Swap crypto-js for something else

[tb-b]

Not sure if relevant for this package, but a good read: GHSA-xwcq-pm8m-c4vf

[AdiRishi]

Just wanted to add some info here. Crypto JS has been officially discontinued, you can see this in the README + npm page for crypto-js

Active development of CryptoJS has been discontinued. This library is no longer maintained.

This is mostly since the web crypto API is the new standard.
This is doubly important in the case of the workerd environment (cloudflare workers/pages) where a lot of the SubtleCrypto methods are async.

I think it makes sense to remove the dependency on crypto-js and move completely to the web crypto standard.

[sergiodxa]

I have plans to look up for an alternative, but the reason for not using Web Crypto API is that in almost all runtimes it’s globally accessible with globalThis.crypto, except in Node where you need to import it from the node:crypto package.

I know in the future this will change but until Remix only supports versions of Node with that change I can’t support it here.

[AdiRishi]

That makes sense 👍