From 720e55565a011f813c2b8aa2451a3359166e65d3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Jul 2026 18:19:38 +0000 Subject: [PATCH 1/2] build(deps): bump @zxcvbn-ts/core from 3.0.4 to 4.1.2 Bumps [@zxcvbn-ts/core](https://github.com/zxcvbn-ts/zxcvbn) from 3.0.4 to 4.1.2. - [Changelog](https://github.com/zxcvbn-ts/zxcvbn/blob/master/CHANGELOG.md) - [Commits](https://github.com/zxcvbn-ts/zxcvbn/compare/@zxcvbn-ts/core@3.0.4...@zxcvbn-ts/core@4.1.2) --- updated-dependencies: - dependency-name: "@zxcvbn-ts/core" dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- frontend/package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/frontend/package.json b/frontend/package.json index 8e6f0487e..ff4e63f68 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -26,7 +26,7 @@ "@tanstack/react-router": "^1.170.16", "@vector-im/compound-design-tokens": "10.2.0", "@vector-im/compound-web": "^9.3.0", - "@zxcvbn-ts/core": "^3.0.4", + "@zxcvbn-ts/core": "^4.1.2", "@zxcvbn-ts/language-common": "^3.0.4", "classnames": "^2.5.1", "date-fns": "^4.4.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 89f600d56..cfdb9740d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -51,8 +51,8 @@ importers: specifier: ^9.3.0 version: 9.3.0(@fontsource/inconsolata@5.2.8)(@fontsource/inter@5.2.8)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@vector-im/compound-design-tokens@10.2.0(@types/react@19.2.17)(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@zxcvbn-ts/core': - specifier: ^3.0.4 - version: 3.0.4 + specifier: ^4.1.2 + version: 4.1.2 '@zxcvbn-ts/language-common': specifier: ^3.0.4 version: 3.0.4 @@ -2627,8 +2627,8 @@ packages: resolution: {integrity: sha512-Nst5JdK47VIl9UcGwtv2Rcgyn5lWtZ0/mhRQ4G8NN2isxpq2TO30iqHzmwoJycjWuyUfg3GFXqP/gFHXeV57IA==} engines: {node: '>=16.0.0'} - '@zxcvbn-ts/core@3.0.4': - resolution: {integrity: sha512-aQeiT0F09FuJaAqNrxynlAwZ2mW/1MdXakKWNmGM1Qp/VaY6CnB/GfnMS2T8gB2231Esp1/maCWd8vTG4OuShw==} + '@zxcvbn-ts/core@4.1.2': + resolution: {integrity: sha512-RQmxWB3AMI+HGQErQdUv6Aq32aQhp6xOxrfgCP0+T9MsLZoP3xtLHuT8O8VojsUxdmQVZfJlYkYb1A0wOwIS+Q==} '@zxcvbn-ts/language-common@3.0.4': resolution: {integrity: sha512-viSNNnRYtc7ULXzxrQIVUNwHAPSXRtoIwy/Tq4XQQdIknBzw4vz36lQLF6mvhMlTIlpjoN/Z1GFu/fwiAlUSsw==} @@ -6868,7 +6868,7 @@ snapshots: dependencies: tslib: 2.8.1 - '@zxcvbn-ts/core@3.0.4': + '@zxcvbn-ts/core@4.1.2': dependencies: fastest-levenshtein: 1.0.16 From 239dec3ee0c543557d80dc15ccc85abc37e4a91e Mon Sep 17 00:00:00 2001 From: Quentin Gliech Date: Thu, 2 Jul 2026 22:22:33 +0200 Subject: [PATCH 2/2] Adapt to the zxcvbn-ts v4 API, bump @zxcvbn-ts/language-common to match v4 replaced the global `zxcvbnOptions`/`zxcvbnAsync` singleton with the `ZxcvbnFactory` class. The warning/suggestion codes and options shape are unchanged. --- frontend/package.json | 2 +- frontend/src/utils/password_complexity/index.ts | 7 ++++--- pnpm-lock.yaml | 17 ++++++++++++----- 3 files changed, 17 insertions(+), 9 deletions(-) diff --git a/frontend/package.json b/frontend/package.json index ff4e63f68..32a1f2099 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -27,7 +27,7 @@ "@vector-im/compound-design-tokens": "10.2.0", "@vector-im/compound-web": "^9.3.0", "@zxcvbn-ts/core": "^4.1.2", - "@zxcvbn-ts/language-common": "^3.0.4", + "@zxcvbn-ts/language-common": "^4.1.2", "classnames": "^2.5.1", "date-fns": "^4.4.0", "i18next": "^26.3.1", diff --git a/frontend/src/utils/password_complexity/index.ts b/frontend/src/utils/password_complexity/index.ts index 1cb25c60c..143c170c6 100644 --- a/frontend/src/utils/password_complexity/index.ts +++ b/frontend/src/utils/password_complexity/index.ts @@ -1,10 +1,11 @@ +// Copyright 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2024 The Matrix.org Foundation C.I.C. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial // Please see LICENSE files in the repository root for full details. -import { zxcvbnAsync, zxcvbnOptions } from "@zxcvbn-ts/core"; +import { ZxcvbnFactory } from "@zxcvbn-ts/core"; import * as zxcvbnCommonPackage from "@zxcvbn-ts/language-common"; import type { TFunction } from "i18next"; @@ -54,7 +55,7 @@ const options = { l33tTable, }; -zxcvbnOptions.setOptions(options); +const zxcvbn = new ZxcvbnFactory(options); export interface PasswordComplexity { /** Score between 0 and 4 */ @@ -72,7 +73,7 @@ export async function estimatePasswordComplexity( password: string, t: TFunction, ): Promise { - const scorerResult = await zxcvbnAsync(password); + const scorerResult = await zxcvbn.checkAsync(password); const improvementsText = []; if (scorerResult.feedback.warning !== null) { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index cfdb9740d..0cddc2daf 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -54,8 +54,8 @@ importers: specifier: ^4.1.2 version: 4.1.2 '@zxcvbn-ts/language-common': - specifier: ^3.0.4 - version: 3.0.4 + specifier: ^4.1.2 + version: 4.1.2 classnames: specifier: ^2.5.1 version: 2.5.1 @@ -2630,8 +2630,11 @@ packages: '@zxcvbn-ts/core@4.1.2': resolution: {integrity: sha512-RQmxWB3AMI+HGQErQdUv6Aq32aQhp6xOxrfgCP0+T9MsLZoP3xtLHuT8O8VojsUxdmQVZfJlYkYb1A0wOwIS+Q==} - '@zxcvbn-ts/language-common@3.0.4': - resolution: {integrity: sha512-viSNNnRYtc7ULXzxrQIVUNwHAPSXRtoIwy/Tq4XQQdIknBzw4vz36lQLF6mvhMlTIlpjoN/Z1GFu/fwiAlUSsw==} + '@zxcvbn-ts/dictionary-compression@3.0.1': + resolution: {integrity: sha512-p3KyPzxGc3vWSap5hHA6SllbUCmh7s+NtpGyC3qEWrxYJT9t9TUAzjPm48Okipo+UUyPQfDlIvTcs9JRShBFiQ==} + + '@zxcvbn-ts/language-common@4.1.2': + resolution: {integrity: sha512-uJlBzhC9/KjPImqdnc1/lPxmdn4xKbkruN5p1mASWkXA0gli+GZ5LrVL+dqscA8Pcf4OfudE56TtCWeHljJOvA==} acorn@8.17.0: resolution: {integrity: sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==} @@ -6872,7 +6875,11 @@ snapshots: dependencies: fastest-levenshtein: 1.0.16 - '@zxcvbn-ts/language-common@3.0.4': {} + '@zxcvbn-ts/dictionary-compression@3.0.1': {} + + '@zxcvbn-ts/language-common@4.1.2': + dependencies: + '@zxcvbn-ts/dictionary-compression': 3.0.1 acorn@8.17.0: {}