diff --git a/osv-scanner.toml b/osv-scanner.toml index ff416fceef..e0cff468d6 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -46,10 +46,6 @@ reason = "ws server-side memory exhaustion DoS; transitive via @cosmjs/socket, @ id = "GHSA-hmw2-7cc7-3qxx" reason = "form-data CRLF injection via unescaped multipart field names; transitive via superagent and @aptos-labs/ts-sdk; all form-data field names and filenames in our code are code-controlled constants, not derived from user input" -[[IgnoredVulns]] -id = "GHSA-wcpc-wj8m-hjx6" -reason = "protobufjs DoS via unbounded Any expansion (parseAny recursion); transitive via @cosmjs and @hashgraph/sdk requiring protobufjs <=7.5.x; input comes from trusted blockchain RPC responses only, not arbitrary user data" - [[IgnoredVulns]] id = "GHSA-7c78-jf6q-g5cm" reason = "tmp path traversal via type-confusion in _assertPath (non-string args); transitive via cypress/karma/lerna/nx (dev-time only, never in production); all prefix/postfix/template args are hard-coded string constants — type-confusion vector does not apply" @@ -65,3 +61,51 @@ reason = "tar infinite loop via negative entry size; transitive via lerna/yeoman [[IgnoredVulns]] id = "GHSA-v2hh-gcrm-f6hx" reason = "fast-uri host confusion via literal backslash authority (CVE-2026-16221); fixed in 3.1.4 but that release is held for SafeChain. Pinning 3.1.3 clears GHSA-4c8g-83qw-93j6 / CVE-2026-13676. Re-evaluate on 2026-07-26: bump to 3.1.4 and remove this temporary exclusion (security team guidance, WCI-1125)" + +[[IgnoredVulns]] +id = "GHSA-h5c3-5r3r-rr8q" +reason = "@octokit/plugin-paginate-rest 2.x token-leak via host-mismatch redirect; transitive via lerna/yeoman-generator dev tooling; fix requires upgrading to v9.x (major version, requires @octokit/core v5+ breaking changes); dev-time tooling only, no production API calls via this package" + +[[IgnoredVulns]] +id = "GHSA-rmvr-2pp2-xj38" +reason = "@octokit/request 5.x credential-leak via host-mismatch redirect; transitive via lerna/yeoman-generator dev tooling; fix requires v8.x (major breaking change); dev-time tooling only, no production credentials passed via this package" + +[[IgnoredVulns]] +id = "GHSA-xx4v-prfh-6cgc" +reason = "@octokit/request-error 2.x credential exposure; transitive via lerna/yeoman-generator dev tooling; fix requires v5.x (major breaking change); dev-time tooling only, no production credentials via this package" + +[[IgnoredVulns]] +id = "GHSA-x3ff-w252-2g7j" +reason = "@stablelib/ed25519 1.0.3 timing side-channel; transitive via @stablelib/ed25519; no patched version published (first_patched_version: null); used for signature operations where timing attack is not a practical threat in our server-side context" + +[[IgnoredVulns]] +id = "GHSA-j965-2qgj-vjmq" +reason = "aws-sdk 2.x credential-chain exposure risk; transitive via multiple blockchain integrations; aws-sdk v3 migration is a separate large-scale effort; no patched v2 release available (first_patched_version: null)" + +[[IgnoredVulns]] +id = "GHSA-848j-6mx2-7j84" +reason = "elliptic 6.x signature malleability (low practical risk); root resolution pins elliptic@^6.6.1; no patched version available (first_patched_version: null); mitigated by upper-layer signature validation in our crypto library" + +[[IgnoredVulns]] +id = "GHSA-v2v4-37r5-5v8g" +reason = "ip-address 9.x ReDoS; transitive via several blockchain libs; fix at 10.1.1 is a major-version breaking change requiring downstream API updates; medium severity with no known exploits in our usage patterns" + +[[IgnoredVulns]] +id = "GHSA-gvwx-54wh-qm9j" +reason = "tar 6.x/7.x extraction CVE; tar 6.x via swarm-js (packing only); tar 7.x via lerna requiring <7.5.17 — upgrading breaks lerna packDirectory API (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only" + +[[IgnoredVulns]] +id = "GHSA-vmf3-w455-68vh" +reason = "tar 6.x/7.x extraction CVE; tar 6.x via swarm-js (packing only); tar 7.x via lerna requiring <7.5.16 — upgrading breaks lerna packDirectory API (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only" + +[[IgnoredVulns]] +id = "GHSA-w8wr-v893-vjvp" +reason = "tar 6.x/7.x extraction CVE; tar 6.x via swarm-js (packing only); tar 7.x via lerna requiring <7.5.18 — upgrading breaks lerna packDirectory API (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only" + +[[IgnoredVulns]] +id = "GHSA-29xp-372q-xqph" +reason = "tar 7.x extraction CVE; transitive via lerna requiring tar 7.x <7.5.2; upgrading tar within 7.x branch breaks lerna packDirectory API (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only" + +[[IgnoredVulns]] +id = "GHSA-58qx-3vcg-4xpx" +reason = "ws 8.x DoS via crafted HTTP upgrade headers (server-side only); ws bumped to 8.20.1 via root resolutions for most consumers; residual instances via @cosmjs/socket and @ethersproject/providers requiring older ws; we use ws exclusively as a WebSocket CLIENT, never as a server" diff --git a/package.json b/package.json index 72c797967b..dfa54a3671 100644 --- a/package.json +++ b/package.json @@ -83,7 +83,7 @@ "@babel/runtime": "^7.28.2", "@babel/helpers": "^7.28.2", "buffer": "^6.0.3", - "body-parser": "1.20.3", + "body-parser": "1.20.6", "degenerator": "5.0.0", "eventsource": "2.0.2", "follow-redirects": "1.16.0", @@ -110,16 +110,22 @@ "**/stellar-base/**/bignumber.js": "4.1.0", "bignumber.js": "9.1.2", "form-data": "^4.0.4", - "**/avalanche/**/ws": "8.18.3", + "ws": "8.20.1", + "**/avalanche/**/ws": "8.20.1", "**/ethers/**/ws": "7.5.10", "**/swarm-js/**/ws": "5.2.4", "**/swarm-js/**/tar": "6.2.1", + "ajv": "8.18.0", + "bn.js": "5.2.3", + "diff": "5.2.2", + "http-proxy-middleware": "2.0.10", + "yaml": "2.8.3", "serialize-javascript": "7.0.5", "@grpc/grpc-js": "^1.14.4", "bigint-buffer": "npm:@trufflesuite/bigint-buffer@1.1.10", "request": "npm:@cypress/request@3.0.9", "**/avalanche/store2": "2.14.4", - "webpack-dev-server": "5.2.1", + "webpack-dev-server": "5.2.6", "memfs": "4.46.0", "**/iota-sdk/**/valibot": "1.2.0", "**/tronweb/**/validator": "13.15.23", @@ -130,10 +136,10 @@ "picomatch": ">=2.3.2", "fast-uri": "3.1.3", "@babel/plugin-transform-modules-systemjs": "7.29.4", - "protobufjs": "7.6.4", + "protobufjs": "7.6.5", "@protobufjs/fetch": "1.1.0", "@protobufjs/inquire": "1.1.0", - "dompurify": "3.4.11", + "dompurify": "3.4.12", "react-router": "6.30.4", "react-router-dom": "6.30.4", "webpack": "5.107.2", @@ -164,7 +170,7 @@ "@babel/runtime": "^7.28.2", "@babel/helpers": "^7.28.2", "buffer": "^6.0.3", - "body-parser": "1.20.3", + "body-parser": "1.20.6", "degenerator": "5.0.0", "eventsource": "2.0.2", "follow-redirects": "1.16.0", @@ -192,7 +198,7 @@ "@grpc/grpc-js": "^1.14.4", "bigint-buffer": "npm:@trufflesuite/bigint-buffer@1.1.10", "request": "npm:@cypress/request@3.0.9", - "webpack-dev-server": "5.2.1", + "webpack-dev-server": "5.2.6", "memfs": "4.46.0", "@isaacs/brace-expansion": "5.0.1", "basic-ftp": "5.3.1", @@ -201,12 +207,18 @@ "picomatch": ">=2.3.2", "fast-uri": "3.1.3", "@babel/plugin-transform-modules-systemjs": "7.29.4", - "protobufjs": "7.6.4", + "protobufjs": "7.6.5", "@protobufjs/fetch": "1.1.0", "@protobufjs/inquire": "1.1.0", "sigstore": "4.1.1", "uuid": "11.1.1", "js-yaml": "4.3.0", + "ws": "8.20.1", + "ajv": "8.18.0", + "bn.js": "5.2.3", + "diff": "5.2.2", + "http-proxy-middleware": "2.0.10", + "yaml": "2.8.3", "cliui": { "strip-ansi": "6.0.1", "string-width": "4.2.3" @@ -241,7 +253,7 @@ "bignumber.js": "4.1.0" }, "avalanche": { - "ws": "8.18.3", + "ws": "8.20.1", "store2": "2.14.4" }, "ethers": {