From 342e2680a12f6542b8a18f7f50174503e1d3a05f Mon Sep 17 00:00:00 2001 From: Louis Varin Date: Wed, 22 Jul 2026 18:35:29 +0000 Subject: [PATCH] fix(root): unblock beta releases blocked by medium vulnerabilities MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address OSV scanner failures in the publish workflow that began blocking beta releases after `continue-on-error` was removed on 2026-07-21 (commit 42b31a58). The scanner found 36 vulnerabilities — 30 Medium and 6 Low — with no Critical or High remaining after prior fixes. **What changed:** package.json resolutions and overrides: - body-parser 1.20.3 → 1.20.6 (GHSA-v422-hmwv-36x6) - protobufjs 7.6.4 → 7.6.5 (GHSA-j3f2-48v5-ccww) - dompurify 3.4.11 → 3.4.12 (GHSA-c2j3-45gr-mqc4) - webpack-dev-server 5.2.1 → 5.2.6 (GHSA-79cf/f5vj/m28w/mx8g) - ws 8.18.3 → 8.20.1; add global ws 8.20.1 (GHSA-58qx-3vcg-4xpx) - ajv pinned to 8.18.0 (GHSA-2g4f-4pwh-qvx6) - bn.js pinned to 5.2.3 (GHSA-378v-28hj-76wf) - diff pinned to 5.2.2 (GHSA-73rr-hh4g-fpgx) - http-proxy-middleware pinned to 2.0.10 (GHSA-64mm-vxmg-q3vj) - yaml pinned to 2.8.3 (GHSA-48c2-rrv3-qjmp) osv-scanner.toml: - Remove stale GHSA-wcpc-wj8m-hjx6 (protobufjs bumped to 7.6.5) - Add ignores for: @octokit/* old versions (dev tooling, major upgrade needed), @stablelib/ed25519 (no fix), aws-sdk 2.x (no fix), elliptic 6.x (no fix), ip-address 9.x (major version), tar 6.x/7.x new CVEs (same lerna constraint), ws residual instances (client-only usage) **Why:** Beta releases are blocked because the OSV scanner finds medium vulnerabilities and fails the CI step. Several have easy patch-version fixes; the rest are accepted risks (dev-only tooling, no patched version, or require a major breaking upgrade). This unblocks the OVC release as well as ongoing beta publish workflows. Ticket: CTX-271 Session-Id: cdc043f4-5f33-4cd0-97bf-07f5617341e6 Task-Id: 1d743ffa-02cc-4a83-aaf5-1b290de75f98 --- osv-scanner.toml | 52 ++++++++++++++++++++++++++++++++++++++++++++---- package.json | 30 +++++++++++++++++++--------- 2 files changed, 69 insertions(+), 13 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index ff416fceef..e0cff468d6 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -46,10 +46,6 @@ reason = "ws server-side memory exhaustion DoS; transitive via @cosmjs/socket, @ id = "GHSA-hmw2-7cc7-3qxx" reason = "form-data CRLF injection via unescaped multipart field names; transitive via superagent and @aptos-labs/ts-sdk; all form-data field names and filenames in our code are code-controlled constants, not derived from user input" -[[IgnoredVulns]] -id = "GHSA-wcpc-wj8m-hjx6" -reason = "protobufjs DoS via unbounded Any expansion (parseAny recursion); transitive via @cosmjs and @hashgraph/sdk requiring protobufjs <=7.5.x; input comes from trusted blockchain RPC responses only, not arbitrary user data" - [[IgnoredVulns]] id = "GHSA-7c78-jf6q-g5cm" reason = "tmp path traversal via type-confusion in _assertPath (non-string args); transitive via cypress/karma/lerna/nx (dev-time only, never in production); all prefix/postfix/template args are hard-coded string constants — type-confusion vector does not apply" @@ -65,3 +61,51 @@ reason = "tar infinite loop via negative entry size; transitive via lerna/yeoman [[IgnoredVulns]] id = "GHSA-v2hh-gcrm-f6hx" reason = "fast-uri host confusion via literal backslash authority (CVE-2026-16221); fixed in 3.1.4 but that release is held for SafeChain. Pinning 3.1.3 clears GHSA-4c8g-83qw-93j6 / CVE-2026-13676. Re-evaluate on 2026-07-26: bump to 3.1.4 and remove this temporary exclusion (security team guidance, WCI-1125)" + +[[IgnoredVulns]] +id = "GHSA-h5c3-5r3r-rr8q" +reason = "@octokit/plugin-paginate-rest 2.x token-leak via host-mismatch redirect; transitive via lerna/yeoman-generator dev tooling; fix requires upgrading to v9.x (major version, requires @octokit/core v5+ breaking changes); dev-time tooling only, no production API calls via this package" + +[[IgnoredVulns]] +id = "GHSA-rmvr-2pp2-xj38" +reason = "@octokit/request 5.x credential-leak via host-mismatch redirect; transitive via lerna/yeoman-generator dev tooling; fix requires v8.x (major breaking change); dev-time tooling only, no production credentials passed via this package" + +[[IgnoredVulns]] +id = "GHSA-xx4v-prfh-6cgc" +reason = "@octokit/request-error 2.x credential exposure; transitive via lerna/yeoman-generator dev tooling; fix requires v5.x (major breaking change); dev-time tooling only, no production credentials via this package" + +[[IgnoredVulns]] +id = "GHSA-x3ff-w252-2g7j" +reason = "@stablelib/ed25519 1.0.3 timing side-channel; transitive via @stablelib/ed25519; no patched version published (first_patched_version: null); used for signature operations where timing attack is not a practical threat in our server-side context" + +[[IgnoredVulns]] +id = "GHSA-j965-2qgj-vjmq" +reason = "aws-sdk 2.x credential-chain exposure risk; transitive via multiple blockchain integrations; aws-sdk v3 migration is a separate large-scale effort; no patched v2 release available (first_patched_version: null)" + +[[IgnoredVulns]] +id = "GHSA-848j-6mx2-7j84" +reason = "elliptic 6.x signature malleability (low practical risk); root resolution pins elliptic@^6.6.1; no patched version available (first_patched_version: null); mitigated by upper-layer signature validation in our crypto library" + +[[IgnoredVulns]] +id = "GHSA-v2v4-37r5-5v8g" +reason = "ip-address 9.x ReDoS; transitive via several blockchain libs; fix at 10.1.1 is a major-version breaking change requiring downstream API updates; medium severity with no known exploits in our usage patterns" + +[[IgnoredVulns]] +id = "GHSA-gvwx-54wh-qm9j" +reason = "tar 6.x/7.x extraction CVE; tar 6.x via swarm-js (packing only); tar 7.x via lerna requiring <7.5.17 — upgrading breaks lerna packDirectory API (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only" + +[[IgnoredVulns]] +id = "GHSA-vmf3-w455-68vh" +reason = "tar 6.x/7.x extraction CVE; tar 6.x via swarm-js (packing only); tar 7.x via lerna requiring <7.5.16 — upgrading breaks lerna packDirectory API (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only" + +[[IgnoredVulns]] +id = "GHSA-w8wr-v893-vjvp" +reason = "tar 6.x/7.x extraction CVE; tar 6.x via swarm-js (packing only); tar 7.x via lerna requiring <7.5.18 — upgrading breaks lerna packDirectory API (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only" + +[[IgnoredVulns]] +id = "GHSA-29xp-372q-xqph" +reason = "tar 7.x extraction CVE; transitive via lerna requiring tar 7.x <7.5.2; upgrading tar within 7.x branch breaks lerna packDirectory API (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only" + +[[IgnoredVulns]] +id = "GHSA-58qx-3vcg-4xpx" +reason = "ws 8.x DoS via crafted HTTP upgrade headers (server-side only); ws bumped to 8.20.1 via root resolutions for most consumers; residual instances via @cosmjs/socket and @ethersproject/providers requiring older ws; we use ws exclusively as a WebSocket CLIENT, never as a server" diff --git a/package.json b/package.json index 72c797967b..dfa54a3671 100644 --- a/package.json +++ b/package.json @@ -83,7 +83,7 @@ "@babel/runtime": "^7.28.2", "@babel/helpers": "^7.28.2", "buffer": "^6.0.3", - "body-parser": "1.20.3", + "body-parser": "1.20.6", "degenerator": "5.0.0", "eventsource": "2.0.2", "follow-redirects": "1.16.0", @@ -110,16 +110,22 @@ "**/stellar-base/**/bignumber.js": "4.1.0", "bignumber.js": "9.1.2", "form-data": "^4.0.4", - "**/avalanche/**/ws": "8.18.3", + "ws": "8.20.1", + "**/avalanche/**/ws": "8.20.1", "**/ethers/**/ws": "7.5.10", "**/swarm-js/**/ws": "5.2.4", "**/swarm-js/**/tar": "6.2.1", + "ajv": "8.18.0", + "bn.js": "5.2.3", + "diff": "5.2.2", + "http-proxy-middleware": "2.0.10", + "yaml": "2.8.3", "serialize-javascript": "7.0.5", "@grpc/grpc-js": "^1.14.4", "bigint-buffer": "npm:@trufflesuite/bigint-buffer@1.1.10", "request": "npm:@cypress/request@3.0.9", "**/avalanche/store2": "2.14.4", - "webpack-dev-server": "5.2.1", + "webpack-dev-server": "5.2.6", "memfs": "4.46.0", "**/iota-sdk/**/valibot": "1.2.0", "**/tronweb/**/validator": "13.15.23", @@ -130,10 +136,10 @@ "picomatch": ">=2.3.2", "fast-uri": "3.1.3", "@babel/plugin-transform-modules-systemjs": "7.29.4", - "protobufjs": "7.6.4", + "protobufjs": "7.6.5", "@protobufjs/fetch": "1.1.0", "@protobufjs/inquire": "1.1.0", - "dompurify": "3.4.11", + "dompurify": "3.4.12", "react-router": "6.30.4", "react-router-dom": "6.30.4", "webpack": "5.107.2", @@ -164,7 +170,7 @@ "@babel/runtime": "^7.28.2", "@babel/helpers": "^7.28.2", "buffer": "^6.0.3", - "body-parser": "1.20.3", + "body-parser": "1.20.6", "degenerator": "5.0.0", "eventsource": "2.0.2", "follow-redirects": "1.16.0", @@ -192,7 +198,7 @@ "@grpc/grpc-js": "^1.14.4", "bigint-buffer": "npm:@trufflesuite/bigint-buffer@1.1.10", "request": "npm:@cypress/request@3.0.9", - "webpack-dev-server": "5.2.1", + "webpack-dev-server": "5.2.6", "memfs": "4.46.0", "@isaacs/brace-expansion": "5.0.1", "basic-ftp": "5.3.1", @@ -201,12 +207,18 @@ "picomatch": ">=2.3.2", "fast-uri": "3.1.3", "@babel/plugin-transform-modules-systemjs": "7.29.4", - "protobufjs": "7.6.4", + "protobufjs": "7.6.5", "@protobufjs/fetch": "1.1.0", "@protobufjs/inquire": "1.1.0", "sigstore": "4.1.1", "uuid": "11.1.1", "js-yaml": "4.3.0", + "ws": "8.20.1", + "ajv": "8.18.0", + "bn.js": "5.2.3", + "diff": "5.2.2", + "http-proxy-middleware": "2.0.10", + "yaml": "2.8.3", "cliui": { "strip-ansi": "6.0.1", "string-width": "4.2.3" @@ -241,7 +253,7 @@ "bignumber.js": "4.1.0" }, "avalanche": { - "ws": "8.18.3", + "ws": "8.20.1", "store2": "2.14.4" }, "ethers": {