chore(deps): resolve Dependabot critical/high/moderate alerts#45
Merged
Conversation
Bumps direct `vitest` dependency from ^3.2.4 to ^4.1.0 across the eight adapter packages to patch GHSA-5xrq-8626-4rwp (arbitrary file read/exec via Vitest UI server). Migrates the `overrides` and `patchedDependencies` blocks from `package.json#pnpm.*` into `pnpm-workspace.yaml`, since pnpm v11 ignores the package.json variant. The existing overrides (valtio, viem, midnight-js-*, etc.) were already silently inert under v11; this migration also makes them effective. New security overrides added: - protobufjs <7.5.8 → ^7.5.8 (GHSA-jggg, 685m, 66ff, 2pr8, fx83, 75px, jvwf, q6x5, xq3m — DoS, code injection, prototype pollution, RCE) - @protobufjs/utf8 <1.1.1 → ^1.1.1 (GHSA-q6x5, overlong UTF-8) - hono <4.12.21 → ^4.12.21 (GHSA-2gcr, 3hrh, xrhx, f577, qp7p, hm8q, p77w, 69xw, 9vqf, 458j, r5rp, 26pp, xpcf, wmmm, xf4j — cookie injection, JWT issues, path traversal, etc.) - ws >=8.0.0 <8.20.1 → ^8.20.1 (GHSA-58qx, memory disclosure) - vite >=7.0.0 <7.3.2 → ^7.3.2 (GHSA-p9ff, v2wj, 4w7w — fs.deny bypass) - lodash <4.18.0 → ^4.18.0 (GHSA-r5fr, f23m, xxjr — code injection, prototype pollution) - tmp <0.2.6 → ^0.2.6 (GHSA-ph9p, 52f5 — path traversal via symlink) - @metamask/sdk + @metamask/sdk-communication-layer <0.33.1 → ^0.33.1 (GHSA-qj3p, malicious debug@4.4.2) - ip-address <=10.1.0 → ^10.1.1 (GHSA-v2v4, XSS in Address6) Fixes vitest 4 mock incompatibility in adapter-stellar tests where `vi.fn(arrow)` mocks were used as constructors. Vitest 4 / tinyspy 4 now uses `Reflect.construct(impl, args)` which throws on arrow functions per ES spec. Converted affected mocks to regular `function` expressions across five test files. Not fixed (no upstream patch, not exploitable, or breaking-major-bump): - uuid 8.3.2/9.0.1 (GHSA-w5hq) — CVE only affects v3/v5/v6 with buf arg; our consumers use v4(). Pin to ^11.1.1 would break peer deps. - elliptic 6.6.1 (GHSA-848j) — no patched release exists. - bigint-buffer 1.1.5 (GHSA-3gc7) — no patched release exists.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Single-PR sweep of the open Dependabot advisories on the adapters repo. Knocks out 8 criticals, multiple highs, and most moderates by bumping direct deps and adding workspace-level pnpm overrides.
Direct dep bump
vitest^3.2.4→^4.1.0across all 8 adapter packages — patches GHSA-5xrq-8626-4rwp (arbitrary file read/exec via Vitest UI server). Resolves to4.1.8.Override migration:
package.json#pnpm→pnpm-workspace.yamlpnpm v11 silently ignores
package.json#pnpm.overrides. The existing overrides (valtio, viem, midnight-js-*, etc.) were already inert. This PR migrates them topnpm-workspace.yaml#overridesso they take effect.New security overrides
protobufjs<7.5.8→^7.5.8@protobufjs/utf8<1.1.1→^1.1.1hono<4.12.21→^4.12.21ws>=8.0.0 <8.20.1→^8.20.1vite>=7.0.0 <7.3.2→^7.3.2lodash<4.18.0→^4.18.0tmp<0.2.6→^0.2.6@metamask/sdk+…-communication-layer<0.33.1→^0.33.1ip-address<=10.1.0→^10.1.1Vitest 4 mock compat fix in adapter-stellar
Vitest 4 /
tinyspy@4switched constructor invocation toReflect.construct(impl, args), which throws on arrow-function implementations per ES spec. Existingvi.fn(() => ({...}))mocks used as constructors (new StellarRpc.Server(...),new Contract(...),new TransactionBuilder(...),new Account(...),Spec(...)) had to be converted to regularfunctionexpressions. Five test files touched:test/access-control/ownable-two-step.test.tstest/contract/loader-sac.test.tstest/contract/type-detection.test.tstest/query/sac-query.test.tstest/query/state-mutability.test.tsNot fixed in this PR (justifications for dismissal)
uuid8.3.2/9.0.1 — GHSA-w5hq-g745-h8pqv3/v5/v6with explicitbufarg. Solana web3.js / MetaMask utils callv4()only. Forcing^11.1.1would violate@solana/web3.jspeer constraints.elliptic6.6.1 — GHSA-848j-6mx2-7j84bigint-buffer1.1.5 — GHSA-3gc7-fjrx-p6mg@solana/spl-token.Test plan
pnpm installsucceeds; lockfile regenerated cleanlypnpm -r typecheckpassespnpm -r test— all tests pass across 8 packages on vitest 4.1.8 (stellar 865/865, evm 126/126, polkadot 66/66, adapters-vite 14/14, plus solana / midnight / evm-core / runtime-utils)pnpm-lock.yaml:ws8.18.x → only8.20.1(+ untouched7.5.10)hono4.12.8 →4.12.23protobufjs7.4.0/7.6.0 →7.6.0only (7.4.0 gone)tmp0.0.33 →0.2.7vite7.3.1 → none (only8.0.5)lodash4.17.21 →4.18.1onlyip-address10.1.0 →10.2.0@metamask/sdk*0.32.0 →0.33.1only