Skip to content

Commit 3603cd0

Browse files
zahin-mohammadzahin-mohammad
committed
fix(deps): clear 4 HIGH osv advisories blocking beta publish
The Publish @bitgo-beta workflow has failed since 2026-08-03 on the osv-severity-gate: 4 of 41 advisory groups scored at or above CVSS 7.0. All four advisories were published 2026-08-03 and all have upstream fixes, so no osv-scanner.toml exclusion is warranted. - brace-expansion 5.0.8 -> 5.0.9 (GHSA-rgw5-rvv9-x895, CVSS 7.5) - fast-uri 3.1.3 -> 3.1.5 (GHSA-7p8r-x3mc-p8w7, CVSS 7.5) - socket.io-parser -> 4.2.7 (GHSA-2m8v-j782-fhvr, CVSS 7.5) - ip-address -> 10.4.0 (GHSA-mwp4-54f8-5fhr, CVSS 7.7) - socks 2.7.3 -> 2.8.9 (carries the ip-address bump) fast-uri stays on the 3.x line rather than moving to 4.1.2: the only consumer is ajv@^8, which declares fast-uri@^3.0.1, and 3.1.5 clears the advisory inside that declared range. Upstream still maintains 3.x under the 'three' dist-tag. ip-address has no 9.x fix, so clearing GHSA-mwp4-54f8-5fhr needs a major bump. Its only consumer is socks, which moved to ip-address@^10.x in 2.8.7, so socks is raised to 2.8.9 rather than forcing 10.x underneath the old 2.7.3 pin. After this the lock holds a single ip-address@^10.1.1 spec, satisfied by 10.4.0 — no semver-major override remains. The 2.7.3 pin was itself a security floor (WP-1413, "locked socks version to fix vulnerability"), so raising it preserves that intent; 2.8.9 carries no advisories. It also repairs a range violation: socks-proxy-agent@^8 declares socks@^2.8.3, which 2.7.3 never satisfied. The explicit ip-address pin stays even though socks now declares ^10.1.1, because that range still permits the vulnerable 10.1.x/10.2.x releases for npm consumers resolving from overrides. Verified in the installed tree on socks 2.8.9 + ip-address 10.4.0: Address4/Address6 constructors, Address6.fromByteArray().canonicalForm(), helpers ipToBuffer / ipv4ToInt32 / int32ToIpv4 / validateSocksClientOptions, SocksClient.createConnection presence, and SocksProxyAgent construction. socks-proxy-agent 7.0.0 (^2.6.2) and 8.0.5 (^2.8.3) both resolve against 2.8.9. resolutions and overrides are updated together; npm consumers of the bitgo umbrella package only see overrides. Ticket: WCN-1798
1 parent 891f68f commit 3603cd0

2 files changed

Lines changed: 32 additions & 41 deletions

File tree

‎package.json‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@
9696
"json5": "^2.2.2",
9797
"ua-parser-js": ">0.7.30 <0.8.0",
9898
"secp256k1": "5.0.1",
99-
"socks": "2.7.3",
99+
"socks": "2.8.9",
100100
"web3-utils": "4.2.1",
101101
"@polkadot/api": "14.1.1",
102102
"@polkadot/util": "13.5.6",
@@ -124,13 +124,13 @@
124124
"**/iota-sdk/**/valibot": "1.2.0",
125125
"**/tronweb/**/validator": "13.15.23",
126126
"@isaacs/brace-expansion": "5.0.1",
127-
"brace-expansion": "5.0.8",
127+
"brace-expansion": "5.0.9",
128128
"nx": "22.7.7",
129129
"basic-ftp": "5.3.1",
130130
"flatted": "3.4.2",
131131
"sjcl": "npm:@bitgo/sjcl@1.0.1",
132132
"picomatch": ">=2.3.2",
133-
"fast-uri": "3.1.3",
133+
"fast-uri": "3.1.5",
134134
"postcss": "8.5.18",
135135
"@babel/plugin-transform-modules-systemjs": "7.29.4",
136136
"protobufjs": "7.6.4",
@@ -151,7 +151,9 @@
151151
"sigstore": "4.1.1",
152152
"**/bn.js": "5.2.3",
153153
"uuid": "11.1.1",
154-
"js-yaml": "4.3.0"
154+
"js-yaml": "4.3.0",
155+
"ip-address": "10.4.0",
156+
"socket.io-parser": "4.2.7"
155157
},
156158
"overrides": {
157159
"qs": "6.15.2",
@@ -181,7 +183,7 @@
181183
"json5": "^2.2.2",
182184
"ua-parser-js": ">0.7.30 <0.8.0",
183185
"secp256k1": "5.0.1",
184-
"socks": "2.7.3",
186+
"socks": "2.8.9",
185187
"web3-utils": "4.2.1",
186188
"@polkadot/api": "14.1.1",
187189
"@polkadot/util": "13.5.6",
@@ -199,13 +201,13 @@
199201
"webpack-dev-server": "5.2.1",
200202
"memfs": "4.46.0",
201203
"@isaacs/brace-expansion": "5.0.1",
202-
"brace-expansion": "5.0.8",
204+
"brace-expansion": "5.0.9",
203205
"nx": "22.7.7",
204206
"basic-ftp": "5.3.1",
205207
"flatted": "3.4.2",
206208
"sjcl": "npm:@bitgo/sjcl@1.0.1",
207209
"picomatch": ">=2.3.2",
208-
"fast-uri": "3.1.3",
210+
"fast-uri": "3.1.5",
209211
"postcss": "8.5.18",
210212
"@babel/plugin-transform-modules-systemjs": "7.29.4",
211213
"protobufjs": "7.6.4",
@@ -215,6 +217,8 @@
215217
"bn.js": "5.2.3",
216218
"uuid": "11.1.1",
217219
"js-yaml": "4.3.0",
220+
"ip-address": "10.4.0",
221+
"socket.io-parser": "4.2.7",
218222
"cliui": {
219223
"strip-ansi": "6.0.1",
220224
"string-width": "4.2.3"

‎yarn.lock‎

Lines changed: 21 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -8107,10 +8107,10 @@ borsh@^0.7.0:
81078107
bs58 "^4.0.0"
81088108
text-encoding-utf-8 "^1.0.2"
81098109

8110-
brace-expansion@5.0.6, brace-expansion@5.0.8, brace-expansion@^1.1.7, brace-expansion@^2.0.1, brace-expansion@^5.0.5:
8111-
version "5.0.8"
8112-
resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz#135ad0d8d808eb18eb5e0ec9a21f3a0b92ef18cf"
8113-
integrity sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==
8110+
brace-expansion@5.0.6, brace-expansion@5.0.9, brace-expansion@^1.1.7, brace-expansion@^2.0.1, brace-expansion@^5.0.5:
8111+
version "5.0.9"
8112+
resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz#7c72438809b5fa5babf54199a1f1c281a6984fcf"
8113+
integrity sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==
81148114
dependencies:
81158115
balanced-match "^4.0.2"
81168116

@@ -11588,10 +11588,10 @@ fast-text-encoding@^1.0.6:
1158811588
resolved "https://registry.npmjs.org/fast-text-encoding/-/fast-text-encoding-1.0.6.tgz"
1158911589
integrity sha512-VhXlQgj9ioXCqGstD37E/HBeqEGV/qOD/kmbVG8h5xKBYvM1L3lR1Zn4555cQ8GkYbJa8aJSipLPndE1k6zK2w==
1159011590

11591-
fast-uri@3.1.3, fast-uri@^3.0.1:
11592-
version "3.1.3"
11593-
resolved "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz#f695a40f006aba505631573a0021ddb21194ad11"
11594-
integrity sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==
11591+
fast-uri@3.1.5, fast-uri@^3.0.1:
11592+
version "3.1.5"
11593+
resolved "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz#610f37419a030270430cecd68d74e3d4d96725d0"
11594+
integrity sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==
1159511595

1159611596
fastest-levenshtein@^1.0.12:
1159711597
version "1.0.16"
@@ -13161,13 +13161,10 @@ iobuffer@^5.3.2:
1316113161
resolved "https://registry.npmjs.org/iobuffer/-/iobuffer-5.4.0.tgz"
1316213162
integrity sha512-DRebOWuqDvxunfkNJAlc3IzWIPD5xVxwUNbHr7xKB8E6aLJxIPfNX3CoMJghcFjpv6RWQsrcJbghtEwSPoJqMA==
1316313163

13164-
ip-address@^9.0.5:
13165-
version "9.0.5"
13166-
resolved "https://registry.npmjs.org/ip-address/-/ip-address-9.0.5.tgz"
13167-
integrity sha512-zHtQzGojZXTwZTHQqra+ETKd4Sn3vgi7uBmlPoXVWZqYvuKmtI0l/VZTjqGmJY9x88GGOaZ9+G9ES8hC4T4X8g==
13168-
dependencies:
13169-
jsbn "1.1.0"
13170-
sprintf-js "^1.1.3"
13164+
ip-address@10.4.0, ip-address@^10.1.1:
13165+
version "10.4.0"
13166+
resolved "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz#c5910bc541b6eae287765d1e4846be0308a05d93"
13167+
integrity sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==
1317113168

1317213169
ipaddr.js@1.9.1:
1317313170
version "1.9.1"
@@ -13893,11 +13890,6 @@ js-yaml@4.1.0, js-yaml@4.3.0, js-yaml@^3.13.1, js-yaml@^3.14.1, js-yaml@^4.1.0:
1389313890
dependencies:
1389413891
argparse "^2.0.1"
1389513892

13896-
jsbn@1.1.0:
13897-
version "1.1.0"
13898-
resolved "https://registry.npmjs.org/jsbn/-/jsbn-1.1.0.tgz"
13899-
integrity sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A==
13900-
1390113893
jsbn@~0.1.0:
1390213894
version "0.1.1"
1390313895
resolved "https://registry.npmjs.org/jsbn/-/jsbn-0.1.1.tgz"
@@ -19065,10 +19057,10 @@ socket.io-adapter@~2.5.2:
1906519057
debug "~4.3.4"
1906619058
ws "~8.17.1"
1906719059

19068-
socket.io-parser@~4.2.4:
19069-
version "4.2.6"
19070-
resolved "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz#19156bf179af3931abd05260cfb1491822578a6f"
19071-
integrity sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==
19060+
socket.io-parser@4.2.7, socket.io-parser@~4.2.4:
19061+
version "4.2.7"
19062+
resolved "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.7.tgz#679e51fe24d1c81df90fc5f7efe4a5f432fe99c0"
19063+
integrity sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==
1907219064
dependencies:
1907319065
"@socket.io/component-emitter" "~3.1.0"
1907419066
debug "~4.4.1"
@@ -19113,12 +19105,12 @@ socks-proxy-agent@^8.0.2, socks-proxy-agent@^8.0.3, socks-proxy-agent@^8.0.5:
1911319105
debug "^4.3.4"
1911419106
socks "^2.8.3"
1911519107

19116-
socks@2.7.3, socks@^2.6.2, socks@^2.8.3:
19117-
version "2.7.3"
19118-
resolved "https://registry.npmjs.org/socks/-/socks-2.7.3.tgz#7d8a75d7ce845c0a96f710917174dba0d543a785"
19119-
integrity sha512-vfuYK48HXCTFD03G/1/zkIls3Ebr2YNa4qU9gHDZdblHLiqhJrJGkY3+0Nx0JpN9qBhJbVObc1CNciT1bIZJxw==
19108+
socks@2.8.9, socks@^2.6.2, socks@^2.8.3:
19109+
version "2.8.9"
19110+
resolved "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz#aa5f130ca0f88a43fa44faf4869c50d22aa27752"
19111+
integrity sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==
1912019112
dependencies:
19121-
ip-address "^9.0.5"
19113+
ip-address "^10.1.1"
1912219114
smart-buffer "^4.2.0"
1912319115

1912419116
sodium-native@^3.3.0:
@@ -19274,11 +19266,6 @@ split@^1.0.1:
1927419266
dependencies:
1927519267
through "2"
1927619268

19277-
sprintf-js@^1.1.3:
19278-
version "1.1.3"
19279-
resolved "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz"
19280-
integrity sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==
19281-
1928219269
sprintf-js@~1.0.2:
1928319270
version "1.0.3"
1928419271
resolved "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz"

0 commit comments

Comments
 (0)