Tracked from #2.
secrets.js@0.1.8 is old and unmaintained. It is used only to decrypt V1 legacy vaults — V2 (current) uses shamir-secret-sharing, and newly created vaults never touch secrets.js.
Options:
- Vendor + audit the small slice we actually use (the V1 decrypt-only path), or
- Replace with a maintained GF(2^8) Shamir implementation that can still reconstruct V1 shares, or
- Keep it isolated behind the V1 legacy path and document the risk.
Not urgent (decrypt-only for old vaults), but worth resolving for the "no dead/insecure dependencies" goal.
Tracked from #2.
secrets.js@0.1.8is old and unmaintained. It is used only to decrypt V1 legacy vaults — V2 (current) usesshamir-secret-sharing, and newly created vaults never touchsecrets.js.Options:
Not urgent (decrypt-only for old vaults), but worth resolving for the "no dead/insecure dependencies" goal.