Bump hexo-blog-encrypt from 3.1.9 to 4.0.0

[dependabot]

Bumps hexo-blog-encrypt from 3.1.9 to 4.0.0.

Release notes

Sourced from hexo-blog-encrypt's releases.

v4.0.0 — AES-256-GCM, per-post salts, click-to-decrypt button

hexo-blog-encrypt v4.0.0

A near-complete rewrite of the plugin with stronger crypto, a real e2e test harness, and a per-post click-to-decrypt button that no longer auto-decrypts on every page render.

📦 npm: https://www.npmjs.com/package/hexo-blog-encrypt/v/4.0.0 (published with provenance) 🌐 Live demo: https://d0n9x1n.github.io/hexo-blog-encrypt/ 📖 Wiki: https://github.com/D0n9X1n/hexo-blog-encrypt/wiki 🔁 Migration guide (v3 → v4): https://github.com/D0n9X1n/hexo-blog-encrypt/wiki/Migration-v3-to-v4

---

Highlights

• AES-256-GCM replaces AES-256-CBC. GCM is authenticated; tampering is detected during decryption.
• Per-post random salt + nonce. No more single global salt across the whole blog.
• Configurable PBKDF2 iterations (default 600 000, floor 310 000 enforced — OWASP-aligned).
• Click-to-decrypt button (opt-in via decrypt_button: true, with decrypt_button per-post override).
• Modular architecture. Server code split into src/server/{config,crypto,template,generator,logger,index}.js. Browser code is a single ESBuild bundle (lib/hbe.bundle.js).
• Real Hexo + Playwright e2e harness (npm test) covering all 8 themes plus callback / MathJax / autosave flows.
• Tarball trim. Published package shrunk from 75 → 22 files, 222 → 112 kB unpacked.

Breaking changes

• Wire format changed (v4 envelope with explicit version byte). v3-encrypted posts must be re-rendered against v4 — passwords and content are unchanged, just rebuild the blog.
• Default theme markup updated to host the decrypt button shell. Custom forks of lib/hbe.<theme>.html need the new SHELL slots — see the migration guide.

Why upgrade

See the new "Why upgrade from v3?" section in the README.

Full changelog

https://github.com/D0n9X1n/hexo-blog-encrypt/blob/master/CHANGELOG.md#400--2026-05-03

Changelog

Sourced from hexo-blog-encrypt's changelog.

[4.0.0] — 2026-05-03

Highlights

• AES-256-GCM replaces AES-CBC + HMAC-SHA-256 — one round-trip encrypt-and-authenticate, no more ciphertext-then-MAC composition. GCM's authentication tag fails closed: a wrong password and a tampered ciphertext are now indistinguishable to the user (see Breaking changes).
• Per-post salt + per-encryption nonce. Two posts with the same password produce different ciphertexts; rebuilding the same post produces a fresh nonce every time. Previously, all posts shared the same salt by default and produced byte-identical ciphertext.
• Optional decrypt button. Themes now expose a click-to-decrypt button alongside the password field. Default: visible (decryptButton: { show: true, text: 'Decrypt' }).
• Opt-in autosave. Successfully-decrypted plaintext is cached in localStorage only when the post (or _config.yml.encrypt) sets autoSave: true. Default: OFF. Cache keys are namespaced under hbe.v4.<post-permalink-hash>; v3 cache leftovers are purged on read.
• Modular architecture. src/server/{config,crypto,generator,index, logger,template}.js (server) and src/browser/{main,crypto,storage, ui,dom}.js (browser, esbuild-bundled to lib/hbe.bundle.js) replace the previous index.js + monolithic lib/hbe.js.
• Real-Hexo + real-browser e2e suite. Per-theme matrix (right password / wrong password / reload re-prompts) plus tag-encryption guard, autosave-cached reload, decrypt-button click, legacy event listener, stale-format and tampered-ciphertext failure modes. Runs on every push via GitHub Actions.

Breaking changes

• Wire-format break. Posts encrypted by hexo-blog-encrypt v3 cannot be decrypted by v4 (and vice versa). v4 wrappers carry data-hbe-format="4"; the bundle aborts with a friendly upgrade message on a format mismatch. Action required: rebuild the entire site with hexo clean && hexo generate after upgrading. No data is lost — the source .md files are unchanged.
• wrong_hash_message is deprecated. GCM unifies wrong-password and tampered-ciphertext into a single failure path; the option is now an alias of wrong_pass_message and emits a build-time warning when set. Will be removed in v5. Action required: delete wrong_hash_message from _config.yml and front-matter; set only wrong_pass_message.
• Cipher and KDF changes. AES-256-GCM (was AES-256-CBC + HMAC). PBKDF2 iteration default raised to 250 000 (was hard-coded). KDF iterations are now configurable via kdf.iterations with a 100 000 floor and a build-time warning below the OWASP-2023 recommended 600 000. Action required: none. Defaults are safe; tune via _config.yml.encrypt.kdf.iterations.

... (truncated)

Commits

• caafe3a ci(release): switch to npm OIDC trusted publishing
• f3595a2 release(v4.0.0): pre-flight — date CHANGELOG, swap demo to ^4.0.0
• 7660c7f feat(v4): AES-256-GCM, per-post salts, click-to-decrypt button, modular archi...
• 4af3169 feat(demo): live demo site auto-deployed to GitHub Pages (#229)
• 191b1b8 docs: add GitHub Actions Tests badge to both READMEs (#228)
• 27a11d0 test(e2e): real-Hexo + real-browser end-to-end test harness (#227)
• e91245d Use random salt instead of fixed salt (#210)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hexo-blog-encrypt since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #18.