Skip to content

Bump @napi-rs/keyring from 1.3.0 to 2.0.0 - #36

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/napi-rs/keyring-2.0.0
Open

Bump @napi-rs/keyring from 1.3.0 to 2.0.0#36
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/napi-rs/keyring-2.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown

Bumps @napi-rs/keyring from 1.3.0 to 2.0.0.

Release notes

Sourced from @​napi-rs/keyring's releases.

v2.0.0

⚠️ Breaking Changes

This release changes how credential store errors are reported. Success and "not found" results are unchanged, but provider failures that were previously silenced now throw (sync API) or reject (async API).

1. Reads: getPassword() / getSecret()

Previously, any failure reading the credential store — a locked keychain, denied access, an OS error — was swallowed and returned as null / undefined, indistinguishable from "no credential stored".

Now only a genuinely missing credential (NoEntry) returns the absent result. Every other error throws or rejects:

Scenario v1.x v2.0.0
Credential exists value value (unchanged)
Credential missing null / undefined null / undefined (unchanged)
Store locked / inaccessible / OS error null / undefined ⚠️ throws / rejects

2. Deletes: deleteCredential() / deletePassword()

Previously, any delete failure returned false, so a failed delete looked identical to "credential was already gone" — leaving callers unable to tell whether the secret was actually removed.

Now false only means the credential did not exist (NoEntry). A failed delete throws or rejects:

Scenario v1.x v2.0.0
Credential deleted true true (unchanged)
No credential to delete false false (unchanged)
Delete failed (locked store, OS error) false ⚠️ throws / rejects

A false result now guarantees the credential is absent from the store.

3. TypeScript: async deletePassword() return type

The async deletePassword() alias is now correctly declared as Promise<boolean> instead of Promise<unknown>. This is a narrowing and is source-compatible for typical usage, but code that treated the result as unknown may need a small type adjustment.

These changes apply to both Entry (sync) and AsyncEntry (async), including the deletePassword() aliases.


🔧 Migration Guide

If you only check for absent credentials — no change needed

// Still works exactly as before: null means "not stored"
const password = await entry.getPassword()
if (password === null) {
  // no credential stored
}

... (truncated)

Commits
  • f344941 2.0.0
  • 648d7ce chore: bump up cross-platform-actions/action action to v1.5.0 (#140)
  • 5df8cf5 fix: propagate credential store errors instead of erasing them into false/abs...
  • a8709c1 chore: bump up cross-platform-actions/action action to v1.4.0 (#139)
  • 58edf33 fix: preserve non-missing password read errors (#136)
  • 8e1e418 chore: bump up Yarn to v4.18.0 (#135)
  • df1f9b5 chore: bump up chalk version to v6 (#134)
  • 3e7bcc4 chore: bump up typescript version to v7 (#132)
  • 9ded330 chore: bump up actions/setup-node action to v7 (#133)
  • f330874 chore: bump up Yarn to v4.17.1 (#131)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@napi-rs/keyring](https://github.com/Brooooooklyn/keyring-node) from 1.3.0 to 2.0.0.
- [Release notes](https://github.com/Brooooooklyn/keyring-node/releases)
- [Commits](Brooooooklyn/keyring-node@v1.3.0...v2.0.0)

---
updated-dependencies:
- dependency-name: "@napi-rs/keyring"
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Development

Successfully merging this pull request may close these issues.

0 participants