Skip to content

doc: add Hmac.digest() documentation-only deprecation (DEP0206)#63121

Merged
nodejs-github-bot merged 1 commit intonodejs:mainfrom
Anshikakalpana:hmac-fix-v2
May 6, 2026
Merged

doc: add Hmac.digest() documentation-only deprecation (DEP0206)#63121
nodejs-github-bot merged 1 commit intonodejs:mainfrom
Anshikakalpana:hmac-fix-v2

Conversation

@Anshikakalpana
Copy link
Copy Markdown
Contributor

@Anshikakalpana Anshikakalpana commented May 4, 2026

Refs: #62838

Situation

Calling digest() on an already-finalized Hmac instance currently returns an empty buffer silently instead of throwing an error. This is inconsistent with Hash behavior which throws ERR_CRYPTO_HASH_FINALIZED and is a potential security footgun.

Change

Add a runtime deprecation warning (DEP0206) when digest() is called more than once on an Hmac instance. The existing behavior (returning an empty buffer) is preserved during the deprecation cycle to avoid breaking changes.

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/userland-migrations

@nodejs-github-bot nodejs-github-bot added crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels May 4, 2026
@Renegade334
Copy link
Copy Markdown
Member

We should create a doc-deprecation first that can land on current release lines.

@Anshikakalpana
Copy link
Copy Markdown
Contributor Author

@Renegade334
Thanks for the suggestion! I’ve updated this PR to introduce a documentation-only deprecation and removed the runtime changes

Comment thread doc/api/deprecations.md Outdated
@Renegade334
Copy link
Copy Markdown
Member

Please can you squash your commits with a new commit message that reflects a documentation-only deprecation, so that the changelog is correct?

@Renegade334 Renegade334 added the deprecations Issues and PRs related to deprecations. label May 4, 2026
Comment thread doc/api/deprecations.md Outdated
@Anshikakalpana
Copy link
Copy Markdown
Contributor Author

Thanks! Updated and squashed into a single doc-only commit.

Comment thread doc/api/deprecations.md Outdated
Signed-off-by: anshikakalpana <anshikajain196872@gmail.com>
@Renegade334 Renegade334 requested review from ChALkeR, jasnell and panva May 5, 2026 12:33
@Renegade334 Renegade334 removed the needs-ci PRs that need a full CI run. label May 5, 2026
@Renegade334 Renegade334 changed the title crypto: runtime deprecate multiple Hmac.digest() calls (DEP0206) crypto: doc-deprecate multiple Hmac.digest() calls (DEP0206) May 5, 2026
@panva panva changed the title crypto: doc-deprecate multiple Hmac.digest() calls (DEP0206) doc: add Hmac.digest() documentation-only deprecation (DEP0206) May 6, 2026
@panva panva added the commit-queue Add this label to land a pull request using GitHub Actions. label May 6, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label May 6, 2026
@nodejs-github-bot nodejs-github-bot merged commit 1b04f16 into nodejs:main May 6, 2026
19 checks passed
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Landed in 1b04f16

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

crypto Issues and PRs related to the crypto subsystem. deprecations Issues and PRs related to deprecations.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants