X_KEYED_HASHER

an HMAC is taken with a keyed new Bun.CryptoHasher(alg, key) instead of hmac()

any file outside packages/core/src/hmac.ts — shipped source, a test, a fixture, a tracked app — constructs CryptoHasher with two arguments. Under Bun 1.4.4 a failed WebCrypto EC import anywhere in the process (one bad JWKS or VAPID key) makes the next keyed hasher throw that stale OpenSSL error once, so a webhook signature, a cursor or a TOTP code fails for one request. An unkeyed hasher is plain hashing, unaffected, and never reported

edit the file the finding names — import { hmac } from '@ultimat3/core' and write hmac('sha256', key, data, 'hex'), then bun run keyed-hasher --json