refactor(internal-plugin-encryption): pkijs v3 + node 20 engines by Tiuipuv · Pull Request #4951 · webex/webex-js-sdk

Tiuipuv · 2026-05-05T18:46:41Z

This pull request addresses

Reduce the size of the dependency tree massively (which will allow consumers to remove --omit=optional from npm installs) due to the entire expo/react native tree being installed.

Before, when running npm install webex-js-sdk in a fresh directory will yield this:

1957 deps (415 mb)
68 vulnerabilities (66 moderate, 2 critical)

With this fix branch, it will yield this:

672 deps (134 MB)
59 vulnerabilities (57 moderate, 2 critical)

Lastly, this branch standardizes node ver to >=20 (up from ~18)

by making the following changes

This is done by removing deps in internal-plugin-encryption that are only used by that package, and are replaced with built-in functionality of modern browsers + nodejs.

The following deps are removed:

valid-url (replaced by new URL() constructor)
asn1js (functionality exposed by modern pkijs)
safe-buffer (exposed on global, pattern already used in other packages)
isomorphic-webcrypto (modern pkijs no longer requires a separate crypto implementation. this is where the massive react native dependencies is pulled in via optional deps)

The following were updated:

pkijs: v2.1.84 to v3.4.0

Also, this standardizes minimum NodeJS by addressing old engines.node fields stuck at v8, v14, v16, and v18, bumping up to v20. Similar to #4288

Change Type

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update
Tooling change
Internal code refactor

The following scenarios were tested

Ran unit tests, and attempted manual bad path injection to verify code coverage of kms.

For reviewing speed purposes, the actual logic changes occur just under internal-plugin-encryption, with the following files:

src/kms.js
src/kms-certificate-validation.js
test/integration/spec/kms.js

The GAI Coding Policy And Copyright Annotation Best Practices

I certified that

I have read and followed contributing guidelines
I discussed changes with code owners prior to submitting this pull request
I have not skipped any automated checks
All existing and new tests passed
I have updated the documentation accordingly

Make sure to have followed the contributing guidelines before submitting.

update pkijs to v3, and fix call points remove asn1js (using new pkijs features) remove valid-url (use native URL constructor) remove isomorphic-webcrypto (use new pkijs features) remove safe-buffer (use native Buffer constructor) remove uuid (use native uuid v4 via global crypto) fix jsdocs

aws-amplify-us-east-2 · 2026-05-05T18:57:10Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-4951.d3m3l2kee0btzx.amplifyapp.com

mkesavan13

Could you please remove all changes to mandate node v20 or is it that the package that you import supports only above node 20? Kindly clarify. Also, please update the branch. It has conflicts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 513979b5aa

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

…20 bumps - Replace all crypto.randomUUID() with uuid.v4() - Re-add uuid@^3.3.2 to package dependencies - Reverse package.json engines.node bumps

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1d16ea4fbc

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8e4cdd0618

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-05-26T17:19:25Z

💡 Codex Review

webex-js-sdk/packages/@webex/internal-plugin-encryption/src/kms-certificate-validation.js

Line 43 in 8e4cdd0

return Certificate.fromBER(Buffer.from(pem, 'base64'));

Restore explicit Buffer shim for certificate decoding

decodeCert() now calls Buffer.from(...) without importing Buffer, so browser builds that do not auto-polyfill Node globals (common in modern webpack/vite setups) will throw ReferenceError: Buffer is not defined during KMS JWT validation. This is a runtime regression introduced by dropping the previous safe-buffer import, and it blocks credential validation before any fallback logic can run.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

…global

Tiuipuv · 2026-05-26T20:56:44Z

@mkesavan13 package is up to date with latest from next.

The reason for the bump to v20 was because of crypto not being exposed globally until v19 (effectively v20 for LTS) of NodeJS. However, I reverted back to the very old uuid v3 lib so we can reduce scope for the PR. Its worth noting that some of the sub packages are already requiring v20 in engines (@webex/contact-center), so they really probably should be synced across the repo up to v20 for clarity on what the effective minimum version is.

Tiuipuv added 2 commits May 5, 2026 12:17

chore(node): bump node in package.json to 20

d08b5b5

Tiuipuv requested review from a team as code owners May 5, 2026 18:46

Tiuipuv changed the title ~~Refactor/internal plugin encryption pkijs v3~~ refactor(internal-plugin-encryption): pkijs v3 + node 20 engines May 5, 2026

bhabalan added the validated If the pull request is validated for automation. label May 14, 2026

mkesavan13 requested changes May 20, 2026

View reviewed changes

Merge branch 'next' into refactor/internal-plugin-encryption-pkijs-v3

513979b

chatgpt-codex-connector Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/@webex/internal-plugin-encryption/src/kms.js Outdated

Tiuipuv added 2 commits May 26, 2026 12:59

fix(internal-plugin-encryption): revert to uuid.v4() and revert node …

6ec0464

…20 bumps - Replace all crypto.randomUUID() with uuid.v4() - Re-add uuid@^3.3.2 to package dependencies - Reverse package.json engines.node bumps

Merge branch 'next' into refactor/internal-plugin-encryption-pkijs-v3

1d16ea4

chatgpt-codex-connector Bot reviewed May 26, 2026

View reviewed changes

Comment thread packages/@webex/internal-plugin-encryption/src/kms-certificate-validation.js

chore(engines): revert remaining engines fields

8e4cdd0

chatgpt-codex-connector Bot reviewed May 26, 2026

View reviewed changes

Comment thread packages/@webex/internal-plugin-encryption/src/kms-certificate-validation.js

fix(internal-plugin-encryption): direct import instead of relying on …

ecaee21

…global

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor(internal-plugin-encryption): pkijs v3 + node 20 engines#4951

refactor(internal-plugin-encryption): pkijs v3 + node 20 engines#4951
Tiuipuv wants to merge 7 commits into
webex:nextfrom
Evernorth:refactor/internal-plugin-encryption-pkijs-v3

Tiuipuv commented May 5, 2026 •

edited

Loading

Uh oh!

aws-amplify-us-east-2 Bot commented May 5, 2026

Uh oh!

mkesavan13 left a comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented May 26, 2026

Uh oh!

Tiuipuv commented May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Tiuipuv commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This pull request addresses

by making the following changes

Change Type

The following scenarios were tested

The GAI Coding Policy And Copyright Annotation Best Practices

I certified that

Uh oh!

aws-amplify-us-east-2 Bot commented May 5, 2026

Uh oh!

mkesavan13 left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented May 26, 2026

💡 Codex Review

Uh oh!

Tiuipuv commented May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Tiuipuv commented May 5, 2026 •

edited

Loading