Wait, why do we depend on pbkdf2? Must be in an example somewhere, maybe perf. Right?

It's in crypto-browserify.

OK, so not affecting anything. But still good for the posture.

We had a problem running npm dedupe before, but I suppose as long as npm ls does not report problems, we should be OK (this is run via lint:lockfile as part of CI)

Anything else pending for the release?

@naugtur I don't think there's anything urgent

Feel free to crank it out or I'll do it tomorrow

@naugtur I'll do it

OK, I cut a release.

@naugtur The flaky symlink test was failing for me locally.

@leotm See #1723