chore(deps): lift the runtime crypto and utility dependencies past their advisories - #5
Merged
Merged
Conversation
…eir advisories elliptic below 6.6.1 accepts signatures it should reject, and this package verifies real signatures, so that one is the reason for the change. lodash, and both the 4.x and 5.x bn.js lines, carry their own advisories and sit in the same runtime graph that ships to consumers. Every declared range already admitted the patched version, so package.json needs no change. The lockfile is edited in place rather than regenerated. Yarn 1 renormalizes the whole file on any write, which here also dropped ten resolution specs and reformatted package.json; the four edited blocks keep the diff to what the advisories require, and a frozen install validates the integrity hashes.
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
elliptic below 6.6.1 accepts signatures it should reject (GHSA-vjh7-7g9h-fjfh, critical). This package verifies real signatures, so that is the reason for the change; five older elliptic advisories clear with it. lodash carries a high and two mediums, and both the 4.x and 5.x bn.js lines carry one each. All four are direct runtime dependencies, so they ship to consumers of the published package.
Every declared range already admitted the patched version, so package.json is unchanged and no resolutions entry was needed. Scope is the root lockfile only; the examples lockfiles are excluded from the published tarball and are untouched.
One elliptic advisory stays open by design: CVE-2025-14505 applies to every version up to and including 6.6.1, so no bump clears it.
Validation
The lockfile is edited in place rather than regenerated. Yarn 1 renormalizes the whole file on any write, and doing so here rewrote 175 lines, dropped ten resolution specs and reformatted package.json; editing the four blocks keeps the diff at 12 lines each way. Each integrity hash was checked against the registry, and yarn install --frozen-lockfile passes, which validates them independently.
The VM suite passes at 35, unchanged, with the crypto paths green: recover_key, assert_recover_key, assert_valid_rsa_sig, assert_invalid_rsa_sig, and the sha256, sha1, sha512 and ripemd160 assertions. The release-notes composer test passes 12/12 and the packaging check 8/8, both unchanged.