From 5894d4160f31f1716cd935fcb254f13b34f73067 Mon Sep 17 00:00:00 2001 From: Dadam Rishikesh Reddy Date: Wed, 30 Sep 2026 16:31:08 +0530 Subject: [PATCH] fix: address brace-expansion, joi, engine.io, webpack-dev-middleware security advisories Ticket: WCI-1715 --- osv-scanner.toml | 4 ---- package.json | 11 +++++------ yarn.lock | 38 +++++++++++++++++++++----------------- 3 files changed, 26 insertions(+), 27 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index 0d37838227..948856a1e2 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -46,10 +46,6 @@ reason = "ws server-side memory exhaustion DoS; transitive via @cosmjs/socket, @ id = "GHSA-hmw2-7cc7-3qxx" reason = "form-data CRLF injection via unescaped multipart field names; transitive via superagent and @aptos-labs/ts-sdk; all form-data field names and filenames in our code are code-controlled constants, not derived from user input" -[[IgnoredVulns]] -id = "GHSA-wcpc-wj8m-hjx6" -reason = "protobufjs DoS via unbounded Any expansion (parseAny recursion); transitive via @cosmjs and @hashgraph/sdk requiring protobufjs <=7.5.x; input comes from trusted blockchain RPC responses only, not arbitrary user data" - [[IgnoredVulns]] id = "GHSA-7c78-jf6q-g5cm" reason = "tmp path traversal via type-confusion in _assertPath (non-string args); transitive via cypress/karma/lerna/nx (dev-time only, never in production); all prefix/postfix/template args are hard-coded string constants — type-confusion vector does not apply" diff --git a/package.json b/package.json index 7a0e923ac4..46a8feb38e 100644 --- a/package.json +++ b/package.json @@ -132,7 +132,7 @@ "**/iota-sdk/**/valibot": "1.2.0", "**/tronweb/**/validator": "13.15.23", "@isaacs/brace-expansion": "5.0.1", - "brace-expansion": "5.0.9", + "brace-expansion": "5.0.11", "nx": "22.7.7", "basic-ftp": "5.3.1", "flatted": "3.4.2", @@ -164,8 +164,7 @@ "socket.io-parser": "4.2.7", "nanoid": "3.3.18", "sanitize-html": "2.17.5", - "node-releases": "2.0.52", - "smol-toml": "1.7.1" + "node-releases": "2.0.52" }, "overrides": { "qs": "6.15.2", @@ -218,7 +217,7 @@ "webpack-dev-server": "5.2.1", "memfs": "4.46.0", "@isaacs/brace-expansion": "5.0.1", - "brace-expansion": "5.0.9", + "brace-expansion": "5.0.11", "nx": "22.7.7", "basic-ftp": "5.3.1", "flatted": "3.4.2", @@ -328,9 +327,9 @@ }, "dependencies": { "axios": "1.18.0", + "bigint-buffer": "npm:@trufflesuite/bigint-buffer@1.1.10", "terser": "^5.14.2", - "tmp": "^0.2.3", - "bigint-buffer": "npm:@trufflesuite/bigint-buffer@1.1.10" + "tmp": "^0.2.3" }, "packageManager": "yarn@1.22.22" } diff --git a/yarn.lock b/yarn.lock index d59340a04c..d7ec2a293d 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7915,7 +7915,7 @@ base64-js@*, base64-js@1.5.1, base64-js@^1.3.0, base64-js@^1.3.1, base64-js@^1.5 resolved "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz" integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA== -base64id@2.0.0, base64id@~2.0.0: +base64id@~2.0.0: version "2.0.0" resolved "https://registry.npmjs.org/base64id/-/base64id-2.0.0.tgz" integrity sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog== @@ -8245,10 +8245,10 @@ borsh@^0.7.0: bs58 "^4.0.0" text-encoding-utf-8 "^1.0.2" -brace-expansion@5.0.6, brace-expansion@5.0.9, brace-expansion@^1.1.7, brace-expansion@^2.0.1, brace-expansion@^5.0.5: - version "5.0.9" - resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz#7c72438809b5fa5babf54199a1f1c281a6984fcf" - integrity sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg== +brace-expansion@5.0.11, brace-expansion@5.0.6, brace-expansion@^1.1.7, brace-expansion@^2.0.1, brace-expansion@^5.0.5: + version "5.0.11" + resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.11.tgz#c002bac1d556536d5f99280d2e179d43f8dbd6b7" + integrity sha512-awigjhi6cLTh90bdw6+QJ9CtmJmyYhEIi70iCbc8Rozn04Fw9FeQIBjv/E22FFGuCGx1bLJyUfB64x/szUSXUg== dependencies: balanced-match "^4.0.2" @@ -10634,20 +10634,19 @@ engine.io-parser@~5.2.1: integrity sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q== engine.io@~6.6.0: - version "6.6.7" - resolved "https://registry.npmjs.org/engine.io/-/engine.io-6.6.7.tgz#60efa5b5b67167cdf93d64430c40a68bae9e4f21" - integrity sha512-DgOngfDKM2EviOH3Mr9m7ks1q8roetLy/IMmYthAYzbpInMbYc/GS+fWFA3rl1gvwKVsQrVV61fo5emD1y3OJQ== + version "6.6.11" + resolved "https://registry.npmjs.org/engine.io/-/engine.io-6.6.11.tgz#05203f76be9c63489cdf52aadab4200a201315fd" + integrity sha512-z34mGpLoY/82ZbkX1LqGMIaf3wjVMPL6gVC681QDqnmzJ26synI8qAE32P+a7UazmpJZ8UGrFIeAavgRfXzYrg== dependencies: "@types/cors" "^2.8.12" "@types/node" ">=10.0.0" "@types/ws" "^8.5.12" accepts "~1.3.4" - base64id "2.0.0" cookie "~0.7.2" cors "~2.8.5" debug "~4.4.1" engine.io-parser "~5.2.1" - ws "~8.18.3" + ws "~8.21.0" enhanced-resolve@5.24.1, enhanced-resolve@^5.0.0, enhanced-resolve@^5.22.0: version "5.24.1" @@ -13981,9 +13980,9 @@ jmespath@0.16.0: integrity sha512-9FzQjJ7MATs1tSpnco1K6ayiYE3figslrXA72G2HQ/n76RzvYlofyi5QM+iX4YRs/pu3yzxlVQSST23+dMDknw== joi@^17.4.0: - version "17.13.6" - resolved "https://registry.npmjs.org/joi/-/joi-17.13.6.tgz#3fa166ca4b7feac442340c1522ea2f51cca3d425" - integrity sha512-ImNZaq/LSysofih+xIGYfR0WUXMA9GLUNB//YTCSrZptoRmVgaNAdJyi6K1kXi9pkLEoSkoI8I4UwtNiu/D7nw== + version "17.13.8" + resolved "https://registry.npmjs.org/joi/-/joi-17.13.8.tgz#92069d521eea09fd709d8abbb86b0ef02862224f" + integrity sha512-iPKOGmiRw1jxf/JOPwxmCcUQAOdF359mdzYiP2DJ+TMX0YK2zjK3D+zYOaGjpumWxOFF/l2xVWjRVK5bGSLdEw== dependencies: "@hapi/hoek" "^9.3.0" "@hapi/topo" "^5.1.0" @@ -21151,9 +21150,9 @@ webpack-cli@^5.0.0: webpack-merge "^5.7.3" webpack-dev-middleware@^7.4.2: - version "7.4.5" - resolved "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-7.4.5.tgz" - integrity sha512-uxQ6YqGdE4hgDKNf7hUiPXOdtkXvBJXrfEGYSx7P7LC8hnUYGK70X6xQXUvXeNyBDDcsiQXpG2m3G9vxowaEuA== + version "7.4.6" + resolved "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-7.4.6.tgz#c27229cb157842882732ee5125fa217a2c6466dc" + integrity sha512-yBWCMvIfUmuhAE8vdqUKzH0vg9kuWN0KeG4vBnqRplUFHRU7lMQjkiJWxVQzvo2BTewqhPhDlMB41rAt2jVA9A== dependencies: colorette "^2.0.10" memfs "^4.43.1" @@ -21505,7 +21504,7 @@ ws@5.2.4: dependencies: async-limiter "~1.0.0" -ws@7.4.6, ws@8.18.3, ws@8.8.0, ws@^8.13.0, ws@^8.18.0, ws@^8.5.0, ws@^8.8.1, ws@~8.18.3: +ws@7.4.6, ws@8.18.3, ws@8.8.0, ws@^8.13.0, ws@^8.18.0, ws@^8.5.0, ws@^8.8.1: version "8.18.3" resolved "https://registry.npmjs.org/ws/-/ws-8.18.3.tgz" integrity sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg== @@ -21520,6 +21519,11 @@ ws@~8.17.1: resolved "https://registry.npmjs.org/ws/-/ws-8.17.1.tgz" integrity sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ== +ws@~8.21.0: + version "8.21.3" + resolved "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz#660b4faddb6a3e575c86e078126919961f4de4fc" + integrity sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw== + wsl-utils@^0.1.0: version "0.1.0" resolved "https://registry.npmjs.org/wsl-utils/-/wsl-utils-0.1.0.tgz"