diff --git a/.iyarc b/.iyarc index 7a5fd13b41..a96613bebc 100644 --- a/.iyarc +++ b/.iyarc @@ -67,6 +67,9 @@ GHSA-9ppj-qmqm-q256 # - No patched version of sjcl exists upstream (first_patched_version: null) GHSA-2w8x-224x-785m + + + # Excluded because: # - ws: Memory exhaustion DoS by sending many tiny fragments/data chunks to exhaust server memory # - Transitive dependency via @cosmjs/socket, @ethersproject/providers, @polkadot/rpc-provider, @@ -76,22 +79,6 @@ GHSA-2w8x-224x-785m # expose any ws server surfaces in production GHSA-96hv-2xvq-fx4p -# Excluded because: -# - form-data: CRLF injection via unescaped multipart field names and filenames -# - Transitive dependency via superagent (abstract-cosmos, express, supertest) and @aptos-labs/ts-sdk -# - The injection requires attacker-controlled field names or filenames in multipart requests -# - All form-data field names and filenames in our codebase are code-controlled constants, -# not derived from user input — no untrusted data flows into form field names or filenames -GHSA-hmw2-7cc7-3qxx - -# Excluded because: -# - protobufjs: DoS through unbounded Any expansion during JSON conversion (parseAny recursion) -# - Transitive dependency via @cosmjs (abstract-cosmos, babylonlabs-io-btc-staking-ts) and -# @hashgraph/proto, @hashgraph/sdk (sdk-coin-hbar) — all requiring protobufjs <=7.5.x -# - Input to protobuf decoding comes from trusted blockchain RPC responses, not arbitrary user data -# - Patched version (7.6.1) requires upstream @cosmjs and @hashgraph dependency updates -GHSA-wcpc-wj8m-hjx6 - # Excluded because: # - tmp: path traversal via type-confusion in _assertPath (non-string prefix/postfix/template) # - Transitive dependency via cypress (web-demo), karma (bitgo module), and lerna/nx (dev tooling) @@ -99,3 +86,4 @@ GHSA-wcpc-wj8m-hjx6 # - The prefix/postfix/template args are all hard-coded string constants in calling code, # not user-supplied — the type-confusion vector does not apply GHSA-7c78-jf6q-g5cm + diff --git a/package.json b/package.json index b5aeb7ca50..9ac3a0c3c0 100644 --- a/package.json +++ b/package.json @@ -110,7 +110,7 @@ "**/stellar-sdk/**/bignumber.js": "4.1.0", "**/stellar-base/**/bignumber.js": "4.1.0", "bignumber.js": "9.1.2", - "form-data": "^4.0.4", + "form-data": "^4.0.6", "**/avalanche/**/ws": "8.18.3", "**/ethers/**/ws": "7.5.10", "**/swarm-js/**/ws": "5.2.4", @@ -131,7 +131,7 @@ "picomatch": ">=2.3.2", "fast-uri": "3.1.2", "@babel/plugin-transform-modules-systemjs": "7.29.4", - "protobufjs": "7.5.8", + "protobufjs": "7.6.4", "@protobufjs/fetch": "1.1.0", "@protobufjs/inquire": "1.1.0", "sigstore": "4.1.1" diff --git a/yarn.lock b/yarn.lock index 349e0fe1f7..3340ac3d9c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4889,12 +4889,12 @@ resolved "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz#d9315ad7cf3f30aac70bda3c068443dc6f143659" integrity sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g== -"@protobufjs/eventemitter@^1.1.0": +"@protobufjs/eventemitter@^1.1.1": version "1.1.1" resolved "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz#d512cb26c0ae026091ee2c1167f1be6faf5c842a" integrity sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg== -"@protobufjs/fetch@1.1.0", "@protobufjs/fetch@^1.1.0": +"@protobufjs/fetch@1.1.0", "@protobufjs/fetch@^1.1.1": version "1.1.0" resolved "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz#ba99fb598614af65700c1619ff06d454b0d84c45" integrity sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ== @@ -4907,7 +4907,7 @@ resolved "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz" integrity sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ== -"@protobufjs/inquire@1.1.0", "@protobufjs/inquire@^1.1.0", "@protobufjs/inquire@^1.1.1": +"@protobufjs/inquire@1.1.0", "@protobufjs/inquire@^1.1.0": version "1.1.0" resolved "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.0.tgz#ff200e3e7cf2429e2dcafc1140828e8cc638f089" integrity sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q== @@ -11847,16 +11847,16 @@ forge-light@1.1.4: resolved "https://registry.npmjs.org/forge-light/-/forge-light-1.1.4.tgz" integrity sha512-Nr0xdu93LJawgBZVU/tC+A+4pbKqigdY5PRBz8CXNm4e5saAZIqU2Qe9+nVFtVO5TWCHSgvI0LaZZuatgE5J1g== -form-data@^2.3.1, form-data@^4.0.0, form-data@^4.0.4, form-data@^4.0.5, form-data@~4.0.4: - version "4.0.4" - resolved "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz" - integrity sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow== +form-data@^2.3.1, form-data@^4.0.0, form-data@^4.0.4, form-data@^4.0.5, form-data@^4.0.6, form-data@~4.0.4: + version "4.0.6" + resolved "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz#28e864e1b786dbebb68db1f452f9635278665827" + integrity sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ== dependencies: asynckit "^0.4.0" combined-stream "^1.0.8" es-set-tostringtag "^2.1.0" - hasown "^2.0.2" - mime-types "^2.1.12" + hasown "^2.0.4" + mime-types "^2.1.35" formdata-polyfill@^4.0.10: version "4.0.10" @@ -12521,6 +12521,13 @@ hasown@^2.0.0, hasown@^2.0.2: dependencies: function-bind "^1.1.2" +hasown@^2.0.4: + version "2.0.4" + resolved "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz#8c62d8cb90beb2aad5d0a5b67581ad9854c3f003" + integrity sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A== + dependencies: + function-bind "^1.1.2" + hdkey@2.0.1: version "2.0.1" resolved "https://registry.npmjs.org/hdkey/-/hdkey-2.0.1.tgz" @@ -15077,7 +15084,7 @@ mime-db@1.52.0: resolved "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz" integrity sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ== -mime-types@^2.1.12, mime-types@^2.1.27, mime-types@~2.1.17, mime-types@~2.1.19, mime-types@~2.1.24, mime-types@~2.1.34: +mime-types@^2.1.27, mime-types@^2.1.35, mime-types@~2.1.17, mime-types@~2.1.19, mime-types@~2.1.24, mime-types@~2.1.34: version "2.1.35" resolved "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz" integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw== @@ -17457,23 +17464,22 @@ propagate@^2.0.0: resolved "https://registry.npmjs.org/propagate/-/propagate-2.0.1.tgz" integrity sha512-vGrhOavPSTz4QVNuBNdcNXePNdNMaO1xj9yBeH1ScQPjk/rhg9sSlCXPhMkFuaNNW/syTvYqsnbIJxMBfRbbag== -protobufjs@7.2.5, protobufjs@7.5.8, protobufjs@^6.8.8, protobufjs@^7.5.5, protobufjs@^7.5.8, protobufjs@~6.11.2, protobufjs@~6.11.3: - version "7.5.8" - resolved "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.8.tgz#51b153a06da6e47153a1aa6800cb1253bc502436" - integrity sha512-dvpCIeLPbXZS/Ete7yLaO7RenOdken2NHKykBXbsaGxZT0UTltcarBciw+A78SRQs9iMAAVpsYA+l8b1hTePIA== +protobufjs@7.2.5, protobufjs@7.6.4, protobufjs@^6.8.8, protobufjs@^7.5.5, protobufjs@^7.5.8, protobufjs@~6.11.2, protobufjs@~6.11.3: + version "7.6.4" + resolved "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.4.tgz#8bb000300026efd63eb7951d26e5dbb38f5658f2" + integrity sha512-RJJPTTpvFfHcWLkIa2JFWK4XvtSzS0yEWDmunqHXli1h3JlkbcQZXDZdcWxv+JK3Xsl5/UFDPZ0iGm7DAengYw== dependencies: "@protobufjs/aspromise" "^1.1.2" "@protobufjs/base64" "^1.1.2" "@protobufjs/codegen" "^2.0.5" - "@protobufjs/eventemitter" "^1.1.0" - "@protobufjs/fetch" "^1.1.0" + "@protobufjs/eventemitter" "^1.1.1" + "@protobufjs/fetch" "^1.1.1" "@protobufjs/float" "^1.0.2" - "@protobufjs/inquire" "^1.1.1" "@protobufjs/path" "^1.1.2" "@protobufjs/pool" "^1.1.0" "@protobufjs/utf8" "^1.1.1" "@types/node" ">=13.7.0" - long "^5.0.0" + long "^5.3.2" protocols@^2.0.0, protocols@^2.0.1: version "2.0.2" @@ -19994,11 +20000,16 @@ tldts@^6.1.32: dependencies: tldts-core "^6.1.86" -tmp@^0.2.1, tmp@^0.2.3, tmp@~0.2.1, tmp@~0.2.3: +tmp@^0.2.1, tmp@~0.2.1, tmp@~0.2.3: version "0.2.6" resolved "https://registry.npmjs.org/tmp/-/tmp-0.2.6.tgz#0dfac10fd09a9319288eb0e8f0ed524604e183b4" integrity sha512-5sJPdPjfI5Kx+qbrDesxkglRBxW//g7hCsqspEjwkewGvBMGIKMOTKzLt1hFVJzyadba3lDUN20O9qhvbQUSTA== +tmp@^0.2.3: + version "0.2.7" + resolved "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059" + integrity sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw== + to-arraybuffer@^1.0.0: version "1.0.1" resolved "https://registry.npmjs.org/to-arraybuffer/-/to-arraybuffer-1.0.1.tgz"