Skip to content

doc: add Hmac.digest() documentation-only deprecation (DEP0206)#63121

Open
Anshikakalpana wants to merge 1 commit intonodejs:mainfrom
Anshikakalpana:hmac-fix-v2
Open

doc: add Hmac.digest() documentation-only deprecation (DEP0206)#63121
Anshikakalpana wants to merge 1 commit intonodejs:mainfrom
Anshikakalpana:hmac-fix-v2

Conversation

@Anshikakalpana
Copy link
Copy Markdown

@Anshikakalpana Anshikakalpana commented May 4, 2026

Refs: #62838

Situation

Calling digest() on an already-finalized Hmac instance currently returns an empty buffer silently instead of throwing an error. This is inconsistent with Hash behavior which throws ERR_CRYPTO_HASH_FINALIZED and is a potential security footgun.

Change

Add a runtime deprecation warning (DEP0206) when digest() is called more than once on an Hmac instance. The existing behavior (returning an empty buffer) is preserved during the deprecation cycle to avoid breaking changes.

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/userland-migrations

@nodejs-github-bot nodejs-github-bot added crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels May 4, 2026
@Renegade334
Copy link
Copy Markdown
Member

We should create a doc-deprecation first that can land on current release lines.

@Anshikakalpana
Copy link
Copy Markdown
Author

@Renegade334
Thanks for the suggestion! I’ve updated this PR to introduce a documentation-only deprecation and removed the runtime changes

Comment thread doc/api/deprecations.md Outdated
@Renegade334
Copy link
Copy Markdown
Member

Please can you squash your commits with a new commit message that reflects a documentation-only deprecation, so that the changelog is correct?

@Renegade334 Renegade334 added the deprecations Issues and PRs related to deprecations. label May 4, 2026
Comment thread doc/api/deprecations.md Outdated
@Anshikakalpana
Copy link
Copy Markdown
Author

Thanks! Updated and squashed into a single doc-only commit.

Comment thread doc/api/deprecations.md Outdated
description: Documentation-only deprecation.
-->

Type: Runtime
Copy link
Copy Markdown
Member

@Renegade334 Renegade334 May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Type: Runtime
Type: Documentation-only

LGTM otherwise. I suspect you will need to shorten your commit message though.

Signed-off-by: anshikakalpana <anshikajain196872@gmail.com>
@Renegade334 Renegade334 requested review from ChALkeR, jasnell and panva May 5, 2026 12:33
@Renegade334 Renegade334 removed the needs-ci PRs that need a full CI run. label May 5, 2026
@Renegade334 Renegade334 changed the title crypto: runtime deprecate multiple Hmac.digest() calls (DEP0206) crypto: doc-deprecate multiple Hmac.digest() calls (DEP0206) May 5, 2026
@panva panva changed the title crypto: doc-deprecate multiple Hmac.digest() calls (DEP0206) doc: add Hmac.digest() documentation-only deprecation (DEP0206) May 6, 2026
@panva panva added the commit-queue Add this label to land a pull request using GitHub Actions. label May 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

commit-queue Add this label to land a pull request using GitHub Actions. crypto Issues and PRs related to the crypto subsystem. deprecations Issues and PRs related to deprecations.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants