From 1b466cd0b6b2bb0fa2958cfff6556b48eaec1808 Mon Sep 17 00:00:00 2001 From: Pranav Jain Date: Tue, 27 Oct 2026 10:09:26 -0600 Subject: [PATCH 1/2] chore(bitgo): deprecate sjcl export and drop unused SJCL deps Note that the bitgo.sjcl export may be removed in a future major release. Move @bitgo/sjcl to devDependencies in sdk-coin-polygon, where only tests use it. In web-demo, build the demo keycard with encrypt from sdk-api and drop the direct @bitgo/sjcl dependency. Ticket: WCN-177 --- modules/bitgo/src/index.ts | 5 ++++- modules/sdk-coin-polygon/package.json | 2 +- modules/web-demo/package.json | 1 - modules/web-demo/src/components/KeyCard/fixtures.ts | 6 +++--- 4 files changed, 8 insertions(+), 6 deletions(-) diff --git a/modules/bitgo/src/index.ts b/modules/bitgo/src/index.ts index ad43f48b50e..fc483c587c9 100644 --- a/modules/bitgo/src/index.ts +++ b/modules/bitgo/src/index.ts @@ -18,7 +18,10 @@ export * from './bitgo'; /** @deprecated */ export { bitcoin } from '@bitgo/sdk-core'; -/** @deprecated */ +/** + * @deprecated SJCL is unmaintained and this export may be removed in a future major release. + * Use `bitgo.encrypt` / `bitgo.decrypt`, or native crypto, instead. + */ export const sjcl = require('@bitgo/sjcl'); export { Buffer } from 'buffer'; diff --git a/modules/sdk-coin-polygon/package.json b/modules/sdk-coin-polygon/package.json index 78e70114751..593ae1dbdd3 100644 --- a/modules/sdk-coin-polygon/package.json +++ b/modules/sdk-coin-polygon/package.json @@ -43,7 +43,6 @@ "@bitgo/abstract-eth": "^25.5.2", "@bitgo/sdk-core": "^40.2.0", "@bitgo/secp256k1": "^1.11.1", - "@bitgo/sjcl": "^1.1.0", "@bitgo/statics": "^59.25.0", "@ethereumjs/common": "^2.6.5", "bignumber.js": "^9.1.2", @@ -53,6 +52,7 @@ }, "devDependencies": { "@bitgo/sdk-api": "^3.1.4", + "@bitgo/sjcl": "^1.1.0", "@bitgo/sdk-test": "^9.1.89", "secp256k1": "5.0.1" }, diff --git a/modules/web-demo/package.json b/modules/web-demo/package.json index 224396420e6..d1357723ae0 100644 --- a/modules/web-demo/package.json +++ b/modules/web-demo/package.json @@ -64,7 +64,6 @@ "@bitgo/sdk-hmac": "^1.9.2", "@bitgo/sdk-lib-mpc": "^11.6.0", "@bitgo/sdk-opensslbytes": "^2.1.0", - "@bitgo/sjcl": "^1.1.0", "@bitgo/statics": "^59.25.0", "bitgo": "^54.2.2", "lodash": "^4.18.0", diff --git a/modules/web-demo/src/components/KeyCard/fixtures.ts b/modules/web-demo/src/components/KeyCard/fixtures.ts index 401447beee2..217134c8483 100644 --- a/modules/web-demo/src/components/KeyCard/fixtures.ts +++ b/modules/web-demo/src/components/KeyCard/fixtures.ts @@ -2,7 +2,7 @@ import { generateKeycard } from '@bitgo/key-card'; import { KeyCurve, coins } from '@bitgo/statics'; import { Keychain } from '@bitgo/sdk-core'; import { DklsDkg, DklsTypes } from '@bitgo/sdk-lib-mpc'; -import * as sjcl from '@bitgo/sjcl'; +import { encrypt } from '@bitgo/sdk-api'; function downloadKeycardImage(coinFamily: string): Promise { return new Promise((resolve, reject) => { @@ -61,7 +61,7 @@ export async function downloadKeycardForDKLsTSS() { const commonKeychain = DklsTypes.getCommonKeychain(userKeyShare); const userCompressed = user.getReducedKeyShare(); const backupCompressed = backup.getReducedKeyShare(); - const encryptedUser = sjcl.encrypt( + const encryptedUser = await encrypt( 't3stSicretly!', btoa( String.fromCharCode.apply( @@ -70,7 +70,7 @@ export async function downloadKeycardForDKLsTSS() { ), ), ); - const encryptedBackup = sjcl.encrypt( + const encryptedBackup = await encrypt( 't3stSicretly!', btoa( String.fromCharCode.apply( From 663b98ea3a9075a05790081375c9ef7c0d22a129 Mon Sep 17 00:00:00 2001 From: Pranav Jain Date: Tue, 27 Oct 2026 14:32:27 -0600 Subject: [PATCH 2/2] chore(examples): use sdk-api encrypt in audit key example Drop the direct @bitgo/sjcl import. Await assertIsValidKey, which is async, so the example's error cases are actually caught. Ticket: WCN-177 --- examples/ts/key/auditKeyExample.ts | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/examples/ts/key/auditKeyExample.ts b/examples/ts/key/auditKeyExample.ts index c346cf598e4..85226dc671f 100644 --- a/examples/ts/key/auditKeyExample.ts +++ b/examples/ts/key/auditKeyExample.ts @@ -1,6 +1,5 @@ import { BitGoAPI } from '@bitgo/sdk-api'; import { Tltc } from '@bitgo/sdk-coin-ltc'; -import * as sjcl from '@bitgo/sjcl'; require('dotenv').config({ path: '../../.env' }); const bitgo = new BitGoAPI({ @@ -16,11 +15,11 @@ async function main() { const baseCoin = bitgo.coin(coin); const keyPair = baseCoin.generateKeyPair(); const walletPassphrase = 'myStrongPassphrase'; - const encryptedPrv = sjcl.encrypt(walletPassphrase, keyPair.prv); + const encryptedPrv = await bitgo.encrypt({ input: keyPair.prv, password: walletPassphrase }); // 2. Call the function with valid arguments so that the function validates the created key try { - baseCoin.assertIsValidKey({ + await baseCoin.assertIsValidKey({ encryptedPrv, walletPassphrase, publicKey: keyPair.pub, @@ -32,7 +31,7 @@ async function main() { // 3. Call the function with the incorrect passphrase, console log the captured error and explain it's the wrong password try { - baseCoin.assertIsValidKey({ + await baseCoin.assertIsValidKey({ encryptedPrv, walletPassphrase: 'wrongPassphrase', publicKey: keyPair.pub, @@ -45,7 +44,7 @@ async function main() { // 4. Call the function with a modified encryptedPrv, console log the captured error and explain that the prv is wrong try { const tamperedEncryptedPrv = encryptedPrv.slice(0, -1) + (encryptedPrv.slice(-1) === 'a' ? 'b' : 'a'); - baseCoin.assertIsValidKey({ + await baseCoin.assertIsValidKey({ encryptedPrv: tamperedEncryptedPrv, walletPassphrase, publicKey: keyPair.pub, @@ -59,7 +58,7 @@ async function main() { try { // Generate a new key pair to get a different public key const anotherKeyPair = baseCoin.generateKeyPair(); - baseCoin.assertIsValidKey({ + await baseCoin.assertIsValidKey({ encryptedPrv, walletPassphrase, publicKey: anotherKeyPair.pub, // mismatched public key