Bump sha.js from 2.4.11 to 2.4.12 in /controlpanel

[dependabot]

Bumps sha.js from 2.4.11 to 2.4.12.

Changelog

Sourced from sha.js's changelog.

v2.4.12 - 2025-07-01

Commits

• [eslint] switch to eslint 7acadfb
• [meta] add auto-changelog b46e711
• [eslint] fix package.json indentation df9d521
• [Tests] migrate from travis to GHA c43c64a
• [Fix] support multi-byte wide typed arrays f2a258e
• [meta] reorder package.json d8d77c0
• [meta] add npmignore 35aec35
• [Tests] avoid console logs 73e33ae
• [Tests] fix tests run in batch 2629130
• [Tests] drop node requirement to 0.10 00c7f23
• [Dev Deps] update buffer, hash-test-vectors, standard, tape, typedarray 92b5de5
• [Tests] drop node requirement to v3 9b5eca8
• [meta] set engines to >= 4 807084c
• Only apps should have lockfiles c72789c
• [Deps] update inherits, safe-buffer 5428cfc
• [Dev Deps] update @ljharb/eslint-config 2dbe0aa
• update README to reflect LICENSE 8938256
• [Dev Deps] add missing peer dep d528896
• [Dev Deps] remove unused buffer dep 94ca724

Commits

• eb4ea2f v2.4.12
• d8d77c0 [meta] reorder package.json
• df9d521 [eslint] fix package.json indentation
• 35aec35 [meta] add npmignore
• d528896 [Dev Deps] add missing peer dep
• b46e711 [meta] add auto-changelog
• 94ca724 [Dev Deps] remove unused buffer dep
• 2dbe0aa [Dev Deps] update @ljharb/eslint-config
• 73e33ae [Tests] avoid console logs
• f2a258e [Fix] support multi-byte wide typed arrays
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for sha.js since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[mariacarmina]

@dependabot rebase

[alexcos20]

@dependabot rebase

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the sha.js package from version 2.4.11 to 2.4.12 within the /controlpanel directory, as part of a routine Dependabot dependency bump. The update primarily affects package-lock.json, reflecting the version change and a cascade of transitive dependency updates. The sha.js patch release itself focuses on internal dependency updates (e.g., inherits, safe-buffer, and adding to-buffer) rather than functional changes to the hashing algorithm. This PR also introduces license information and funding URLs for several updated transitive dependencies, improving metadata.

Comments:
• [INFO][other] Multiple transitive dependencies have been updated. While expected with package-lock.json changes, it's good to note the breadth of updates, including available-typed-arrays, call-bind, get-intrinsic, is-typed-array, and which-typed-array. These are mostly low-level utility libraries, so the risk of regressions is minimal.
• [INFO][other] The primary dependency, sha.js, has been updated from 2.4.11 to 2.4.12. The changelog indicates this is a patch release focused on updating its own internal dependencies (inherits, safe-buffer) and adding to-buffer, rather than significant functional changes. This confirms the low risk of this specific update.
• [INFO][style] The dev: true flag for isarray has been removed. This typically means the package is now explicitly considered a production dependency, or the flag was redundant. This is a minor metadata change.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request is an automated dependency update by Dependabot. It bumps the sha.js package from version 2.4.11 to 2.4.12 within the /controlpanel directory. The changes are confined to package-lock.json, reflecting the updated sha.js version and its transitive dependencies. The changelog for sha.js 2.4.12 indicates internal dependency updates rather than functional changes.

Comments:
• [INFO][other] This package-lock.json update is expected due to the sha.js dependency bump. The numerous changes observed are consistent with the refreshing of the dependency tree, including internal updates to sha.js's own dependencies (e.g., available-typed-arrays, call-bind, get-intrinsic, gopd, has-symbols, hasown, is-typed-array, typed-array-buffer, to-buffer, math-intrinsics). No manual code changes are introduced, confirming this is a standard Dependabot update.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, opened by Dependabot, updates the sha.js dependency from version 2.4.11 to 2.4.12 within the controlpanel directory. The changes are solely confined to controlpanel/package-lock.json, reflecting the direct patch version upgrade and numerous transitive dependency updates. The upstream changelog for sha.js@2.4.12 confirms that this is a maintenance release focused on updating indirect dependencies and internal refactoring, rather than introducing new features or significant functional changes. This is a routine and low-risk dependency update.

Comments:
• [INFO][other] The isarray dependency had "dev": true removed. This is a minor change in the lockfile metadata and unlikely to cause issues, but it's worth noting if there's a specific reason it was marked as a dev dependency previously and now isn't. It likely reflects an updated dependency resolution strategy.
• [INFO][other] The has-proto dependency had "dev": true added. Similar to the isarray change, this is a minor metadata update in the lockfile and typically harmless, reflecting how the dependency is now categorized within the overall dependency tree by the package manager.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the sha.js dependency in the /controlpanel directory from version 2.4.11 to 2.4.12. This is a routine patch version bump identified by Dependabot, primarily addressing a bug fix related to error handling in to-buffer (a new transitive dependency). The package-lock.json file reflects numerous other minor and patch version updates to transitive dependencies, which is expected behavior for npm dependency resolution.

Comments:
• [INFO][other] The primary dependency updated is sha.js from 2.4.11 to 2.4.12. Checking the commit history for sha.js shows this is a bug fix release, specifically 'fix: handle errors in to-buffer'. This is a positive change, improving robustness.

Additional license, engines, and funding fields have also been added to the sha.js entry in package-lock.json, which is a metadata improvement.
• [INFO][other] The utf-8-validate dependency has been removed. Given its previous optional: true and peer: true status, it might no longer be a required transitive dependency for the updated package tree, or its functionality is now handled differently by other dependencies. This change generally indicates a cleanup or a shift in dependency requirements, but it's worth noting if any specific functionality relied directly on it, though unlikely given its optional nature.
• [INFO][other] Multiple @parcel/watcher platform-specific packages (e.g., android-arm64, darwin-x64, freebsd-x64, linux-*, win32-*) have been added or updated. These are typically optional dependencies for file watching in development environments. Their presence is a normal part of how npm resolves optional binaries for different platforms during npm install.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
Updates the sha.js dependency from 2.4.11 to 2.4.12 in the /controlpanel directory. This is a routine Dependabot security update that primarily addresses Node.js 20 compatibility fixes for sha.js. The change is limited to package-lock.json and includes numerous transitive dependency updates.

Comments:
• [INFO][other] The utf-8-validate optional dependency has been removed from the lockfile as part of these transitive updates. As an optional dependency, its absence typically means a JavaScript fallback implementation will be used. Please ensure that this change does not introduce any noticeable performance regressions if controlpanel relies heavily on fast UTF-8 validation.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, generated by Dependabot, updates the sha.js package from version 2.4.11 to 2.4.12 within the /controlpanel directory. This is a minor patch update that includes a bug fix for the hash.copy() method and updates to sha.js's indirect dependencies (inherits, safe-buffer, and introduces to-buffer). The update also reflects a regenerated package-lock.json file, which has resulted in several other transitive dependency updates, new optional native modules for @parcel/watcher being listed, and the removal of utf-8-validate (an optional dependency for ws).

Comments:
• [INFO][other] The primary dependency update here is sha.js from 2.4.11 to 2.4.12. The changelog indicates this includes a bug fix for hash.copy() and internal dependency updates, which is generally a positive change for maintenance and potential security enhancements. No breaking changes are expected for a patch version.
• [INFO][other] Many new optional native modules for @parcel/watcher (e.g., android-arm64, darwin-x64, linux-arm64-musl, win32-ia32, etc.) have been added to the package-lock.json. This is likely a side effect of the package-lock.json regeneration by Dependabot, where the npm/yarn version might be listing all possible optional native binaries. As these are optional, they should only be installed if applicable to the build environment and don't typically affect core functionality on other platforms.
• [WARNING][performance] The utf-8-validate optional dependency has been removed. This package is typically used by ws (websocket library) for performance optimization by providing a native C++ implementation for UTF-8 validation. While it's an optional dependency and ws should fall back to a JavaScript implementation if it's not present, this could potentially lead to a slight performance degradation in websocket communication within the controlpanel if ws is heavily utilized. Please confirm if websocket performance is a critical factor for the controlpanel in specific use cases.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
Dependabot PR to update the sha.js package from 2.4.11 to 2.4.12 in the /controlpanel directory. This is a patch version update for sha.js. The update to package-lock.json also reflects numerous transitive dependency updates and additions, including new platform-specific optional dependencies for @parcel/watcher and minor version bumps for several utility libraries (e.g., available-typed-arrays, call-bind, get-intrinsic, is-typed-array). Notably, utf-8-validate (an optional peer dependency) has been removed as part of these transitive changes.

Comments:
• [INFO][other] The utf-8-validate package, which was an optional and peer dependency, has been removed. While it was optional, it's typically used for WebSocket performance optimizations. Please verify that its removal does not negatively impact any functionality or performance within the controlpanel that might have implicitly relied on it. This is likely a safe transitive change, but a quick check is good practice.