Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update readme #2109

Merged
merged 6 commits into from
Jun 15, 2024
Merged

Update readme #2109

merged 6 commits into from
Jun 15, 2024

Conversation

jasonandjay
Copy link
Member

In case of #2106

1. Documented Error:
Added details about the Uncaught TypeError: (0 , fs_1.readFileSync) is not a function error with tiny-secp256k1 due to WASM issues in browsers.

2. ECC Library Alternatives:
Introduced @bitcoinjs-lib/tiny-secp256k1-asmjs and @bitcoinerlab/secp256k1 as alternatives for improved browser support.

@jasonandjay
Copy link
Member Author

unexpected test failed of audit, please have a look @junderw

@junderw
Copy link
Member

junderw commented Jun 13, 2024

Change - run: npm run audit to - run: npm run audit -- -x 1097496 to the audit script to ignore. This vulnerability will at worst crash when running the tests or eslint.

@junderw
Copy link
Member

junderw commented Jun 13, 2024

  1. Install a clean node_modules from npm ci (from package-lock)
  2. Run npm ls braces
  3. It shows which dependencies use it.
  4. Upgrade all those dependencies to latest.
  5. Refresh node_modules by deleting and re-runing npm ci
  6. Check again

Since it did not fix the audit, that means there is no fix out yet and/or the chain of dependencies hasn't upgraded yet.

We can't do anything, but check the content of the vulnerability and see if we can ignore it.

I think we can ignore it.

@junderw
Copy link
Member

junderw commented Jun 13, 2024

I think instead of modifying the audit script in package.json we should just modify the invocation in CI.

If some other user wants to run audit, we shouldn't mess with it.

... maybe -l high should also be moved from package.json to main_ci?

README.md Outdated
Comment on lines 108 to 113
If you encounter the following error:

```
Uncaught TypeError: (0 , fs_1.readFileSync) is not a function
```
This indicates that tiny-secp256k1's WASM implementation is not fully compatible with your browser environment.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need to mention the errors.

README.md Outdated
@@ -102,6 +102,22 @@ Which you can then import as an ESM module:
<script type="module">import "/scripts/bitcoinjs-lib.js"</script>
````

**Using Taproot:**
When utilizing Taproot features with bitcoinjs-lib, you may need to include an additional ECC (Elliptic Curve Cryptography) library. The commonly used tiny-secp256k1 library, however, might lead to compatibility issues due to its reliance on WASM (WebAssembly).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Backticks around tiny-secp256k1 so it's monospaced and stands out.

@jasonandjay
Copy link
Member Author

Which part needs to be optimized?

@junderw junderw merged commit e77c2f8 into bitcoinjs:master Jun 15, 2024
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants