Bump jsrsasign from 11.1.0 to 11.1.1

[dependabot]

Bumps jsrsasign from 11.1.0 to 11.1.1.

Changelog

Sourced from jsrsasign's changelog.

ChangeLog for jsrsasign

• Changes from 11.1.2 to 11.1.3 (2026-Apr-18)

  • base64x.js
    • timingSafeEqual and timingSafeEqualImpl added
  • jws.js
    • modified to use timingSafeEqual for HS* signature verification
  • Security fixes:
    • JWS hmac signature validation timing attack fix #654 by @​Kr0emer
  • bugfix
    • jws.js
      • wrong thumbprint calculation for symmetric key (KJUR.jws.JWS.getJWKthumbprint) reported in issue #656 by @​e3stpavel.

• Changes from 11.1.1 to 11.1.2 (2026-Apr-12)

  • Security fixes:
    • HIGH: wrong random for for Node.JS >= 19 and modern browsers (ext/rng.js SecureRandom) reported by Bronson Yen of Calif.io and @​Kr0emer #655.
    • HIGH: ASN.1 Parser Infinite Loop (asn1hex.js) getChildIdx fix to avoid infinite loop reported by Koda Reef.
    • HIGH: DSA Universal Signature Forgery (dsa.js) FIPS 186-4 section 4.7 wrong boundary checking in verifyWithMessageHash reported by Koda Reef, Nicholas Carlini and @​Kr0emer.
    • ASN1HEX.getChildIdx DoS (asn1hex.js) getChildIdx may raise DoS because of lacking value length check reported by Yt(yutengsun) and Franciny S Roj.
    • missing JWS crit header parameter validation (jws.js) as reported by Franciny S Roj. Thank you indeed for those vulnerability reports and/or patches.

• Changes from 11.1.0 to 11.1.1 (2026-Feb-20)

  • security fix for DSA and BigInteger
    • PR #651, #650, #649, #648, #647, #646, #645. Thank you @​Kr0remer
    • After assigned CVE number reports will be added.
  • SECURITY.md added. Thank you @​njg7194

restore KJUR.crypto.Cipher class without RSA/RSAOAEP support

• Changes from 11.0.0 to 11.1.0 (2024-Feb-01)
  • src/crypto.js
    • restore KJUR.crypto.Cipher class without RSA and RSAOAEP encryption/decryption support

remove RSA and RSAOAEP encryption for Marvin attack

• Changes from 10.9.0 to 11.0.0 (2024-Jan-16)
  • Major Changes:
    • Stop to support Internet Explorer.
    • Stop to support bower.
    • Modern ECMA functions will be introduced such as Promise, let, Array methods or class.
    • API document generator will be changed from Jsdoc Toolkit to JSDoc3.
    • Module bandler will be used such as browserify or webpack.

... (truncated)

Commits

• e2b136e 11.1.1 release
• e2e417e Merge pull request #641 from njg7194/add-security-policy
• 77f1776 Merge pull request #651 from Kr0emer/fix/bug-007-isprobableprime-negative
• 5ea1c32 Merge pull request #650 from Kr0emer/fix/bug-006-modpow-negative-exponent
• ee4b013 Merge pull request #647 from Kr0emer/fix/bug-003-dsa-nonce-compareto
• 37b4c06 Merge pull request #646 from Kr0emer/fix/bug-002-dsa-domain-params-validation
• d89f0ec fix(crypto): correct compareTo checks in BigInteger RNG helpers
• 02fa75d fix(jsbn2): reject non-positive values in primality checks
• f508ddd Merge branch 'master' into fix/bug-002-dsa-domain-params-validation
• ca5b027 Merge pull request #648 from Kr0emer/fix/bug-004-modinverse-dos
• Additional commits viewable in compare view

---

Note

Medium Risk
Touches a crypto library used for signing in src/util/crypto.ts; the change is a targeted security patch rather than a major upgrade, but crypto dependency updates warrant careful review.

Overview
Bumps the jsrsasign dependency from 11.1.0 to 11.1.1 in package.json and package-lock.json.

11.1.1 includes security fixes for DSA and BigInteger (multiple CVE-related PRs). The app uses jsrsasign in src/util/crypto.ts for SHA-512 hashing and RSA signing (sha512HashAndSign).

^{Reviewed by Cursor Bugbot for commit ff5c1c7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jsrsasign@​11.1.0 ⏵ 11.1.1	+1	+75	+1

View full report

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.