[dependabot]

Bumps altcha from 3.1.0 to 3.5.0.

Release notes

Sourced from altcha's releases.

v3.5.0

The "Protected by ALTCHA" footer link can now be reached with the keyboard. Its tabindex="-1" is removed in all built-in translations, so pressing Tab moves from the checkbox to the footer link and then to the next form control. The link's aria-label now also tells screen reader users that it opens in a new tab, for example "Altcha (official website, opens in new tab)".

Custom footer translations are not affected

If you override the footer string with your own translation, nothing changes for you. The widget renders your custom string exactly as you wrote it.

Restoring the previous behavior

If you need the footer link to stay out of the Tab order, set a custom footer string that includes tabindex="-1":

v3.4.1

Changes:

• Fix: regression in V1 challenge detection #202

v3.4.0

Changes:

• Fix: ./i18n/* export types condition points to dist/i18n/*.d.ts instead of the non-existent dist/external/*.d.ts #200
• Fix: support the form attribute to associate the widget with a <form> it is not nested in #201

v3.3.0

This release fixes the widget's proof-of-work code to match the fixed altcha-lib (v2.6.0). It fixes a key-derivation mismatch that caused valid solutions to be rejected, and a verification bypass in altcha/lib. Upgrading is recommended.

Security

• verifySolution bypass (altcha/lib). If the challenge had no keySignature, or the verifier passed no hmacKeySignatureSecret, verifySolution re-derived the key from the submitted counter but never checked it against the signed keyPrefix. Any counter, for example 0, together with its derived key verified without doing any work. The derived key must now also match keyPrefix. altcha-lib fixed this in e2a6daf (v2.3.2), but the fix never reached the widget's copy of this code until now.
• Obfuscation plugin key exposure. obfuscate() used the published keyPrefix as its AES key. If keyPrefixLength was overridden, part or all of that key could be published. It now encrypts with the full derived key and publishes only half of it. With default options the output format is the same, so existing obfuscated strings still decode.

Fixes

• SHA key derivation. Each round now hashes the full digest from the previous round, and the result is cut to keyLength once at the end. This is what altcha-lib and all server ports do. Before, the widget's solutions were rejected (invalidSolution) for SHA-384 or SHA-512 with cost > 1, and for any SHA-* challenge with keyLength below the digest size and cost > 1. The default (SHA-256, keyLength 32) was not affected.
• PBKDF2 key length. PBKDF2/* now supports any keyLength. Before, only 16, 24 and 32 worked.
• Algorithm names. The built-in deriveKey functions reject names they don't support. Before, unknown PBKDF2/* names fell back to SHA-256, and SCRYPT and ARGON2ID ignored the name. Each function now accepts only its own exact names:
  • SHA-256, SHA-384, SHA-512
  • PBKDF2/SHA-256, PBKDF2/SHA-384, PBKDF2/SHA-512
  • SCRYPT
  • ARGON2ID
• Input validation (altcha/lib):
  • createChallenge checks cost, keyLength, memoryCost, parallelism, counter, counterMode, expiresAt, hmacAlgorithm and the secrets.
  • createChallenge also checks the key prefix. keyPrefix must be a non-empty hex string, and it is lowercased before signing. keyPrefixLength must be a positive integer smaller than the derived key.
  • verifySolution returns invalidSolution for a malformed derivedKey (it must be lowercase hex) or counter (it must be an integer the counter mode can encode), instead of throwing or coercing the value.
  • solveChallenge throws immediately on an invalid keyPrefix instead of running until the timeout.
  • hexToBuffer rejects non-hex characters.
  • Canonical JSON keeps a __proto__ key, so an injected key now breaks the signature.
  • verifyServerSignature:
    • checks payload.algorithm against SHA-1, SHA-256, SHA-384 and SHA-512;
    • requires hmacSecret;
    • returns invalidSignature when the signature is missing;

... (truncated)

Changelog

Sourced from altcha's changelog.

[3.5.0] - 2026-10-22

• Fix: footer link is keyboard-focusable (removed tabindex="-1") and its aria-label announces that it opens in a new tab, in all translations #204

[3.4.1] - 2026-10-19

• Fix: regression in V1 challenge detection #202

[3.4.0] - 2026-10-15

• Fix: ./i18n/* export types condition points to dist/i18n/*.d.ts instead of the non-existent dist/external/*.d.ts #200
• Fix: support the form attribute to associate the widget with a <form> it is not nested in #201

[3.3.0] - 2026-10-05

• Fix: SHA key derivation hashes the full digest each round and truncates once, matching altcha-lib and the server ports (SHA-384/512 and any keyLength below the digest size with cost > 1 previously failed server verification)
• Fix: PBKDF2 supports any keyLength (uses deriveBits instead of an AES-GCM key)
• Fix: built-in deriveKey functions reject unsupported algorithm names
• Fix: verifySolution requires the re-derived key to match the signed keyPrefix, rejects malformed derivedKey/counter values, and validates secrets and hmacAlgorithm
• Fix: createChallenge validates its options (keyPrefixLength below the derived key length, non-empty hex keyPrefix lowercased before signing, positive integer cost/keyLength, valid counter and expiresAt)
• Fix: solveChallenge fails fast on an invalid keyPrefix
• Fix: hexToBuffer rejects non-hex input; canonical JSON keeps __proto__ keys
• Fix: verifyServerSignature validates algorithm and hmacSecret, handles a missing signature, and uses exact expiry
• Fix: obfuscation plugin encrypts with the full derived key instead of a keyPrefixLength-sized prefix

[3.2.4] - 2026-09-30

• Fix: unhandled AbortError when audio challenge play() is interrupted by pause() #199

[3.2.3] - 2026-09-20

• Fix: add rel=noopener attribute to external links #198

[3.2.2] - 2026-08-19

• Fix: theme attribute (widget types and HTML attribute)

[3.2.1] - 2026-07-12

• Fix: checkbox focus outline in safari #194

[3.2.0] - 2026-07-08

• Fix: i18n load-order #193

Commits

• f921727 v3.5.0
• 0090bff fix: footer link focusable (remove tabindex) #204
• e54922d v3.4.1
• 2363843 fix: regression in V1 challenge detection #202
• 2c0b5de v3.4.0
• 2ffdb17 fix: support the form attribute #201
• dc50c45 fix: i18n types export #200
• 1b72074 v3.3.0
• a9f393d deps: update vulnerabilities
• 999d339 fix: align pow library and helpers with fixed in altcha-lib
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)