Skip to content

Hookwarden

v@hookwarden/[email protected] Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 1mo Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

cli developer-tools go hmac php python
+5 more
static-analysis security signature-verification typescript webhook-security

Affected surfaces

crypto_tls

Summary

AI summary

Fixes verification diagnosis for handlers using Node's crypto imports, correcting timing‑safe comparison detection.

Changes in this release

Bugfix Medium

Fixes verification diagnosis for handlers using Node's crypto imports.

Fixes verification diagnosis for handlers using Node's crypto imports.

Source: llm_adapter@2026-06-09

Confidence: high

 —
Full changelog

Patch Changes

  • Fix verification diagnosis for handlers that verify via a bare named-import of Node's crypto
    (import { createHmac, timingSafeEqual } from 'node:crypto'). The reachability helpers now
    recognize the unqualified createHmac / timingSafeEqual / compare_digest call shapes (in
    lock-step), so a handler that computes an HMAC but compares it with !== is reported as
    missing-timing-safe-equal (timing-unsafe comparison) rather than mislabeled
    missing-signature-verification, and a handler that verifies with timingSafeEqual no longer
    trips a false missing-timing-safe-equal. Diagnosis accuracy only — no severity or detection-
    coverage change. Most visible on n8n-style trigger nodes.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Hookwarden

Get notified when new releases ship.

Sign up free

About Hookwarden

All releases →

Related context

Beta — feedback welcome: [email protected]