[dependabot]

Bumps @block65/webcrypto-web-push from 1.0.2 to 2.0.0.

Release notes

Sourced from @​block65/webcrypto-web-push's releases.

v2.0.0

What's Changed

• feat!: RFC 8291 aes128gcm and RFC 8292 vapid by @​maxholman in block65/webcrypto-web-push#19

Messages are now encrypted with aes128gcm (RFC 8291) and authenticated with the vapid scheme (RFC 8292), replacing the draft aesgcm encoding and the WebPush scheme. Apple accepts neither of the old ones, so Safari and iOS work now.

Verified against the RFC 8291 section 5 test vector, and by decrypting in Chrome and Firefox against their real push services.

Breaking

• encryptNotification returns the RFC 8188 body instead of { ciphertext, salt, localPublicKeyBytes }, and takes an options argument
• the crypto-key and encryption headers are gone
• messages are padded to a constant 4096 octets, so the maximum payload is 3993 bytes
• subscription endpoints must be https, p256dh must be a 65 byte uncompressed P-256 point and auth 16 octets
• node 22 or later

buildPushPayload is otherwise unchanged, so fetch(subscription.endpoint, payload) still works as documented. Stay on 1.x if you need the aesgcm encoding.

type-fest is no longer a dependency, leaving uint8array-extras as the only one.

Full Changelog: block65/webcrypto-web-push@v1.0.2...v2.0.0

Commits

• 6ced541 ci: skip the git branch check when staging
• c2763b4 ci: stage the publish rather than publishing directly
• 5cf4fca ci: publish with provenance over oidc
• e60d223 Merge pull request #19 from block65/v2
• 6b9cb09 docs: install with pnpm or npm, and name the package up front
• 541b742 ci: limit the github token to reading contents
• 565c7d2 fix(test): pin the mocked clock to UTC
• c53c021 test(e2e): fail on console errors, warnings and uncaught errors
• 1a2b75b refactor(e2e): use the playwright test runner
• 2adc032 chore(deps): share common versions through a pnpm catalog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​block65/webcrypto-web-push since your current version.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
base31	Ready	Preview	Oct 7, 2026 5:21pm UTC