Skip to content

Use crypton instead of deprecated cryptonite#161

Open
dancewithheart wants to merge 2 commits into
mongodb-haskell:masterfrom
dancewithheart:replace-cryptohash
Open

Use crypton instead of deprecated cryptonite#161
dancewithheart wants to merge 2 commits into
mongodb-haskell:masterfrom
dancewithheart:replace-cryptohash

Conversation

@dancewithheart

@dancewithheart dancewithheart commented May 4, 2026

Copy link
Copy Markdown

This replaces deprecated cryptohash with crypton (see: yesodweb/wai#931, kazu-yamamoto/crypton#5 (comment), commercialhaskell/stack#6200 and commercialhaskell/stackage#7474).

Also cabal-audit reports:

Hackage package cryptonite at version 0.30 is vulnerable for:
  HSEC-2025-0002 "Double Public Key Signing Function Oracle Attack on Ed25519"
  published: 2025-11-14 14:45:34 UTC
  https://haskell.github.io/security-advisories/advisory/HSEC-2025-0002
  No fix version available
  crypto

this silence this warning.

I think mongodb is not affected by HSEC-2025-0002 - it does not uses Ed25519 signing.

Comment thread mongoDB.cabal Outdated
@dancewithheart dancewithheart changed the title Replace deprecated cryptohash with crypton Use crypton instead of deprecated cryptonite May 11, 2026
@dancewithheart

Copy link
Copy Markdown
Author

Hi @VictorDenisov, sorry for the direct ping. I noticed you recently merged changes here, so I wanted to ask whether this PR looks reasonable.

This would help also `persistent

persistent-mongoDB -> mongoDB -> cryptohash -> cryptonite

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant