fix(deps): update dependency altcha-lib to v2

renovate-bot commented

2026-08-17 20:38:12 +00:00

Contributor

This PR contains the following updates:

Package	Change	Age	Confidence
altcha-lib (source)	`^1.2.0` → `^2.0.0`

Release Notes

altcha-org/altcha-lib (altcha-lib)

`v2.8.0`

Compare Source

Fixed

Nuxt 4 support: altcha-lib/frameworks/h3 works with h3 v1 (Nuxt 4, Nitro 2) as well as h3 v2 (Nitro 3), and the h3 peer dependency accepts ^1.15.0 || ^2.0.0 (#22). The plugin no longer imports h3 at runtime, so it no longer fails with event.req.headers.get is not a function when the package manager installs h3 v2 for altcha-lib next to Nuxt's h3 v1.
altcha-lib/frameworks/h3 middleware leaves the request body readable for later handlers on both h3 majors.
altcha-lib/frameworks/h3 errors (403 on failed verification, 400 on an invalid JSON or form data body) are recognized as HTTP errors by both h3 v1 and v2. h3 v1 previously treated them as unhandled errors.
docs/nuxt.md: route files live under server/routes/, imports use ~~/server/... (Nuxt 4's ~ points to app/), and the example uses createError, which exists in h3 v1 and v2.

Changed

The build uses TypeScript 6. tsconfig.cjs.json sets ignoreDeprecations: "6.0" to keep moduleResolution: "node" for the CommonJS build, which TypeScript 6 deprecates and TypeScript 7 removes.

`v2.7.0`

Compare Source

Fixed

SvelteKit 3 support: the @sveltejs/kit peer dependency accepts ^2.0.0 || ^3.0.0, so npm no longer fails with ERESOLVE in SvelteKit 3 projects (#21). altcha-lib/frameworks/sveltekit no longer imports Handle from @sveltejs/kit, which SvelteKit 3 moved to @sveltejs/kit/hooks.

Changed

altcha-lib/frameworks/sveltekit is ESM-only, like @sveltejs/kit. The CommonJS build could not be loaded because @sveltejs/kit cannot be require()d; require('altcha-lib/frameworks/sveltekit') now fails with ERR_PACKAGE_PATH_NOT_EXPORTED for altcha-lib instead.
altcha-lib/frameworks/sveltekit responds with Response.json instead of SvelteKit's json helper, which SvelteKit 3 deprecates.

`v2.6.0`

Compare Source

Security

createChallenge no longer publishes the whole derived key when keyPrefixLength is at least the key length. Before, a challenge with hmacKeySignatureSecret could be verified without any work by submitting the published keyPrefix as the solution.
obfuscate() no longer exposes its AES key when keyPrefixLength is passed in its options.
createChallenge no longer creates challenges with an empty keyPrefix (for example with keyLength: 1, keyPrefixLength: 0 or keyPrefix: ''), which any counter solved.
Framework plugins: replay protection for server-signed (Sentinel) payloads uses the id inside the signed verificationData instead of the unsigned top-level id, which could be changed or removed to replay a payload.
Framework plugins: payload ids are recorded in the replay store only after the payload has been verified. Unverified payloads could fill the store, evict used ids from a CappedMap (allowing replays), or mark another user's challenge as used.
verifyServerSignature validates payload.algorithm (not covered by the signature) before use. It accepts only SHA-1, SHA-256, SHA-384 and SHA-512.
A __proto__ key in challenge parameters is now covered by the signature. Before, it was dropped from the signed JSON, so it could be injected into a signed challenge.

Fixed

The browser SHA key derivation (altcha-lib/algorithms/web/sha) produces the same keys as the Node version. They differed for SHA-384 and SHA-512 with the default keyLength 32 and cost > 1, and for any keyLength below the digest size.
The browser PBKDF2 key derivation (altcha-lib/algorithms/web/pbkdf2) supports any keyLength, not only 16, 24 and 32.
verifySolution returns invalidSolution instead of throwing for a malformed solution: a derivedKey that is missing or not lowercase hex, or a missing solution. Both verification paths now reject an uppercase derivedKey (the key-signature path used to accept it).
verifySolution returns invalidSolution for a counter that is not an exact integer in range. Before, "42" and 2 ** 32 + 42 verified as 42.
solveChallenge throws immediately for an invalid keyPrefix instead of searching until the timeout.
An odd-length uppercase keyPrefix (for example from another library) can be solved and verified.
verifyServerSignature returns invalidSignature instead of throwing when payload.signature is missing.
verifyServerSignature treats a payload as expired as soon as the current time passes expire, the same as verifySolution. Before, it allowed up to 1 second of grace.
CLI: create --algorithm is case-insensitive and rejects unsupported names. Before, a lowercase name created a challenge that solve could not solve.
CLI: create defaults to PBKDF2/SHA-256, as documented. It used SHA-256.

Added

Store.setIfAbsent(key, value): optional atomic check-and-set. When a store implements it, the framework plugins use it, so only one of two concurrent submissions of the same payload passes. CappedMap implements it; docs/store.md shows a Redis implementation with SET … NX.
docs/advanced-usage.md documents the challenge signature format (canonical JSON) for other implementations.
docs/server-signatures.md documents the expiry rules and how to check fieldsHash with verifyFieldsHash.

Changed

BREAKING: createChallenge validates its options and throws for invalid values:
- keyPrefixLength must be a positive integer smaller than the derived key length. Values above half the derived key are capped at half. The default is floor(keyLength / 2). With SHA-256 and keyLength: 64, the default now throws in counter mode, because the derived key is only 32 bytes.
- keyPrefix must be a non-empty hex string no longer than the key. It is lowercased before signing.
- counter must be an integer from 0 to 2^32 - 1 ('uint32') or Number.MAX_SAFE_INTEGER ('string').
- cost and keyLength must be positive integers, and so must memoryCost and parallelism when set.
- counterMode must be 'uint32' or 'string'.
- expiresAt must be a valid Date or a positive number of seconds.
- hmacAlgorithm must be SHA-256, SHA-384 or SHA-512.
BREAKING: HMAC secrets must be non-empty strings:
- createChallenge throws for an empty or null hmacSignatureSecret, and for hmacKeySignatureSecret without hmacSignatureSecret (it used to be ignored). Omitting hmacSignatureSecret still creates an unsigned challenge.
- verifySolution throws for a missing or empty hmacSignatureSecret.
- verifyServerSignature throws for a missing or empty hmacSecret.
BREAKING: The built-in deriveKey functions accept only their exact algorithm names and throw otherwise: SHA-256, SHA-384, SHA-512; PBKDF2/SHA-256, PBKDF2/SHA-384, PBKDF2/SHA-512; SCRYPT; ARGON2ID. The Node functions used to fall back to SHA-256 for unknown names, and scrypt and Argon2id ignored the name. The scrypt and Argon2id functions require memoryCost.
BREAKING: verifySolution and verifyServerSignature throw for an unsupported hmacAlgorithm or payload.algorithm. The framework plugins return the error as a failed verification.
BREAKING: Framework challengeHandlers fail with a configuration error when hmacSignatureSecret is not set, instead of issuing unsigned challenges that their own verify rejects.
BREAKING: With a replay store configured, server-signed payloads without an id in verificationData are rejected. Sentinel always includes it.
Framework plugins: a self-hosted challenge whose submission failed verification can be submitted again; it is no longer marked as used.

`v2.4.0`

Compare Source

Fixed

Nest.js with Fastify (#18).
Nest.js registerAsync typing (#19).

`v2.3.2`

Compare Source

Fixed

Enforce keyPrefix in PoW v2 fallback verification.

`v2.3.1`

Compare Source

Fixed

verifyHandler (the standalone /verify endpoint, meant for custom or external integrations) called verifyServer when a verifyServer option was configured.

`v2.3.0`

Compare Source

Added

verifyServer() verifies a payload remotely through ALTCHA Sentinel's POST /v1/verify/signature API instead of checking the HMAC signature locally. It supports timeouts, retries with fixed or exponential backoff, a custom fetch, and aborting through an AbortController.
All framework plugins (Express, Fastify, NestJS, Next.js, Nuxt/H3, SvelteKit, Hono) accept a verifyServer option. When it is set, Sentinel-issued payloads are verified remotely through the existing verifyHandler and middleware.

Changed

hmacSignatureSecret, deriveKey and createChallengeParameters are optional in the framework plugin options, so a Sentinel-only setup can be create({ verifyServer: { url, secret } }). Calling challengeHandler without deriveKey or createChallengeParameters fails with a configuration error.

`v2.2.0`

Compare Source

Fixed

Framework plugins send a default Cache-Control: no-store header (#17).

`v2.1.0`

Compare Source

Fixed

Fastify and Express throw an error when throwOnFailure is set (#16).

`v2.0.1`

Compare Source

Added

CLI utility.

Fixed

solveChallenge yielding and abort.

`v2.0.0`

Compare Source

Fixed

Nuxt 4 support: altcha-lib/frameworks/h3 works with h3 v1 (Nuxt 4, Nitro 2) as well as h3 v2 (Nitro 3), and the h3 peer dependency accepts ^1.15.0 || ^2.0.0 (#22). The plugin no longer imports h3 at runtime, so it no longer fails with event.req.headers.get is not a function when the package manager installs h3 v2 for altcha-lib next to Nuxt's h3 v1.
altcha-lib/frameworks/h3 middleware leaves the request body readable for later handlers on both h3 majors.
altcha-lib/frameworks/h3 errors (403 on failed verification, 400 on an invalid JSON or form data body) are recognized as HTTP errors by both h3 v1 and v2. h3 v1 previously treated them as unhandled errors.
docs/nuxt.md: route files live under server/routes/, imports use ~~/server/... (Nuxt 4's ~ points to app/), and the example uses createError, which exists in h3 v1 and v2.

Changed

The build uses TypeScript 6. tsconfig.cjs.json sets ignoreDeprecations: "6.0" to keep moduleResolution: "node" for the CommonJS build, which TypeScript 6 deprecates and TypeScript 7 removes.

Configuration

📅 Schedule: (in timezone America/Chicago)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [altcha-lib](https://altcha.org) ([source](https://github.com/altcha-org/altcha-lib)) | [`^1.2.0` → `^2.0.0`](https://renovatebot.com/diffs/npm/altcha-lib/1.4.1/2.8.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/altcha-lib/2.8.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/altcha-lib/1.4.1/2.8.0?slim=true) | --- ### Release Notes <details> <summary>altcha-org/altcha-lib (altcha-lib)</summary> ### [`v2.8.0`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#280---2026-10-24) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.7.0...v2.8.0) ##### Fixed - Nuxt 4 support: `altcha-lib/frameworks/h3` works with h3 v1 (Nuxt 4, Nitro 2) as well as h3 v2 (Nitro 3), and the `h3` peer dependency accepts `^1.15.0 || ^2.0.0` ([#22](https://github.com/altcha-org/altcha-lib/issues/22)). The plugin no longer imports `h3` at runtime, so it no longer fails with `event.req.headers.get is not a function` when the package manager installs h3 v2 for `altcha-lib` next to Nuxt's h3 v1. - `altcha-lib/frameworks/h3` middleware leaves the request body readable for later handlers on both h3 majors. - `altcha-lib/frameworks/h3` errors (403 on failed verification, 400 on an invalid JSON or form data body) are recognized as HTTP errors by both h3 v1 and v2. h3 v1 previously treated them as unhandled errors. - `docs/nuxt.md`: route files live under `server/routes/`, imports use `~~/server/...` (Nuxt 4's `~` points to `app/`), and the example uses `createError`, which exists in h3 v1 and v2. ##### Changed - The build uses TypeScript 6. `tsconfig.cjs.json` sets `ignoreDeprecations: "6.0"` to keep `moduleResolution: "node"` for the CommonJS build, which TypeScript 6 deprecates and TypeScript 7 removes. ### [`v2.7.0`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#270---2026-10-21) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.6.0...v2.7.0) ##### Fixed - SvelteKit 3 support: the `@sveltejs/kit` peer dependency accepts `^2.0.0 || ^3.0.0`, so npm no longer fails with `ERESOLVE` in SvelteKit 3 projects ([#21](https://github.com/altcha-org/altcha-lib/issues/21)). `altcha-lib/frameworks/sveltekit` no longer imports `Handle` from `@sveltejs/kit`, which SvelteKit 3 moved to `@sveltejs/kit/hooks`. ##### Changed - `altcha-lib/frameworks/sveltekit` is ESM-only, like `@sveltejs/kit`. The CommonJS build could not be loaded because `@sveltejs/kit` cannot be `require()`d; `require('altcha-lib/frameworks/sveltekit')` now fails with `ERR_PACKAGE_PATH_NOT_EXPORTED` for `altcha-lib` instead. - `altcha-lib/frameworks/sveltekit` responds with `Response.json` instead of SvelteKit's `json` helper, which SvelteKit 3 deprecates. ### [`v2.6.0`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#260---2026-10-05) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.5.0...v2.6.0) ##### Security - `createChallenge` no longer publishes the whole derived key when `keyPrefixLength` is at least the key length. Before, a challenge with `hmacKeySignatureSecret` could be verified without any work by submitting the published `keyPrefix` as the solution. - `obfuscate()` no longer exposes its AES key when `keyPrefixLength` is passed in its options. - `createChallenge` no longer creates challenges with an empty `keyPrefix` (for example with `keyLength: 1`, `keyPrefixLength: 0` or `keyPrefix: ''`), which any counter solved. - Framework plugins: replay protection for server-signed (Sentinel) payloads uses the `id` inside the signed `verificationData` instead of the unsigned top-level `id`, which could be changed or removed to replay a payload. - Framework plugins: payload ids are recorded in the replay store only after the payload has been verified. Unverified payloads could fill the store, evict used ids from a `CappedMap` (allowing replays), or mark another user's challenge as used. - `verifyServerSignature` validates `payload.algorithm` (not covered by the signature) before use. It accepts only `SHA-1`, `SHA-256`, `SHA-384` and `SHA-512`. - A `__proto__` key in challenge parameters is now covered by the signature. Before, it was dropped from the signed JSON, so it could be injected into a signed challenge. ##### Fixed - The browser SHA key derivation (`altcha-lib/algorithms/web/sha`) produces the same keys as the Node version. They differed for SHA-384 and SHA-512 with the default `keyLength` 32 and `cost` > 1, and for any `keyLength` below the digest size. - The browser PBKDF2 key derivation (`altcha-lib/algorithms/web/pbkdf2`) supports any `keyLength`, not only 16, 24 and 32. - `verifySolution` returns `invalidSolution` instead of throwing for a malformed solution: a `derivedKey` that is missing or not lowercase hex, or a missing `solution`. Both verification paths now reject an uppercase `derivedKey` (the key-signature path used to accept it). - `verifySolution` returns `invalidSolution` for a counter that is not an exact integer in range. Before, `"42"` and `2 ** 32 + 42` verified as `42`. - `solveChallenge` throws immediately for an invalid `keyPrefix` instead of searching until the timeout. - An odd-length uppercase `keyPrefix` (for example from another library) can be solved and verified. - `verifyServerSignature` returns `invalidSignature` instead of throwing when `payload.signature` is missing. - `verifyServerSignature` treats a payload as expired as soon as the current time passes `expire`, the same as `verifySolution`. Before, it allowed up to 1 second of grace. - CLI: `create --algorithm` is case-insensitive and rejects unsupported names. Before, a lowercase name created a challenge that `solve` could not solve. - CLI: `create` defaults to `PBKDF2/SHA-256`, as documented. It used `SHA-256`. ##### Added - `Store.setIfAbsent(key, value)`: optional atomic check-and-set. When a store implements it, the framework plugins use it, so only one of two concurrent submissions of the same payload passes. `CappedMap` implements it; `docs/store.md` shows a Redis implementation with `SET … NX`. - `docs/advanced-usage.md` documents the challenge signature format (canonical JSON) for other implementations. - `docs/server-signatures.md` documents the expiry rules and how to check `fieldsHash` with `verifyFieldsHash`. ##### Changed - **BREAKING:** `createChallenge` validates its options and throws for invalid values: - `keyPrefixLength` must be a positive integer smaller than the derived key length. Values above half the derived key are capped at half. The default is `floor(keyLength / 2)`. With SHA-256 and `keyLength: 64`, the default now throws in counter mode, because the derived key is only 32 bytes. - `keyPrefix` must be a non-empty hex string no longer than the key. It is lowercased before signing. - `counter` must be an integer from 0 to 2^32 - 1 (`'uint32'`) or `Number.MAX_SAFE_INTEGER` (`'string'`). - `cost` and `keyLength` must be positive integers, and so must `memoryCost` and `parallelism` when set. - `counterMode` must be `'uint32'` or `'string'`. - `expiresAt` must be a valid `Date` or a positive number of seconds. - `hmacAlgorithm` must be `SHA-256`, `SHA-384` or `SHA-512`. - **BREAKING:** HMAC secrets must be non-empty strings: - `createChallenge` throws for an empty or `null` `hmacSignatureSecret`, and for `hmacKeySignatureSecret` without `hmacSignatureSecret` (it used to be ignored). Omitting `hmacSignatureSecret` still creates an unsigned challenge. - `verifySolution` throws for a missing or empty `hmacSignatureSecret`. - `verifyServerSignature` throws for a missing or empty `hmacSecret`. - **BREAKING:** The built-in `deriveKey` functions accept only their exact algorithm names and throw otherwise: `SHA-256`, `SHA-384`, `SHA-512`; `PBKDF2/SHA-256`, `PBKDF2/SHA-384`, `PBKDF2/SHA-512`; `SCRYPT`; `ARGON2ID`. The Node functions used to fall back to SHA-256 for unknown names, and scrypt and Argon2id ignored the name. The scrypt and Argon2id functions require `memoryCost`. - **BREAKING:** `verifySolution` and `verifyServerSignature` throw for an unsupported `hmacAlgorithm` or `payload.algorithm`. The framework plugins return the error as a failed verification. - **BREAKING:** Framework `challengeHandler`s fail with a configuration error when `hmacSignatureSecret` is not set, instead of issuing unsigned challenges that their own `verify` rejects. - **BREAKING:** With a replay store configured, server-signed payloads without an `id` in `verificationData` are rejected. Sentinel always includes it. - Framework plugins: a self-hosted challenge whose submission failed verification can be submitted again; it is no longer marked as used. ### [`v2.5.0`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#250---2026-09-10) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.4.0...v2.5.0) ##### Added - Support for Nest.js v12. ### [`v2.4.0`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#240---2026-08-30) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.3.2...v2.4.0) ##### Fixed - Nest.js with Fastify ([#18](https://github.com/altcha-org/altcha-lib/issues/18)). - Nest.js `registerAsync` typing ([#19](https://github.com/altcha-org/altcha-lib/issues/19)). ### [`v2.3.2`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#232---2026-07-27) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.3.1...v2.3.2) ##### Fixed - Enforce `keyPrefix` in PoW v2 fallback verification. ### [`v2.3.1`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#231---2026-07-20) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.3.0...v2.3.1) ##### Fixed - `verifyHandler` (the standalone `/verify` endpoint, meant for custom or external integrations) called `verifyServer` when a `verifyServer` option was configured. ### [`v2.3.0`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#230---2026-07-20) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.2.0...v2.3.0) ##### Added - `verifyServer()` verifies a payload remotely through ALTCHA Sentinel's `POST /v1/verify/signature` API instead of checking the HMAC signature locally. It supports timeouts, retries with fixed or exponential backoff, a custom `fetch`, and aborting through an `AbortController`. - All framework plugins (Express, Fastify, NestJS, Next.js, Nuxt/H3, SvelteKit, Hono) accept a `verifyServer` option. When it is set, Sentinel-issued payloads are verified remotely through the existing `verifyHandler` and middleware. ##### Changed - `hmacSignatureSecret`, `deriveKey` and `createChallengeParameters` are optional in the framework plugin options, so a Sentinel-only setup can be `create({ verifyServer: { url, secret } })`. Calling `challengeHandler` without `deriveKey` or `createChallengeParameters` fails with a configuration error. ### [`v2.2.0`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#220---2026-05-24) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.1.0...v2.2.0) ##### Fixed - Framework plugins send a default `Cache-Control: no-store` header ([#17](https://github.com/altcha-org/altcha-lib/issues/17)). ### [`v2.1.0`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#210---2026-05-20) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.0.3...v2.1.0) ##### Fixed - Fastify and Express throw an error when `throwOnFailure` is set ([#16](https://github.com/altcha-org/altcha-lib/issues/16)). ### [`v2.0.3`](https://github.com/altcha-org/altcha-lib/compare/v2.0.2...v2.0.3) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.0.2...v2.0.3) ### [`v2.0.2`](https://github.com/altcha-org/altcha-lib/compare/v2.0.1...v2.0.2) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.0.1...v2.0.2) ### [`v2.0.1`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#201---2026-04-10) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/v2.0.0...v2.0.1) ##### Added - CLI utility. ##### Fixed - `solveChallenge` yielding and abort. ### [`v2.0.0`](https://github.com/altcha-org/altcha-lib/blob/HEAD/CHANGELOG.md#280---2026-10-24) [Compare Source](https://github.com/altcha-org/altcha-lib/compare/1.4.1...v2.0.0) ##### Fixed - Nuxt 4 support: `altcha-lib/frameworks/h3` works with h3 v1 (Nuxt 4, Nitro 2) as well as h3 v2 (Nitro 3), and the `h3` peer dependency accepts `^1.15.0 || ^2.0.0` ([#22](https://github.com/altcha-org/altcha-lib/issues/22)). The plugin no longer imports `h3` at runtime, so it no longer fails with `event.req.headers.get is not a function` when the package manager installs h3 v2 for `altcha-lib` next to Nuxt's h3 v1. - `altcha-lib/frameworks/h3` middleware leaves the request body readable for later handlers on both h3 majors. - `altcha-lib/frameworks/h3` errors (403 on failed verification, 400 on an invalid JSON or form data body) are recognized as HTTP errors by both h3 v1 and v2. h3 v1 previously treated them as unhandled errors. - `docs/nuxt.md`: route files live under `server/routes/`, imports use `~~/server/...` (Nuxt 4's `~` points to `app/`), and the example uses `createError`, which exists in h3 v1 and v2. ##### Changed - The build uses TypeScript 6. `tsconfig.cjs.json` sets `ignoreDeprecations: "6.0"` to keep `moduleResolution: "node"` for the CommonJS build, which TypeScript 6 deprecates and TypeScript 7 removes. </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Chicago) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-08-17 20:38:12 +00:00

fix(deps): update dependency altcha-lib to v2

CI / API — typecheck & tests (push) Failing after 1m23s

Details

CI / App — typecheck, test & build (push) Successful in 1m39s

Details

CI / API — typecheck & tests (pull_request) Failing after 2m2s

Details

CI / App — typecheck, test & build (pull_request) Successful in 2m6s

Details

CI / Images — production build (pull_request) Failing after 1m41s

Details

CI / Images — production build (push) Failing after 3m31s

Details

0af2c6fb4d

renovate-bot force-pushed renovate/altcha-lib-2.x from 0af2c6fb4d

CI / API — typecheck & tests (push) Failing after 1m23s

Details

CI / App — typecheck, test & build (push) Successful in 1m39s

Details

CI / API — typecheck & tests (pull_request) Failing after 2m2s

Details

CI / App — typecheck, test & build (pull_request) Successful in 2m6s

Details

CI / Images — production build (pull_request) Failing after 1m41s

Details

CI / Images — production build (push) Failing after 3m31s

Details

to 31d64885ab

CI / App — typecheck, test & build (push) Successful in 1m8s

Details

CI / API — typecheck & tests (push) Failing after 1m15s

Details

CI / API — typecheck & tests (pull_request) Failing after 1m17s

Details

CI / Images — production build (push) Failing after 1m32s

Details

CI / Images — production build (pull_request) Failing after 1m32s

Details

CI / App — typecheck, test & build (pull_request) Successful in 1m46s

Details

2026-08-30 12:14:54 +00:00

Compare

renovate-bot force-pushed renovate/altcha-lib-2.x from 31d64885ab

CI / App — typecheck, test & build (push) Successful in 1m8s

Details

CI / API — typecheck & tests (push) Failing after 1m15s

Details

CI / API — typecheck & tests (pull_request) Failing after 1m17s

Details

CI / Images — production build (push) Failing after 1m32s

Details

CI / Images — production build (pull_request) Failing after 1m32s

Details

CI / App — typecheck, test & build (pull_request) Successful in 1m46s

Details

to 74947ee09d

CI / API — typecheck & tests (push) Failing after 1m24s

Details

CI / API — typecheck & tests (pull_request) Failing after 1m4s

Details

CI / App — typecheck, test & build (pull_request) Successful in 1m18s

Details

CI / Images — production build (pull_request) Failing after 1m17s

Details

CI / Images — production build (push) Failing after 2m5s

Details

CI / App — typecheck, test & build (push) Successful in 3m1s

Details

2026-09-10 06:19:35 +00:00

Compare

renovate-bot force-pushed renovate/altcha-lib-2.x from 74947ee09d

CI / API — typecheck & tests (push) Failing after 1m24s

Details

CI / API — typecheck & tests (pull_request) Failing after 1m4s

Details

CI / App — typecheck, test & build (pull_request) Successful in 1m18s

Details

CI / Images — production build (pull_request) Failing after 1m17s

Details

CI / Images — production build (push) Failing after 2m5s

Details

CI / App — typecheck, test & build (push) Successful in 3m1s

Details

to 82a60a9333

CI / API — typecheck & tests (push) Failing after 1m19s

Details

CI / Images — production build (push) Failing after 1m16s

Details

CI / App — typecheck, test & build (push) Successful in 2m18s

Details

CI / API — typecheck & tests (pull_request) Failing after 1m40s

Details

CI / Images — production build (pull_request) Failing after 1m58s

Details

CI / App — typecheck, test & build (pull_request) Successful in 2m43s

Details

2026-10-05 06:29:12 +00:00

Compare

renovate-bot force-pushed renovate/altcha-lib-2.x from 82a60a9333

CI / API — typecheck & tests (push) Failing after 1m19s

Details

CI / Images — production build (push) Failing after 1m16s

Details

CI / App — typecheck, test & build (push) Successful in 2m18s

Details

CI / API — typecheck & tests (pull_request) Failing after 1m40s

Details

CI / Images — production build (pull_request) Failing after 1m58s

Details

CI / App — typecheck, test & build (pull_request) Successful in 2m43s

Details

to 79dc361c5c

CI / Images — production build (push) Failing after 1m0s

Details

CI / API — typecheck & tests (push) Failing after 1m33s

Details

CI / API — typecheck & tests (pull_request) Failing after 1m33s

Details

CI / Images — production build (pull_request) Failing after 1m53s

Details

CI / App — typecheck, test & build (push) Successful in 2m0s

Details

CI / App — typecheck, test & build (pull_request) Successful in 2m45s

Details

2026-10-21 12:20:32 +00:00

Compare

renovate-bot force-pushed renovate/altcha-lib-2.x from 79dc361c5c

CI / Images — production build (push) Failing after 1m0s

Details

CI / API — typecheck & tests (push) Failing after 1m33s

Details

CI / API — typecheck & tests (pull_request) Failing after 1m33s

Details

CI / Images — production build (pull_request) Failing after 1m53s

Details

CI / App — typecheck, test & build (push) Successful in 2m0s

Details

CI / App — typecheck, test & build (pull_request) Successful in 2m45s

Details

to 732a00420c

CI / Images — production build (push) Failing after 1m15s

Details

CI / API — typecheck & tests (push) Failing after 2m52s

Details

CI / API — typecheck & tests (pull_request) Failing after 1m37s

Details

CI / Images — production build (pull_request) Failing after 28s

Details

CI / App — typecheck, test & build (push) Successful in 3m52s

Details

CI / App — typecheck, test & build (pull_request) Successful in 2m1s

Details

2026-10-24 06:23:43 +00:00

Compare

CI / Images — production build (push) Failing after 1m15s

Required

Details

CI / API — typecheck & tests (push) Failing after 2m52s

Required

Details

CI / API — typecheck & tests (pull_request) Failing after 1m37s

Required

Details

CI / Images — production build (pull_request) Failing after 28s

Required

Details

CI / App — typecheck, test & build (push) Successful in 3m52s

Required

Details

CI / App — typecheck, test & build (pull_request) Successful in 2m1s

Required

Details

Some required checks were not successful.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/altcha-lib-2.x:renovate/altcha-lib-2.x

git switch renovate/altcha-lib-2.x

Rows
Columns

fix(deps): update dependency altcha-lib to v2 #162

Release Notes

Fixed

Changed

Fixed

Changed

Security

Fixed

Added

Changed

Added

Fixed

Fixed

Fixed

Added

Changed

Fixed

Fixed

Added

Fixed

Fixed

Changed

Configuration

Checkout