feat: make v2 opt-in on password change + plumb through changePassword - #9439
Open
pranavjain97 wants to merge 2 commits into
Open
feat: make v2 opt-in on password change + plumb through changePassword#9439pranavjain97 wants to merge 2 commits into
pranavjain97 wants to merge 2 commits into
Conversation
Contributor
Flip updateSingleKeychainPassword/updatePassword to preserve each keychain's existing envelope version by default (v1 stays v1, v2 stays v2). Callers opt in to the Argon2id upgrade with encryptionVersion: 2 once they're ready. Rolling out a v2 default before the Sept 15 breaking-change window closes could push integrations that only have v1 decrypt paths onto v2 blobs they can't read. Explicit opt-in lets each caller adopt on their own timeline; the default can be flipped back to v2 after the window. TICKET: WCN-1814
Thread an optional encryptionVersion through changePassword to both the v1 and v2 keychains().updatePassword calls, so callers can opt in to the Argon2id upgrade without reaching into keychains() directly. TICKET: WCN-1814
pranavjain97
force-pushed
the
pranavjain/wcn-1814-followup-preserve-envelope-version
branch
from
August 6, 2026 17:11
67d3bc9 to
b3cef11
Compare
pranavjain97
changed the title
zahin-mohammad
approved these changes
Aug 6, 2026
noel-bitgo
approved these changes
Aug 6, 2026
pranishnepal
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
updateSingleKeychainPassword/updatePasswordnow preserve the source envelope version (v1 stays v1, v2 stays v2). Callers opt in to the Argon2id upgrade withencryptionVersion: 2.BitGoAPI.changePasswordaccepts an optionalencryptionVersionand forwards it to both v1- and v2-APIkeychains().updatePasswordcalls.Why opt-in
Rolling out a v2 default before the Sept 15 breaking-change window closes could push integrations that only have v1 decrypt paths onto v2 blobs they can't read. Explicit opt-in lets each caller adopt on their own
timeline; the default can be flipped back to v2 after the window.
Impact
bitgo.changePassword({ oldPassword, newPassword, encryptionVersion: 2 }).