Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: critical security vulnerabilities #30

Merged
merged 8 commits into from
Nov 1, 2024

Conversation

freemanzMrojo
Copy link
Member

@freemanzMrojo freemanzMrojo commented Nov 1, 2024

Upgraded dependencies that were pulling underscore, ws and babel-traverse, affected by critical vulnerabilities.

@freemanzMrojo freemanzMrojo requested a review from a team as a code owner November 1, 2024 11:24
Copy link

socket-security bot commented Nov 1, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@ethereum-waffle/chai@4.0.10 None 0 473 kB ethworks
npm/@ethereum-waffle/compiler@4.0.3 filesystem, network, shell +1 290 kB ethworks
npm/@ethereum-waffle/ens@4.0.3 None 0 2.41 MB ethworks
npm/@ethereum-waffle/mock-contract@4.0.4 None 0 516 kB ethworks
npm/@ethereum-waffle/provider@4.0.5 None 0 251 kB ethworks
npm/@ethereumjs/block@3.6.3 None +1 802 kB holgerd77
npm/@ethereumjs/blockchain@5.5.3 None 0 458 kB holgerd77
npm/@ethereumjs/ethash@1.1.0 None +1 109 kB holgerd77
npm/@ethereumjs/vm@5.6.0 environment, eval Transitive: network +2 2.74 MB holgerd77
npm/@ganache/ethereum-address@0.1.4 None 0 26.3 kB truffle-cicd
npm/@ganache/ethereum-options@0.1.4 environment 0 132 kB truffle-cicd
npm/@ganache/ethereum-utils@0.1.4 None +3 3.32 MB truffle-cicd
npm/@ganache/options@0.1.4 None 0 58.3 kB truffle-cicd
npm/@ganache/rlp@0.1.4 None +1 85.4 kB truffle-cicd
npm/@ganache/utils@0.1.4 Transitive: environment, filesystem +3 1.18 MB truffle-cicd
npm/@trufflesuite/bigint-buffer@1.1.10 Transitive: environment, filesystem +1 282 kB davidmurdoch
npm/@types/abstract-leveldown@7.2.5 None 0 6.96 kB types
npm/@types/level-errors@3.0.2 None 0 3.36 kB types
npm/@types/levelup@4.3.3 None 0 8.56 kB types
npm/@types/seedrandom@3.0.1 None 0 6.27 kB types
npm/abstract-leveldown@7.2.0 None 0 243 kB vweevers
npm/async@2.6.4 None 0 541 kB hargasinski
npm/bip39@3.0.4 None +1 945 kB junderw
npm/catering@2.1.1 None 0 5 kB vweevers
npm/commander@8.3.0 environment, filesystem, shell 0 151 kB abetomo
npm/deferred-leveldown@5.3.0 None 0 36.2 kB vweevers
npm/emittery@0.10.0 None 0 44.1 kB sindresorhus
npm/encoding-down@6.3.0 None +1 266 kB vweevers
npm/ethereum-waffle@4.0.10 None +2 8.81 MB ethworks
npm/ganache@7.4.3 environment, filesystem, network, shell +4 97.6 MB truffle-cicd
npm/is-buffer@2.0.5 None 0 4.59 kB feross
npm/json-bigint@1.0.0 None 0 37.3 kB sidorares
npm/level-concat-iterator@3.1.0 None 0 8.47 kB vweevers
npm/level-iterator-stream@4.0.2 None 0 26.5 kB vweevers
npm/level-mem@5.0.1 None 0 14.1 kB vweevers
npm/level-packager@5.1.1 None 0 32.8 kB vweevers
npm/level-supports@2.1.0 None 0 26.9 kB vweevers
npm/level-ws@2.0.0 None 0 34.5 kB vweevers
npm/leveldown@6.1.0 None 0 5.64 MB vweevers
npm/levelup@4.4.0 None +2 136 kB vweevers
npm/memdown@5.1.0 None +3 278 kB vweevers
npm/merkle-patricia-tree@4.2.4 None +1 762 kB holgerd77
npm/napi-macros@2.0.0 None 0 16.2 kB mafintosh
npm/seedrandom@3.0.5 None 0 374 kB davidbau
npm/semaphore-async-await@1.5.1 None 0 20.6 kB jsoendermann
npm/typechain@8.3.2 filesystem Transitive: environment +2 195 kB ethereum-ts-bot
npm/underscore@1.13.7 eval 0 906 kB jgonggrijp

🚮 Removed packages: npm/@ethereum-waffle/chai@3.4.4, npm/@ethereum-waffle/compiler@3.4.4, npm/@ethereum-waffle/ens@3.4.4, npm/@ethereum-waffle/mock-contract@3.4.4, npm/@ethereum-waffle/provider@3.4.4, npm/@ljharb/resumer@0.0.1, npm/@yarnpkg/lockfile@1.1.0, npm/abstract-leveldown@3.0.0, npm/arr-diff@4.0.0, npm/arr-flatten@1.1.0, npm/arr-union@3.1.0, npm/array-back@2.0.0, npm/array-unique@0.3.2, npm/array.prototype.reduce@1.0.7, npm/asn1.js@4.10.1, npm/assign-symbols@1.0.0, npm/async-limiter@1.0.1, npm/atob@2.1.2, npm/babel-code-frame@6.26.0, npm/babel-core@6.26.3, npm/babel-generator@6.26.1, npm/babel-helper-builder-binary-assignment-operator-visitor@6.24.1, npm/babel-helper-call-delegate@6.24.1, npm/babel-helper-define-map@6.26.0, npm/babel-helper-explode-assignable-expression@6.24.1, npm/babel-helper-function-name@6.24.1, npm/babel-helper-get-function-arity@6.24.1, npm/babel-helper-hoist-variables@6.24.1, npm/babel-helper-optimise-call-expression@6.24.1, npm/babel-helper-regex@6.26.0, npm/babel-helper-remap-async-to-generator@6.24.1, npm/babel-helper-replace-supers@6.24.1, npm/babel-helpers@6.24.1, npm/babel-messages@6.23.0, npm/babel-plugin-check-es2015-constants@6.22.0, npm/babel-plugin-syntax-async-functions@6.13.0, npm/babel-plugin-syntax-exponentiation-operator@6.13.0, npm/babel-plugin-syntax-trailing-function-commas@6.22.0, npm/babel-plugin-transform-async-to-generator@6.24.1, npm/babel-plugin-transform-es2015-arrow-functions@6.22.0, npm/babel-plugin-transform-es2015-block-scoped-functions@6.22.0, npm/babel-plugin-transform-es2015-block-scoping@6.26.0, npm/babel-plugin-transform-es2015-classes@6.24.1, npm/babel-plugin-transform-es2015-computed-properties@6.24.1, npm/babel-plugin-transform-es2015-destructuring@6.23.0, npm/babel-plugin-transform-es2015-duplicate-keys@6.24.1, npm/babel-plugin-transform-es2015-for-of@6.23.0, npm/babel-plugin-transform-es2015-function-name@6.24.1, npm/babel-plugin-transform-es2015-literals@6.22.0, npm/babel-plugin-transform-es2015-modules-amd@6.24.1, npm/babel-plugin-transform-es2015-modules-systemjs@6.24.1, npm/babel-plugin-transform-es2015-modules-umd@6.24.1, npm/babel-plugin-transform-es2015-object-super@6.24.1, npm/babel-plugin-transform-es2015-parameters@6.24.1, npm/babel-plugin-transform-es2015-shorthand-properties@6.24.1, npm/babel-plugin-transform-es2015-spread@6.22.0, npm/babel-plugin-transform-es2015-sticky-regex@6.24.1, npm/babel-plugin-transform-es2015-template-literals@6.22.0, npm/babel-plugin-transform-es2015-typeof-symbol@6.23.0, npm/babel-plugin-transform-es2015-unicode-regex@6.24.1, npm/babel-plugin-transform-exponentiation-operator@6.24.1, npm/babel-plugin-transform-regenerator@6.26.0, npm/babel-plugin-transform-strict-mode@6.24.1, npm/babel-preset-env@1.7.0, npm/babel-register@6.26.0, npm/babelify@7.3.0, npm/babylon@6.18.0, npm/backoff@2.5.0, npm/base@0.11.2, npm/bip39@2.5.0, npm/browserify-cipher@1.0.1, npm/browserify-des@1.0.2, npm/browserify-sign@4.2.3, npm/browserslist@3.2.8, npm/bytewise-core@1.2.3, npm/bytewise@1.1.0, npm/cache-base@1.0.1, npm/cachedown@1.0.0, npm/caniuse-lite@1.0.30001606, npm/checkpoint-store@1.1.0, npm/class-utils@0.3.6, npm/clone@2.1.2, npm/collection-visit@1.0.0, npm/command-line-args@4.0.7, npm/component-emitter@1.3.1, npm/concat-stream@1.6.2, npm/convert-source-map@1.9.0, npm/cookiejar@2.1.4, npm/copy-descriptor@0.1.1, npm/create-ecdh@4.0.4, npm/crypto-browserify@3.12.0, npm/deep-equal@1.1.2, npm/deferred-leveldown@4.0.2, npm/define-property@2.0.2, npm/defined@1.0.1, npm/des.js@1.1.0, npm/diffie-hellman@5.0.3, npm/dotignore@0.1.2, npm/duplexer3@0.1.5, npm/electron-to-chromium@1.4.728, npm/encoding-down@5.0.4, npm/encoding@0.1.13, npm/es-array-method-boxes-properly@1.0.0, npm/eth-block-tracker@3.0.1, npm/eth-json-rpc-infura@3.2.1, npm/eth-json-rpc-middleware@1.6.0, npm/eth-query@2.1.2, npm/eth-sig-util@3.0.0, npm/eth-tx-summary@3.2.4, npm/ethashjs@0.0.8, npm/ethereum-common@0.2.0, npm/ethereum-waffle@3.4.4, npm/ethereumjs-account@3.0.0, npm/ethereumjs-blockchain@4.0.4, npm/ethereumjs-common@1.5.0, npm/ethereumjs-vm@4.2.0, npm/expand-brackets@2.1.4, npm/extglob@2.0.4, npm/fake-merkle-patricia-tree@1.0.1, npm/fetch-ponyfill@4.1.0, npm/find-replace@1.0.3, npm/find-yarn-workspace-root@2.0.0, npm/flow-stoplight@1.0.0, npm/for-in@1.0.2, npm/fragment-cache@0.2.1, npm/ganache-core@2.13.2, npm/get-value@2.0.6, npm/has-ansi@2.0.0, npm/has-value@1.0.0, npm/has-values@1.0.0, npm/has@1.0.4, npm/home-or-tmp@2.0.0, npm/invariant@2.2.4, npm/is-accessor-descriptor@1.0.1, npm/is-buffer@1.1.6, npm/is-ci@2.0.0, npm/is-data-descriptor@1.0.1, npm/is-descriptor@1.0.3, npm/is-docker@2.2.1, npm/is-extendable@1.0.1, npm/is-finite@1.1.0, npm/is-fn@1.0.0, npm/is-plain-object@2.0.4, npm/is-stream@1.1.0, npm/is-windows@1.0.2, npm/is-wsl@2.2.0, npm/isobject@3.0.1, npm/jsesc@1.3.0, npm/json-rpc-error@2.0.0, npm/json-rpc-random-id@1.0.1, npm/json-stable-stringify@1.1.1, npm/jsonify@0.0.1, npm/klaw-sync@6.0.0, npm/level-iterator-stream@2.0.3, npm/level-mem@3.0.1, npm/level-packager@4.0.1, npm/level-post@1.0.7, npm/level-sublevel@6.6.4, npm/level-ws@1.0.0, npm/levelup@3.1.1, npm/looper@2.0.0, npm/loose-envify@1.4.0, npm/ltgt@2.1.3, npm/map-cache@0.2.2, npm/map-visit@1.0.0, npm/memdown@1.4.1, npm/merkle-patricia-tree@3.0.0, npm/mixin-deep@1.3.2, npm/mock-property@1.0.3, npm/nanomatch@1.2.13, npm/nice-try@1.0.5, npm/object-copy@0.1.0, npm/object-is@1.1.6, npm/object-visit@1.0.1, npm/object.getownpropertydescriptors@2.1.8, npm/object.pick@1.3.0, npm/open@7.4.2, npm/os-homedir@1.0.2, npm/pascalcase@0.1.1, npm/patch-package@6.5.1, npm/posix-character-classes@0.1.1, npm/postinstall-postinstall@2.1.0, npm/precond@0.2.3, npm/prepend-http@2.0.0, npm/process-nextick-args@2.0.1, npm/promise-to-callback@1.0.0, npm/pseudomap@1.0.2, npm/public-encrypt@4.0.3, npm/pull-cat@1.1.11, npm/pull-defer@0.2.3, npm/pull-level@2.0.4, npm/pull-live@1.0.1, npm/pull-pushable@2.2.0, npm/pull-window@2.1.4, npm/randomfill@1.0.4, npm/regenerate@1.4.2, npm/regenerator-transform@0.10.1, npm/regex-not@1.0.2, npm/regexpu-core@2.0.0, npm/regjsgen@0.2.0, npm/regjsparser@0.1.5, npm/repeat-element@1.1.4, npm/repeat-string@1.6.1, npm/repeating@2.0.1, npm/resolve-url@0.2.1, npm/ret@0.1.15, npm/safe-event-emitter@1.0.1, npm/safe-regex@1.1.0, npm/scryptsy@1.2.1, npm/seedrandom@3.0.1, npm/set-immediate-shim@1.0.1, npm/set-value@2.0.1, npm/snapdragon-node@2.1.1, npm/snapdragon-util@3.0.1, npm/snapdragon@0.8.2, npm/source-map-resolve@0.5.3, npm/source-map-url@0.4.1, npm/split-string@3.1.0, npm/static-extend@0.1.2, npm/stream-to-pull-stream@1.7.3, npm/tape@4.17.0, npm/test-value@2.1.0, npm/through2@2.0.5, npm/to-fast-properties@1.0.3, npm/to-object-path@0.3.0, npm/to-readable-stream@1.0.0, npm/trim-right@1.0.1, npm/typechain@3.0.0, npm/typedarray@0.0.6, npm/typewise@1.0.3, npm/typewiselite@1.0.0, npm/typical@2.6.1, npm/ultron@1.1.1, npm/underscore@1.13.6, npm/union-value@1.0.1, npm/unorm@1.6.0, npm/unset-value@1.0.0, npm/urix@0.1.0, npm/url-parse-lax@3.0.0, npm/use@3.1.1, npm/util.promisify@1.1.2, npm/web3-provider-engine@14.2.1, npm/whatwg-fetch@2.0.4, npm/ws@7.4.6, npm/xhr2-cookies@1.1.0, npm/yaml@1.10.2

View full report↗︎

@freemanzMrojo freemanzMrojo marked this pull request as draft November 1, 2024 11:33
@freemanzMrojo freemanzMrojo force-pushed the fix/critical-security-alerts branch from a5f055d to 98a131c Compare November 1, 2024 13:08
Copy link

sonarqubecloud bot commented Nov 1, 2024

@freemanzMrojo freemanzMrojo marked this pull request as ready for review November 1, 2024 16:04
Copy link

@vanja-vechain vanja-vechain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@freemanzMrojo freemanzMrojo merged commit e90d6e1 into vechain Nov 1, 2024
9 checks passed
@freemanzMrojo freemanzMrojo deleted the fix/critical-security-alerts branch November 1, 2024 16:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants