Update dependencies.

.github/workflows/main.yml → .github/workflows/main.yaml

@@ -1,7 +1,9 @@
-name: Bedrock Node.js CI
+name: Main CI
 
 on: [push]
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -11,6 +13,8 @@ jobs:
         node-version: [24.x]
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@v6
       with:
@@ -19,7 +23,6 @@ jobs:
     - name: Run eslint
       run: npm run lint
   test-node:
-    needs: [lint]
     runs-on: ubuntu-latest
     timeout-minutes: 10
     services:
@@ -32,6 +35,8 @@ jobs:
         node-version: [22.x, 24.x]
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@v6
       with:
@@ -45,7 +50,6 @@ jobs:
         cd test
         npm test
   coverage:
-    needs: [test-node]
     runs-on: ubuntu-latest
     timeout-minutes: 10
     services:
@@ -58,6 +62,8 @@ jobs:
         node-version: [24.x]
     steps:
     - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@v6
       with:
@@ -73,6 +79,6 @@ jobs:
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@v6
       with:
-        file: ./test/coverage/lcov.info
+        files: ./test/coverage/lcov.info
         fail_ci_if_error: true
         token: ${{ secrets.CODECOV_TOKEN }}

CHANGELOG.md

@@ -1,5 +1,15 @@
 # bedrock-tokenization ChangeLog
 
+## 23.3.0 - 2026-06-dd
+
+### Changed
+- Expect node >= 22.
+- Update dependencies:
+  - `canonicalize@3`
+  - `@digitalbazaar/cborld@8.1`
+  - `@digitalbazaar/minimal-cipher@6.1.1`
+  - `lru-cache@11.5.1`.
+
 ## 23.2.0 - 2026-06-21
 
 ### Added

eslint.config.js

@@ -0,0 +1,16 @@
+import config from '@digitalbazaar/eslint-config/node-recommended';
+
+export default [
+  ...config,
+  {
+    files: [
+      'test/mocha/**/*.js'
+    ],
+    languageOptions: {
+      globals: {
+        // @bedrock/test global
+        assertNoError: true
+      }
+    }
+  }
+];

lib/batchVersions.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2020-2025 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2020-2026 Digital Bazaar, Inc.
  */
 import * as bedrock from '@bedrock/core';
 import * as database from '@bedrock/mongodb';
@@ -14,7 +14,7 @@ const {util: {BedrockError}} = bedrock;
 const CACHE = new LRU({
   max: 100,
   // 24 hour ttl
-  ttl: 1000 * 60 * 60 * 24,
+  ttl: 1000 * 60 * 60 * 24
 });
 
 // a special ID, the literal string "NEXT_OPTIONS", is used to identify the

lib/tokens/aeskw.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2020-2022 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2020-2026 Digital Bazaar, Inc.
  */
 import crypto from 'node:crypto';
 
@@ -41,7 +41,7 @@ class Kek {
     try {
       const cipher = crypto.createDecipheriv('id-aes256-wrap', kek, AES_KW_IV);
       return Buffer.concat([cipher.update(wrappedKey), cipher.final()]);
-    } catch(e) {
+    } catch {
       // decryption failed
       return null;
     }

lib/tokens/batches.js

@@ -1,7 +1,6 @@
 /*!
- * Copyright (c) 2020-2025 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2020-2026 Digital Bazaar, Inc.
  */
-import * as base64url from 'base64url-universal';
 import * as batchVersions from '../batchVersions.js';
 import * as bedrock from '@bedrock/core';
 import * as database from '@bedrock/mongodb';
@@ -23,7 +22,7 @@ only 100, so it fits within this parameter. The config for this module has
 comments that indicate that the max configurable token batch size is 256 and
 this is because of this implementation detail. */
 const EMPTY_RESOLVED_LIST_FOR_MAX_BATCH_SIZE_256 = Buffer.from(
-  base64url.decode('H4sIAAAAAAAAA2NgwA8ArVUKGSAAAAA'));
+  'H4sIAAAAAAAAA2NgwA8ArVUKGSAAAAA', 'base64url');
 
 const INTERNAL_ID_SIZE = 16;
 const MAX_TOKEN_COUNT = 100;

lib/tokens/format.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2020-2025 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2020-2026 Digital Bazaar, Inc.
  */
 import * as base58 from 'base58-universal';
 import * as batchVersions from '../batchVersions.js';
@@ -77,7 +77,7 @@ export async function create({
   // salt
   payload.set(salt, offset += 2);
   // wrapped
-  payload.set(wrapped, offset += salt.length);
+  payload.set(wrapped, offset + salt.length);
 
   // ConcealedIdToken "meta" is "attributes"
 
@@ -88,7 +88,7 @@ export async function create({
     '@context': CIT_CONTEXT_URL,
     type: 'ConcealedIdToken',
     meta: `z${base58.encode(attributes)}`,
-    payload: `z${base58.encode(payload)}`,
+    payload: `z${base58.encode(payload)}`
   };
   const token = await cborldEncode({
     jsonldDocument,
@@ -183,7 +183,7 @@ export async function parse({token}) {
   let offset = payload.byteOffset + VERSION_SIZE;
   const salt = new Uint8Array(payload.buffer, offset, batchSaltSize);
   const wrapped = new Uint8Array(
-    payload.buffer, offset += batchSaltSize, wrappedSize);
+    payload.buffer, offset + batchSaltSize, wrappedSize);
 
   // get tokenizer associated with version
   const tokenizer = await tokenizers.get({id: batchVersion.tokenizerId});

lib/tokens/resolve.js

@@ -1,7 +1,6 @@
 /*!
- * Copyright (c) 2020-2025 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2020-2026 Digital Bazaar, Inc.
  */
-import * as base64url from 'base64url-universal';
 import * as bedrock from '@bedrock/core';
 import * as entities from '../entities.js';
 import {
@@ -95,7 +94,7 @@ export async function resolve({
     });
 
     // find resolution list for `requester`
-    const encodedRequester = base64url.encode(requester);
+    const encodedRequester = Buffer.from(requester).toString('base64url');
     const requesterList = resolution[encodedRequester];
 
     // see if token is already resolved

package.json

@@ -5,7 +5,7 @@
   "description": "Bedrock Tokenization Engine",
   "main": "./lib/index.js",
   "scripts": {
-    "lint": "eslint ."
+    "lint": "eslint"
   },
   "repository": {
     "type": "git",
@@ -26,15 +26,14 @@
   "homepage": "https://github.com/digitalbazaar/bedrock-tokenization",
   "dependencies": {
     "@digitalbazaar/bitstring": "^3.1.0",
-    "@digitalbazaar/cborld": "^8.0.0",
-    "@digitalbazaar/minimal-cipher": "^6.0.0",
+    "@digitalbazaar/cborld": "^8.1.0",
+    "@digitalbazaar/minimal-cipher": "^6.1.1",
     "assert-plus": "^1.0.0",
     "base58-universal": "^2.0.0",
-    "base64url-universal": "^2.0.0",
     "bnid": "^3.0.0",
-    "canonicalize": "^2.1.0",
+    "canonicalize": "^3.0.0",
     "cit-context": "^2.0.1",
-    "lru-cache": "^11.1.0",
+    "lru-cache": "^11.5.1",
     "p-limit": "^6.2.0"
   },
   "peerDependencies": {
@@ -45,15 +44,13 @@
     "@bedrock/tokenizer": "^11.0.0"
   },
   "devDependencies": {
-    "eslint": "^8.57.1",
-    "eslint-config-digitalbazaar": "^5.2.0",
-    "eslint-plugin-jsdoc": "^50.6.8",
-    "eslint-plugin-unicorn": "^56.0.1"
+    "@digitalbazaar/eslint-config": "^9.0.0",
+    "eslint": "^10.5.0"
   },
   "directories": {
     "lib": "./lib"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   }
 }

test/mocha/10-documents.js

@@ -80,7 +80,7 @@ describe('Documents', function() {
         header: {
           kid: 'did:key:z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH#' +
             'z6LSbysY2xFMRpGMhb7tFTLMpeuPRaqaWM1yECx2AtzE3KCc',
-          alg: 'ECDH-ES+A256KW',
+          alg: 'ECDH-ES+A256KW'
         }
       }];
       const result = await documents.register({