grubba
February 18, 2025, 2:24pm
1
A few days ago we announced that: Meteor.js v3.1.2 is out! π
Since then we have started working on 3.2 and currently, we have a beta version for you to try:
meteor update --release 3.2-beta.1
This beta includes:
meteor:devel
β vparpoil:feature/argon2-password-encryption
opened 05:29PM - 17 Jan 25 UTC
Following this discussion : https://github.com/meteor/meteor/discussions/13529 I⦠worked on a proposal to implement `argon2` as a drop-in replacement for `bcrypt` to securely store user password.
The `checkPasswordAsync` function has been updated to enable a seamless transition from `bcrypt` to `argon2`. A test has been added to verify this transition.
The `accounts-password` package still includes `bcrypt` as a dependency to support legacy hashed passwords
meteor:devel
β cunneen:feature/arm64-minisat-allow-memory-growth
opened 03:11PM - 03 Feb 25 UTC
Recompile minisat to address #12902 (`MINISAT-out: Cannot enlarge memory arrays`β¦ ), which [is still being reported](https://forums.meteor.com/t/meteor-update-failing-with-cannot-enlarge-memory-arrays/62740)
Changes we would love the community to give it a shot at testing.
Nacho is also working on a 2.16 patch to help out with the Error building cordova project that we are having on the 2.x versions.
Next releases:
Meteor 3.2.0 (late-February/early March 2025)
6 Likes
rjdavid
February 19, 2025, 12:11am
2
It will help a lot for a migration guide, not only technically, but also how it should happen in operations for the removal of bcrypt.
Not all users will be migrated through a login and therefore has to be forced to reset passwords before removing bcrypt
2 Likes
minhna
February 19, 2025, 2:05am
3
As of my understanding, we will need that migration guide, but not immediately. It will be critical when bcrypt
got removed.
2 Likes
We decided to roll out this feature in multiple phases.
The first phase is planned for 3.2 and wonβt introduce any breaking changes. A guide on optionally enabling Argon2 is available in the docs . Feel free to share any feedback with the author there.
In the second phase, after broader community adoption, we plan to remove bcrypt. Guidance will be provided, considering insights from early adopters. A future version will introduce this as a breaking change with clear warnings and necessary actions.
2 Likes
rjdavid
February 21, 2025, 10:23am
5
@nachocodoner , which one is the case here:
We are sure that bcrypt
will be removed in the future
Removal of bcrypt
depends on the feedback about the use of argon2