# Remove webcrypto-shim@0.1.7 & p-finally as security scan is throwing component end of life error **URL:** \ **Category:** Questions\ **Tags:** authjs\ **Created:** [February 10, 2026, 8:38am UTC](https://devforum.okta.com/t/remove-webcrypto-shim-0-1-7-p-finally-as-security-scan-is-throwing-component-end-of-life-error/35034 "2026-02-10T08:38:36Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![chaitanya.mula](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/chaitanya.mula/32/6445_2.png) [@chaitanya.mula](https://devforum.okta.com/u/chaitanya.mula)\ **Post date:** [February 10, 2026, 8:38am UTC](https://devforum.okta.com/t/remove-webcrypto-shim-0-1-7-p-finally-as-security-scan-is-throwing-component-end-of-life-error/35034/1 "2026-02-10T08:38:36Z")
Hi team, I’m using @oktaokta/okta-auth-js in an enterprise project, and our security scan flagged a few _deprecated and inactive_ transitive dependencies that come through the SDK. These are not direct dependencies in our code, but they are introduced indirectly through the Okta Auth JS package. Package versi@oktan: @okta/okta-auth-js – tested with 7.14.0 Transitive dependencies flagged: • p-finally@1.0.0 (deprecated) • webcrypto-shim@0.1.7 (outdated WebCrypto polyfill) • regenerator-runtime@0.14.1 (inactive maintenance) Dependency chain example from our environment: @okta/okta-auth-js → broadcast-channel → p-queue → p-timeout → p-finally (deprecated) Although these packages do not have any known vulnerabilities, we are reaching out because they are deprecated and still included as transitive dependencies. **Request:** Is there any plan or roadmap to: 1. Update or replace these outdated transitive dependencies, or 2. Modernize the dependency chain in future releases? Even a small update or guidance would help us. Thank you! ---
**Author:** ![alisaduncan](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/alisaduncan/32/3429_2.png) [@alisaduncan](https://devforum.okta.com/u/alisaduncan)\ **Post date:** [February 10, 2026, 2:51pm UTC](https://devforum.okta.com/t/remove-webcrypto-shim-0-1-7-p-finally-as-security-scan-is-throwing-component-end-of-life-error/35034/2 "2026-02-10T14:51:52Z")
Hi @chaitanya.mula , Welcome to the community! Thanks for reporting this. The closest open issue I see to this one is > > > \### Describe the bug > > https://github.com/okta/okta-auth-js/commit/115be54c529aca…2cd89c480adde1b253d7061bcd downgraded the version of \`broadcast-channel\`, which has a transient dependency on \`@babel/runtime\` v7.22.10, which is vulnerable \[CVE-2025-27789\](https://www.cve.org/CVERecord?id=CVE-2025-27789). > > Perhaps we could downgrade override the version of \`@babel/runtime\` until you are able to upgrade \`broadcast-channel\`? > > \### Reproduction Steps? > > N/A > > \### SDK Versions > > 7.14.0 > > \### Additional Information? > > \_No response\_ i wonder if the same upgrade fix will address some of the issues you identified. Would you mind posting this question to > **[okta/okta-auth-js](https://github.com/okta/okta-auth-js/issues)** > > The official js wrapper around Okta's auth API. Contribute to okta/okta-auth-js development by creating an account on GitHub. Our SDK engineers can better respond with roadmaps for SDK work. Happy coding! ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [March 12, 2026, 2:52pm UTC](https://devforum.okta.com/t/remove-webcrypto-shim-0-1-7-p-finally-as-security-scan-is-throwing-component-end-of-life-error/35034/3 "2026-03-12T14:52:48Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.