feat!: redesign bcrypt API while preserving stored hash verification

.github/workflows/ci.yaml

@@ -309,6 +309,45 @@ jobs:
       - name: Test bindings
         run: yarn workspaces foreach -A -j 1 run test
 
+  test-bcrypt-supported-node:
+    name: Test bcrypt on supported Node ${{ matrix.node }}
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['10', '12']
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup node for test dependencies
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: yarn
+
+      - name: Install test dependencies
+        run: yarn install --immutable --mode=skip-build
+
+      - name: Setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Download native bindings
+        uses: actions/download-artifact@v8
+        with:
+          name: bindings-x86_64-unknown-linux-gnu
+          path: packages
+
+      # Avoid the modern development toolchain when testing the published API.
+      - name: Test bcrypt public API and stored hashes
+        run: node packages/bcrypt/__tests__/supported-node.cjs
+
+      - name: Test locally imported cancellation polyfill
+        run: node packages/bcrypt/__tests__/polyfill-cancellation.cjs
+
   test-linux-x64-gnu-binding:
     name: Test bindings on Linux-x64-gnu - node@${{ matrix.node }}
     needs:
@@ -558,6 +597,7 @@ jobs:
       - test-linux-aarch64-musl-binding
       - test-linux-arm-gnueabihf-binding
       - test-macOS-windows-binding
+      - test-bcrypt-supported-node
       - test-wasi-nodejs
     steps:
       - uses: actions/checkout@v7

.yarnrc.yml

@@ -1,10 +1,17 @@
 nodeLinker: node-modules
 
+# Link workspaces only through the workspace: protocol, so pinned previous releases
+# such as bcrypt-previous (npm:@node-rs/bcrypt@1.10.9) come from the registry even
+# when a workspace currently has the same version.
+enableTransparentWorkspaces: false
+
 npmRegistryServer: 'https://registry.npmjs.org/'
 
 yarnPath: .yarn/releases/yarn-4.18.1.cjs
 
 npmPreapprovedPackages:
+  # This repo's own packages, including previous releases pinned by compatibility tests.
+  - '@node-rs/*'
   - '@napi-rs/*'
   - oxlint
   - '@oxlint/*'

Cargo.toml

@@ -13,8 +13,7 @@ resolver = "2"
 [workspace.dependencies]
 argon2-rust = { version = "1.1", default-features = false }
 base64 = { version = "0.23" }
-bcrypt = "0.19"
-blowfish = { version = "0.10", features = ["bcrypt"] }
+bcrypt = { package = "bcrypt-rust", version = "1" }
 crc32c = { version = "0.6" }
 crc32fast = { version = "1.4", features = ["nightly"] }
 global_alloc = { path = "./crates/alloc" }
@@ -26,13 +25,13 @@ napi = { version = "3", default-features = false, features = ["napi3"] }
 napi-build = "2"
 napi-derive = { version = "3", default-features = false, features = ["type-def"] }
 once_cell = "1"
-quickcheck = "1.0"
 rand = "0.10"
 rand_core = { version = "0.10" }
 serde = "1.0"
 serde_json = "1.0"
 simdutf8 = "0.1"
 xxhash-rust = { version = "0.8", features = ["xxh32", "const_xxh32", "xxh64", "const_xxh64", "xxh3", "const_xxh3"] }
+zeroize = "1"
 [profile.release]
 codegen-units = 1
 lto = true

package.json

@@ -56,7 +56,8 @@
       "ts"
     ],
     "files": [
-      "packages/*/__test__/**/*.spec.ts"
+      "packages/*/__test__/**/*.spec.ts",
+      "packages/bcrypt/__tests__/**/*.spec.ts"
     ],
     "nodeArguments": [
       "--import",