From 9727e2607c5c97193d20d245a600417759f89564 Mon Sep 17 00:00:00 2001
From: GCHQ Developer 85297 <95289555+C85297@users.noreply.github.com>
Date: Sat, 9 May 2026 11:57:41 +0100
Subject: [PATCH] update bcryptjs (#2368)

Co-authored-by: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> (fixed browser tests)
---
 package-lock.json                     | 13 ++++++++-----
 package.json                          |  4 ++--
 src/core/operations/Bcrypt.mjs        |  2 +-
 src/core/operations/BcryptCompare.mjs |  2 +-
 tests/browser/02_ops.js               |  2 +-
 tests/node/tests/operations.mjs       |  4 ++--
 6 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index fd549604..0af1a225 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -20,7 +20,7 @@
         "arrive": "^2.5.3",
         "assert": "^2.1.0",
         "avsc": "^5.7.9",
-        "bcryptjs": "^2.4.3",
+        "bcryptjs": "^3.0.3",
         "bignumber.js": "^9.3.1",
         "blakejs": "^1.2.1",
         "bootstrap": "4.6.2",
@@ -5808,10 +5808,13 @@
       "license": "MIT"
     },
     "node_modules/bcryptjs": {
-      "version": "2.4.3",
-      "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-2.4.3.tgz",
-      "integrity": "sha512-V/Hy/X9Vt7f3BbPJEi8BdVFMByHi+jNXrYkW3huaybV/kQ0KJg0Y6PkEMbn+zeT+i+SiKZ/HMqJGIIt4LZDqNQ==",
-      "license": "MIT"
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-3.0.3.tgz",
+      "integrity": "sha512-GlF5wPWnSa/X5LKM1o0wz0suXIINz1iHRLvTS+sLyi7XPbe5ycmYI3DlZqVGZZtDgl4DmasFg7gOB3JYbphV5g==",
+      "license": "BSD-3-Clause",
+      "bin": {
+        "bcrypt": "bin/bcrypt"
+      }
     },
     "node_modules/big.js": {
       "version": "5.2.2",
diff --git a/package.json b/package.json
index 7acab465..86e0e7d4 100644
--- a/package.json
+++ b/package.json
@@ -96,15 +96,15 @@
     "@alexaltea/capstone-js": "^3.0.5",
     "@astronautlabs/amf": "^0.0.6",
     "@blu3r4y/lzma": "^2.3.3",
+    "@noble/hashes": "2.2.0",
     "@wavesenterprise/crypto-gost-js": "^2.1.0-RC1",
     "@xmldom/xmldom": "^0.8.13",
     "argon2-browser": "^1.18.0",
     "arrive": "^2.5.3",
     "assert": "^2.1.0",
     "avsc": "^5.7.9",
-    "bcryptjs": "^2.4.3",
+    "bcryptjs": "^3.0.3",
     "bignumber.js": "^9.3.1",
-    "@noble/hashes": "2.2.0",
     "blakejs": "^1.2.1",
     "bootstrap": "4.6.2",
     "bootstrap-colorpicker": "^3.4.0",
diff --git a/src/core/operations/Bcrypt.mjs b/src/core/operations/Bcrypt.mjs
index 53b8a92e..adf6c9c6 100644
--- a/src/core/operations/Bcrypt.mjs
+++ b/src/core/operations/Bcrypt.mjs
@@ -43,7 +43,7 @@ class Bcrypt extends Operation {
         const rounds = args[0];
         const salt = await bcrypt.genSalt(rounds);
 
-        return await bcrypt.hash(input, salt, null, p => {
+        return await bcrypt.hash(input, salt, undefined, p => {
             // Progress callback
             if (isWorkerEnvironment())
                 self.sendStatusMessage(`Progress: ${(p * 100).toFixed(0)}%`);
diff --git a/src/core/operations/BcryptCompare.mjs b/src/core/operations/BcryptCompare.mjs
index 8d9a6937..824316ae 100644
--- a/src/core/operations/BcryptCompare.mjs
+++ b/src/core/operations/BcryptCompare.mjs
@@ -43,7 +43,7 @@ class BcryptCompare extends Operation {
     async run(input, args) {
         const hash = args[0];
 
-        const match = await bcrypt.compare(input, hash, null, p => {
+        const match = await bcrypt.compare(input, hash, undefined, p => {
             // Progress callback
             if (isWorkerEnvironment())
                 self.sendStatusMessage(`Progress: ${(p * 100).toFixed(0)}%`);
diff --git a/tests/browser/02_ops.js b/tests/browser/02_ops.js
index 896de7b0..9d29f50d 100644
--- a/tests/browser/02_ops.js
+++ b/tests/browser/02_ops.js
@@ -64,7 +64,7 @@ module.exports = {
         testOp(browser, "BSON serialise", '{"a":"test"}', "\u0011\u0000\u0000\u0000\u0002a\u0000\u0005\u0000\u0000\u0000test\u0000\u0000");
         // testOp(browser, "Bacon Cipher Decode", "test input", "test_output");
         // testOp(browser, "Bacon Cipher Encode", "test input", "test_output");
-        testOp(browser, "Bcrypt", "test input", /^\$2a\$06\$.{53}$/, [6]);
+        testOp(browser, "Bcrypt", "test input", /^\$2b\$06\$.{53}$/, [6]);
         testOp(browser, "Bcrypt compare", "test input", "Match: test input", ["$2a$05$FCfBSVX7OeRkK.9kQVFCiOYu9XtwtIbePqUiroD1lkASW9q5QClzG"]);
         testOp(browser, "Bcrypt parse", "$2a$05$kXWtAIGB/R8VEzInoM5ocOTBtyc0m2YTIwFiBU/0XoW032f9QrkWW", /Rounds: 5/);
         testOp(browser, "Bifid Cipher Decode", "qblb tfovy", "test input", ["pass"]);
diff --git a/tests/node/tests/operations.mjs b/tests/node/tests/operations.mjs
index a97f5ccb..3b2bbda6 100644
--- a/tests/node/tests/operations.mjs
+++ b/tests/node/tests/operations.mjs
@@ -136,8 +136,8 @@ Tiger-128`;
     it("Bcrypt", async () => {
         const result = await chef.bcrypt("Put a Sock In It");
         const strResult = result.toString();
-        assert.equal(strResult.length, 60);
-        assert.equal(strResult.slice(0, 7), "$2a$10$");
+        assert.match(strResult, /^\$2b\$10\$[./A-Za-z0-9]{53}$/);
+        assert.equal(strResult.split("$").length, 4);
     }),
 
     it("bcryptCompare", async() => {