines field (node >=20)
CHANGELOG.md: document IL5 dynamic key injection feature (was missing)
publish.npm.yml: remove unused artifact upload from build-npm job;
add permissions:{} to validate-version job
manifest sbom CLI does not forward --version to Syft's --source-version flag, so Syft infers the version from git and produces a Go pseudo-version (v0.0.0-YYYYMMDDHHMMSS-hash) in the SPDX root package versionInfo field. Use the -- passthrough to explicitly set --source-name and --source-version on the Syft invocation so the SPDX document root reflects the real version. Also add get-version to generate-sbom needs so VERSION output is accessible.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
…984) Adds utility-level null checks to webSafe64ToRegular (utils.ts) and both platform base64ToBytes implementations (Node + browser) so that null/undefined config values produce a typed Error naming the bad input instead of a cryptic native TypeError or silent garbage decode.
…rage (KSM-887) Adds secureStorage(dbName) to the browser entry point. It generates a non-extractable AES-256-GCM CryptoKey stored natively in IndexedDB so the raw key bytes can never be exported, then encrypts all config values (strings and bytes) with that key before persisting them. KSM credentials are therefore never held in extractable form in browser storage.
…M-1010) Ports the Python KeeperRecordLink accessor class (KSM-992) to TypeScript. Renames the internal raw type to KeeperRecordLinkRaw; the new exported KeeperRecordLink class wraps a raw link entry with the owner record UID and exposes the full accessor surface: boolean permission flags with allowedSettings fallback, getLinkDataVersion, getDecodedData, hasReadableData, mightBeEncrypted, hasEncryptedData, getDecryptedData (AES-256-GCM via platform.decryptWithKey), getLinkData (auto plain-vs-encrypted), getAiSettingsData, getJitSettingsData, getMetaData, getSettingsForPath, getAllowedSettings, getRotationSettings. All accessors never throw. Adds getLinks(record) standalone function and 17 unit tests mirroring the Python test suite. Also adds per-call-site null guards in fetchAndDecryptSecrets for folder and record keys (KSM-984 parity, same file).
On HTTP 403 {"error":"throttled"}, postQuery now retries up to 5 times
with exponential backoff (11s, 22s, 44s, 88s, 176s) plus +/-25% jitter,
honoring retry_after from the response when present, and throws the new
KeeperThrottleError once retries are exhausted. Detection is gated on the
403 status and runs before the key-rotation handler so that path (incl. the
IL5 custom-key suppression) is unchanged.
Adds an optional throttleSleep seam on SecretManagerOptions for tests.
Strip internal JIRA ticket IDs from two comments in keeper.ts while keeping the surrounding explanations. Comment-only change; no behavior impact.
idimov-keeper
previously approved these changes
Jun 25, 2026
…per-error feat(sdk/javascript): add exported KeeperError base class (KSM-1025)
Moves SBOM generation after build-npm so Syft scans the actual dist/ output rather than the unbuilt source tree. build-npm uploads dist/ + package.json + package-lock.json as a short-lived artifact; generate-sbom downloads it, giving Syft real files to hash for a valid packageVerificationCode instead of the SHA1 of an empty set. Also bumps manifest-cli from v0.31.0 to v0.35.0.
This comment has been minimized.
This comment has been minimized.
- Add id-token: write to publish-npm job for OIDC - Node 24 + registry-url + npm upgrade to satisfy npm 11.5.1+ requirement - Remove KSM token retrieval; npm handles auth via short-lived OIDC token - Add --provenance for automatic attestation - Fix Syft config to use select-catalogers format - Add SBOM namespace template and jq filesAnalyzed fix - Cap SBOM artifact retention to 10 days
idimov-keeper
approved these changes
Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release branch for v17.5.0: adds throttle retry, secure browser storage, typed record link accessors, exported error base class, custom server key support, and two bug fixes.
Changes
New Features
{"error":"throttled"},postQueryretries up to 5 times with delays of 11s/22s/44s/88s/176s ±25% jitter, honoringretry_afterfrom the response. TypedKeeperThrottleErrorthrown on exhaustion.secureStorage(dbName)backend generates a non-extractable AES-256-GCMCryptoKeystored in IndexedDB so credentials are never held in extractable form.KeeperRecordLinkclass andgetLinks()function (TypeScript port of Python KSM-992) expose permission booleans, data accessors, and settings accessors; all non-throwing.KeeperErrorbase class (KSM-1025): SDK errors can now be distinguished from unexpected runtime failures viainstanceof KeeperError.KeeperThrottleErrorextendsKeeperError; existinginstanceof Errorhandling is unaffected.serverPublicKeyinjection — OTS token (IL5:TOKEN:keyId:publicKey),ClientConfigurationfields, andSecretManagerOptionsparam. AddsIL5 → il5.keepersecurity.usregion mapping. Server rotation hints suppressed when a custom key is configured.Bug Fixes
webSafe64ToBytesandbase64ToBytesnow throw a typedKeeperErrornaming the bad field on null/undefined input instead of a cryptic nativeTypeError.catch {}wrappingJSON.parse.Maintenance
[email protected]with[email protected](KSM-758) — resolves Rollup 4.x peer dependency warnings; 0.5.6 fixes a transitivepicomatchHIGH (dev-only)validate-versionpre-flight gate,permissions: contents: read,persist-credentials: false, SBOM--source-versionfixpaths:filter totest.js.ymlSecurity
rollupdevDependency^4.52.3→^4.60.1— fixes HIGH severity arbitrary file write via path traversal (CVE affects 4.0.0–4.58.0); build-only, not shippedBreaking Changes
None.
Related Issues