Skip to content

chore(deps): bump protobufjs to 7.6.4, form-data to ^4.0.6, drop 2 GHSAs from .iyarc #9176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-actions wants to merge 1 commit into
base: master
Choose a base branch
from
+36 −37
Open

chore(deps): bump protobufjs to 7.6.4, form-data to ^4.0.6, drop 2 GHSAs from .iyarc #9176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 4 additions & 16 deletions .iyarc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,9 @@ GHSA-9ppj-qmqm-q256
# - No patched version of sjcl exists upstream (first_patched_version: null)
GHSA-2w8x-224x-785m




# Excluded because:
# - ws: Memory exhaustion DoS by sending many tiny fragments/data chunks to exhaust server memory
# - Transitive dependency via @cosmjs/socket, @ethersproject/providers, @polkadot/rpc-provider,
Expand All @@ -76,26 +79,11 @@ GHSA-2w8x-224x-785m
# expose any ws server surfaces in production
GHSA-96hv-2xvq-fx4p

# Excluded because:
# - form-data: CRLF injection via unescaped multipart field names and filenames
# - Transitive dependency via superagent (abstract-cosmos, express, supertest) and @aptos-labs/ts-sdk
# - The injection requires attacker-controlled field names or filenames in multipart requests
# - All form-data field names and filenames in our codebase are code-controlled constants,
# not derived from user input — no untrusted data flows into form field names or filenames
GHSA-hmw2-7cc7-3qxx

# Excluded because:
# - protobufjs: DoS through unbounded Any expansion during JSON conversion (parseAny recursion)
# - Transitive dependency via @cosmjs (abstract-cosmos, babylonlabs-io-btc-staking-ts) and
# @hashgraph/proto, @hashgraph/sdk (sdk-coin-hbar) — all requiring protobufjs <=7.5.x
# - Input to protobuf decoding comes from trusted blockchain RPC responses, not arbitrary user data
# - Patched version (7.6.1) requires upstream @cosmjs and @hashgraph dependency updates
GHSA-wcpc-wj8m-hjx6

# Excluded because:
# - tmp: path traversal via type-confusion in _assertPath (non-string prefix/postfix/template)
# - Transitive dependency via cypress (web-demo), karma (bitgo module), and lerna/nx (dev tooling)
# - All usages are dev-time only; tmp is never used in production or runtime code
# - The prefix/postfix/template args are all hard-coded string constants in calling code,
# not user-supplied — the type-confusion vector does not apply
GHSA-7c78-jf6q-g5cm

4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@
"**/stellar-sdk/**/bignumber.js": "4.1.0",
"**/stellar-base/**/bignumber.js": "4.1.0",
"bignumber.js": "9.1.2",
"form-data": "^4.0.4",
"form-data": "^4.0.6",
"**/avalanche/**/ws": "8.18.3",
"**/ethers/**/ws": "7.5.10",
"**/swarm-js/**/ws": "5.2.4",
Expand All @@ -131,7 +131,7 @@
"picomatch": ">=2.3.2",
"fast-uri": "3.1.2",
"@babel/plugin-transform-modules-systemjs": "7.29.4",
"protobufjs": "7.5.8",
"protobufjs": "7.6.4",
"@protobufjs/fetch": "1.1.0",
"@protobufjs/inquire": "1.1.0",
"sigstore": "4.1.1"
Expand Down
49 changes: 30 additions & 19 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4889,12 +4889,12 @@
resolved "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz#d9315ad7cf3f30aac70bda3c068443dc6f143659"
integrity sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==

"@protobufjs/eventemitter@^1.1.0":
"@protobufjs/eventemitter@^1.1.1":
version "1.1.1"
resolved "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz#d512cb26c0ae026091ee2c1167f1be6faf5c842a"
integrity sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==

"@protobufjs/fetch@1.1.0", "@protobufjs/fetch@^1.1.0":
"@protobufjs/fetch@1.1.0", "@protobufjs/fetch@^1.1.1":
version "1.1.0"
resolved "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz#ba99fb598614af65700c1619ff06d454b0d84c45"
integrity sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==
Expand All @@ -4907,7 +4907,7 @@
resolved "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz"
integrity sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==

"@protobufjs/inquire@1.1.0", "@protobufjs/inquire@^1.1.0", "@protobufjs/inquire@^1.1.1":
"@protobufjs/inquire@1.1.0", "@protobufjs/inquire@^1.1.0":
version "1.1.0"
resolved "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.0.tgz#ff200e3e7cf2429e2dcafc1140828e8cc638f089"
integrity sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q==
Expand Down Expand Up @@ -11847,16 +11847,16 @@ forge-light@1.1.4:
resolved "https://registry.npmjs.org/forge-light/-/forge-light-1.1.4.tgz"
integrity sha512-Nr0xdu93LJawgBZVU/tC+A+4pbKqigdY5PRBz8CXNm4e5saAZIqU2Qe9+nVFtVO5TWCHSgvI0LaZZuatgE5J1g==

form-data@^2.3.1, form-data@^4.0.0, form-data@^4.0.4, form-data@^4.0.5, form-data@~4.0.4:
version "4.0.4"
resolved "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz"
integrity sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==
form-data@^2.3.1, form-data@^4.0.0, form-data@^4.0.4, form-data@^4.0.5, form-data@^4.0.6, form-data@~4.0.4:
version "4.0.6"
resolved "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz#28e864e1b786dbebb68db1f452f9635278665827"
integrity sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==
dependencies:
asynckit "^0.4.0"
combined-stream "^1.0.8"
es-set-tostringtag "^2.1.0"
hasown "^2.0.2"
mime-types "^2.1.12"
hasown "^2.0.4"
mime-types "^2.1.35"

formdata-polyfill@^4.0.10:
version "4.0.10"
Expand Down Expand Up @@ -12521,6 +12521,13 @@ hasown@^2.0.0, hasown@^2.0.2:
dependencies:
function-bind "^1.1.2"

hasown@^2.0.4:
version "2.0.4"
resolved "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz#8c62d8cb90beb2aad5d0a5b67581ad9854c3f003"
integrity sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==
dependencies:
function-bind "^1.1.2"

hdkey@2.0.1:
version "2.0.1"
resolved "https://registry.npmjs.org/hdkey/-/hdkey-2.0.1.tgz"
Expand Down Expand Up @@ -15077,7 +15084,7 @@ mime-db@1.52.0:
resolved "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz"
integrity sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==

mime-types@^2.1.12, mime-types@^2.1.27, mime-types@~2.1.17, mime-types@~2.1.19, mime-types@~2.1.24, mime-types@~2.1.34:
mime-types@^2.1.27, mime-types@^2.1.35, mime-types@~2.1.17, mime-types@~2.1.19, mime-types@~2.1.24, mime-types@~2.1.34:
version "2.1.35"
resolved "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz"
integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
Expand Down Expand Up @@ -17457,23 +17464,22 @@ propagate@^2.0.0:
resolved "https://registry.npmjs.org/propagate/-/propagate-2.0.1.tgz"
integrity sha512-vGrhOavPSTz4QVNuBNdcNXePNdNMaO1xj9yBeH1ScQPjk/rhg9sSlCXPhMkFuaNNW/syTvYqsnbIJxMBfRbbag==

protobufjs@7.2.5, protobufjs@7.5.8, protobufjs@^6.8.8, protobufjs@^7.5.5, protobufjs@^7.5.8, protobufjs@~6.11.2, protobufjs@~6.11.3:
version "7.5.8"
resolved "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.8.tgz#51b153a06da6e47153a1aa6800cb1253bc502436"
integrity sha512-dvpCIeLPbXZS/Ete7yLaO7RenOdken2NHKykBXbsaGxZT0UTltcarBciw+A78SRQs9iMAAVpsYA+l8b1hTePIA==
protobufjs@7.2.5, protobufjs@7.6.4, protobufjs@^6.8.8, protobufjs@^7.5.5, protobufjs@^7.5.8, protobufjs@~6.11.2, protobufjs@~6.11.3:
version "7.6.4"
resolved "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.4.tgz#8bb000300026efd63eb7951d26e5dbb38f5658f2"
integrity sha512-RJJPTTpvFfHcWLkIa2JFWK4XvtSzS0yEWDmunqHXli1h3JlkbcQZXDZdcWxv+JK3Xsl5/UFDPZ0iGm7DAengYw==
dependencies:
"@protobufjs/aspromise" "^1.1.2"
"@protobufjs/base64" "^1.1.2"
"@protobufjs/codegen" "^2.0.5"
"@protobufjs/eventemitter" "^1.1.0"
"@protobufjs/fetch" "^1.1.0"
"@protobufjs/eventemitter" "^1.1.1"
"@protobufjs/fetch" "^1.1.1"
"@protobufjs/float" "^1.0.2"
"@protobufjs/inquire" "^1.1.1"
"@protobufjs/path" "^1.1.2"
"@protobufjs/pool" "^1.1.0"
"@protobufjs/utf8" "^1.1.1"
"@types/node" ">=13.7.0"
long "^5.0.0"
long "^5.3.2"

protocols@^2.0.0, protocols@^2.0.1:
version "2.0.2"
Expand Down Expand Up @@ -19994,11 +20000,16 @@ tldts@^6.1.32:
dependencies:
tldts-core "^6.1.86"

tmp@^0.2.1, tmp@^0.2.3, tmp@~0.2.1, tmp@~0.2.3:
tmp@^0.2.1, tmp@~0.2.1, tmp@~0.2.3:
version "0.2.6"
resolved "https://registry.npmjs.org/tmp/-/tmp-0.2.6.tgz#0dfac10fd09a9319288eb0e8f0ed524604e183b4"
integrity sha512-5sJPdPjfI5Kx+qbrDesxkglRBxW//g7hCsqspEjwkewGvBMGIKMOTKzLt1hFVJzyadba3lDUN20O9qhvbQUSTA==

tmp@^0.2.3:
version "0.2.7"
resolved "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059"
integrity sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==

to-arraybuffer@^1.0.0:
version "1.0.1"
resolved "https://registry.npmjs.org/to-arraybuffer/-/to-arraybuffer-1.0.1.tgz"
Expand Down