did-method-key - npm Package Compare versions

Comparing version 0.5.0 to 0.5.1

CHANGELOG.md

 # did:key driver ChangeLog
 
+## 0.5.1 - 2020-02-27
+
+### Changed
+- Use x25519-key-pair@1.
+
 ## 0.5.0 - 2020-02-24
@@ -4,0 +9,0 @@

lib/driver.js

 /*!
- * Copyright (c) 2019 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2019-2020 Digital Bazaar, Inc. All rights reserved.
  */
@@ -7,3 +7,3 @@ 'use strict';
 const {LDKeyPair} = require('crypto-ld');
-const X25519KeyPair = require('x25519-key-pair');
+const {X25519KeyPair} = require('x25519-key-pair');
 const {constants: securityConstants} = require('security-context');
@@ -10,0 +10,0 @@

lib/index.js

 /*!
- * Copyright (c) 2019 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2019-2020 Digital Bazaar, Inc. All rights reserved.
  */
@@ -4,0 +4,0 @@ 'use strict';

package.json

 {
   "name": "did-method-key",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "A did:key method driver for did-io and standalone use.",
@@ -24,7 +24,7 @@ "homepage": "http://github.com/digitalbazaar/did-method-key",
     "security-context": "^4.0.0",
-    "x25519-key-pair": "digitalbazaar/x25519-key-pair#initial"
+    "x25519-key-pair": "^1.0.0"
   },
   "devDependencies": {
     "chai": "^4.2.0",
-    "mocha": "^6.1.4"
+    "mocha": "^7.0.1"
   },
@@ -31,0 +31,0 @@ "engines": {

tests/driver.spec.js

 /*!
- * Copyright (c) 2019 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2019-2020 Digital Bazaar, Inc. All rights reserved.
  */
@@ -4,0 +4,0 @@ 'use strict';

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

GitHub dependency

Supply chain risk

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

Found 1 instance in 1 package

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Improved metrics

Number of high supply chain risk alerts

0

decreased by-100%

Worsened metrics

Total package byte prevSize

16573

decreased by-47.49%

Number of package files

9

decreased by-47.06%

Dependency changes

• + Addeded2curve@0.2.1(transitive)

• + Addedesm@3.2.25(transitive)

• + Addednode-forge@0.8.5(transitive)

• + Addedtweetnacl@0.14.51.0.3(transitive)

• + Addedx25519-key-pair@1.0.0(transitive)

• Updatedx25519-key-pair@^1.0.0