[ErisDS]

The reset-token helpers take an existing stored password hash, but call the option password. Rename it to passwordHash in generateHash() and compare() so the API states its contract and CodeQL does not classify it as plaintext password hashing. Remove the ineffective inline suppression and use stored-hash fixtures in the tests.

This is a breaking API change for the next major release of @tryghost/security. Ghost must update both caller options when adopting that release. The token algorithm, format and CommonJS exports are unchanged; a regression test checks generation and validation against a token produced by the old API.

The TypeScript conversion remains separate in #1081, after this change merges.

Validation:

• corepack pnpm --filter @tryghost/security test — 39 tests pass, with 100% line coverage.
• corepack pnpm lint
• corepack pnpm format:check

Packed the package and installed the tarball into a disposable Ghost checkout. After updating the two production caller options and five test fixtures, 132 focused Ghost tests pass. Temporary compatibility tests exercise Ghost's real generateToken() and doReset() orchestration with database doubles: generation succeeds, a token produced by the previous API is accepted, and a changed stored hash invalidates it. The unchanged callers failed those checks before the update.

Also verified that Ghost resolves the packed CommonJS JavaScript and the existing lib/tokens entry point. These Ghost caller changes must accompany the dependency upgrade after the major release; they are not included in this Framework PR.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.05%. Comparing base (0b040ac) to head (5320a53).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1083      +/-   ##
==========================================
+ Coverage   98.13%   99.05%   +0.92%     
==========================================
  Files          87        6      -81     
  Lines        3210      106    -3104     
  Branches      574       14     -560     
==========================================
- Hits         3150      105    -3045     
+ Misses         16        0      -16     
+ Partials       44        1      -43     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 747fbdd1-9ac9-4347-bdfb-e83c3cdeb39d

📥 Commits

Reviewing files that changed from the base of the PR and between 0b040ac and 5320a53.

📒 Files selected for processing: 3

• packages/security/README.md
• packages/security/lib/tokens.js
• packages/security/test/tokens.test.js

+------------------------------------------------------------------------------------------------------------------------+
| Don't assume it - prove it. Prove your assumptions in the actual environment - with real data and boundary conditions. |
+------------------------------------------------------------------------------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}