Bump jsrsasign from 11.1.0 to 11.1.1

[dependabot]

Bumps jsrsasign from 11.1.0 to 11.1.1.

Changelog

Sourced from jsrsasign's changelog.

ChangeLog for jsrsasign

• Changes from 11.1.2 to 11.1.3 (2026-Apr-18)

  • base64x.js
    • timingSafeEqual and timingSafeEqualImpl added
  • jws.js
    • modified to use timingSafeEqual for HS* signature verification
  • Security fixes:
    • JWS hmac signature validation timing attack fix #654 by @​Kr0emer
  • bugfix
    • jws.js
      • wrong thumbprint calculation for symmetric key (KJUR.jws.JWS.getJWKthumbprint) reported in issue #656 by @​e3stpavel.

• Changes from 11.1.1 to 11.1.2 (2026-Apr-12)

  • Security fixes:
    • HIGH: wrong random for for Node.JS >= 19 and modern browsers (ext/rng.js SecureRandom) reported by Bronson Yen of Calif.io and @​Kr0emer #655.
    • HIGH: ASN.1 Parser Infinite Loop (asn1hex.js) getChildIdx fix to avoid infinite loop reported by Koda Reef.
    • HIGH: DSA Universal Signature Forgery (dsa.js) FIPS 186-4 section 4.7 wrong boundary checking in verifyWithMessageHash reported by Koda Reef, Nicholas Carlini and @​Kr0emer.
    • ASN1HEX.getChildIdx DoS (asn1hex.js) getChildIdx may raise DoS because of lacking value length check reported by Yt(yutengsun) and Franciny S Roj.
    • missing JWS crit header parameter validation (jws.js) as reported by Franciny S Roj. Thank you indeed for those vulnerability reports and/or patches.

• Changes from 11.1.0 to 11.1.1 (2026-Feb-20)

  • security fix for DSA and BigInteger
    • PR #651, #650, #649, #648, #647, #646, #645. Thank you @​Kr0remer
    • After assigned CVE number reports will be added.
  • SECURITY.md added. Thank you @​njg7194

restore KJUR.crypto.Cipher class without RSA/RSAOAEP support

• Changes from 11.0.0 to 11.1.0 (2024-Feb-01)
  • src/crypto.js
    • restore KJUR.crypto.Cipher class without RSA and RSAOAEP encryption/decryption support

remove RSA and RSAOAEP encryption for Marvin attack

• Changes from 10.9.0 to 11.0.0 (2024-Jan-16)
  • Major Changes:
    • Stop to support Internet Explorer.
    • Stop to support bower.
    • Modern ECMA functions will be introduced such as Promise, let, Array methods or class.
    • API document generator will be changed from Jsdoc Toolkit to JSDoc3.
    • Module bandler will be used such as browserify or webpack.

... (truncated)

Commits

• e2b136e 11.1.1 release
• e2e417e Merge pull request #641 from njg7194/add-security-policy
• 77f1776 Merge pull request #651 from Kr0emer/fix/bug-007-isprobableprime-negative
• 5ea1c32 Merge pull request #650 from Kr0emer/fix/bug-006-modpow-negative-exponent
• ee4b013 Merge pull request #647 from Kr0emer/fix/bug-003-dsa-nonce-compareto
• 37b4c06 Merge pull request #646 from Kr0emer/fix/bug-002-dsa-domain-params-validation
• d89f0ec fix(crypto): correct compareTo checks in BigInteger RNG helpers
• 02fa75d fix(jsbn2): reject non-positive values in primality checks
• f508ddd Merge branch 'master' into fix/bug-002-dsa-domain-params-validation
• ca5b027 Merge pull request #648 from Kr0emer/fix/bug-004-modinverse-dos
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Patch-only dependency bump with security fixes in the crypto library; no app logic changes, though the library touches signing paths used by sha512HashAndSign.

Overview
Bumps the jsrsasign dependency from 11.1.0 to 11.1.1 in package.json and package-lock.json only—no application code changes.

The wallet uses jsrsasign in src/util/crypto.ts for SHA-512 hashing and RSA signing (KJUR.crypto.Util.sha512). 11.1.1 includes upstream security fixes for DSA and BigInteger (issues #645–#651) plus a SECURITY.md addition.

^{Reviewed by Cursor Bugbot for commit 8eb10cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jsrsasign@​11.1.0 ⏵ 11.1.1	+1	+75	+1

View full report