From 3603cd096434fe2bba60197ca8404501bd2cd9df Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Tue, 4 Aug 2026 11:49:06 -0400 Subject: [PATCH] fix(deps): clear 4 HIGH osv advisories blocking beta publish MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Publish @bitgo-beta workflow has failed since 2026-08-03 on the osv-severity-gate: 4 of 41 advisory groups scored at or above CVSS 7.0. All four advisories were published 2026-08-03 and all have upstream fixes, so no osv-scanner.toml exclusion is warranted. - brace-expansion 5.0.8 -> 5.0.9 (GHSA-rgw5-rvv9-x895, CVSS 7.5) - fast-uri 3.1.3 -> 3.1.5 (GHSA-7p8r-x3mc-p8w7, CVSS 7.5) - socket.io-parser -> 4.2.7 (GHSA-2m8v-j782-fhvr, CVSS 7.5) - ip-address -> 10.4.0 (GHSA-mwp4-54f8-5fhr, CVSS 7.7) - socks 2.7.3 -> 2.8.9 (carries the ip-address bump) fast-uri stays on the 3.x line rather than moving to 4.1.2: the only consumer is ajv@^8, which declares fast-uri@^3.0.1, and 3.1.5 clears the advisory inside that declared range. Upstream still maintains 3.x under the 'three' dist-tag. ip-address has no 9.x fix, so clearing GHSA-mwp4-54f8-5fhr needs a major bump. Its only consumer is socks, which moved to ip-address@^10.x in 2.8.7, so socks is raised to 2.8.9 rather than forcing 10.x underneath the old 2.7.3 pin. After this the lock holds a single ip-address@^10.1.1 spec, satisfied by 10.4.0 — no semver-major override remains. The 2.7.3 pin was itself a security floor (WP-1413, "locked socks version to fix vulnerability"), so raising it preserves that intent; 2.8.9 carries no advisories. It also repairs a range violation: socks-proxy-agent@^8 declares socks@^2.8.3, which 2.7.3 never satisfied. The explicit ip-address pin stays even though socks now declares ^10.1.1, because that range still permits the vulnerable 10.1.x/10.2.x releases for npm consumers resolving from overrides. Verified in the installed tree on socks 2.8.9 + ip-address 10.4.0: Address4/Address6 constructors, Address6.fromByteArray().canonicalForm(), helpers ipToBuffer / ipv4ToInt32 / int32ToIpv4 / validateSocksClientOptions, SocksClient.createConnection presence, and SocksProxyAgent construction. socks-proxy-agent 7.0.0 (^2.6.2) and 8.0.5 (^2.8.3) both resolve against 2.8.9. resolutions and overrides are updated together; npm consumers of the bitgo umbrella package only see overrides. Ticket: WCN-1798 --- package.json | 18 ++++++++++------- yarn.lock | 55 ++++++++++++++++++++-------------------------------- 2 files changed, 32 insertions(+), 41 deletions(-) diff --git a/package.json b/package.json index 1711dcddd3..5ea078b04b 100644 --- a/package.json +++ b/package.json @@ -96,7 +96,7 @@ "json5": "^2.2.2", "ua-parser-js": ">0.7.30 <0.8.0", "secp256k1": "5.0.1", - "socks": "2.7.3", + "socks": "2.8.9", "web3-utils": "4.2.1", "@polkadot/api": "14.1.1", "@polkadot/util": "13.5.6", @@ -124,13 +124,13 @@ "**/iota-sdk/**/valibot": "1.2.0", "**/tronweb/**/validator": "13.15.23", "@isaacs/brace-expansion": "5.0.1", - "brace-expansion": "5.0.8", + "brace-expansion": "5.0.9", "nx": "22.7.7", "basic-ftp": "5.3.1", "flatted": "3.4.2", "sjcl": "npm:@bitgo/sjcl@1.0.1", "picomatch": ">=2.3.2", - "fast-uri": "3.1.3", + "fast-uri": "3.1.5", "postcss": "8.5.18", "@babel/plugin-transform-modules-systemjs": "7.29.4", "protobufjs": "7.6.4", @@ -151,7 +151,9 @@ "sigstore": "4.1.1", "**/bn.js": "5.2.3", "uuid": "11.1.1", - "js-yaml": "4.3.0" + "js-yaml": "4.3.0", + "ip-address": "10.4.0", + "socket.io-parser": "4.2.7" }, "overrides": { "qs": "6.15.2", @@ -181,7 +183,7 @@ "json5": "^2.2.2", "ua-parser-js": ">0.7.30 <0.8.0", "secp256k1": "5.0.1", - "socks": "2.7.3", + "socks": "2.8.9", "web3-utils": "4.2.1", "@polkadot/api": "14.1.1", "@polkadot/util": "13.5.6", @@ -199,13 +201,13 @@ "webpack-dev-server": "5.2.1", "memfs": "4.46.0", "@isaacs/brace-expansion": "5.0.1", - "brace-expansion": "5.0.8", + "brace-expansion": "5.0.9", "nx": "22.7.7", "basic-ftp": "5.3.1", "flatted": "3.4.2", "sjcl": "npm:@bitgo/sjcl@1.0.1", "picomatch": ">=2.3.2", - "fast-uri": "3.1.3", + "fast-uri": "3.1.5", "postcss": "8.5.18", "@babel/plugin-transform-modules-systemjs": "7.29.4", "protobufjs": "7.6.4", @@ -215,6 +217,8 @@ "bn.js": "5.2.3", "uuid": "11.1.1", "js-yaml": "4.3.0", + "ip-address": "10.4.0", + "socket.io-parser": "4.2.7", "cliui": { "strip-ansi": "6.0.1", "string-width": "4.2.3" diff --git a/yarn.lock b/yarn.lock index d6b8955a57..fc843be62e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8107,10 +8107,10 @@ borsh@^0.7.0: bs58 "^4.0.0" text-encoding-utf-8 "^1.0.2" -brace-expansion@5.0.6, brace-expansion@5.0.8, brace-expansion@^1.1.7, brace-expansion@^2.0.1, brace-expansion@^5.0.5: - version "5.0.8" - resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz#135ad0d8d808eb18eb5e0ec9a21f3a0b92ef18cf" - integrity sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg== +brace-expansion@5.0.6, brace-expansion@5.0.9, brace-expansion@^1.1.7, brace-expansion@^2.0.1, brace-expansion@^5.0.5: + version "5.0.9" + resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz#7c72438809b5fa5babf54199a1f1c281a6984fcf" + integrity sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg== dependencies: balanced-match "^4.0.2" @@ -11588,10 +11588,10 @@ fast-text-encoding@^1.0.6: resolved "https://registry.npmjs.org/fast-text-encoding/-/fast-text-encoding-1.0.6.tgz" integrity sha512-VhXlQgj9ioXCqGstD37E/HBeqEGV/qOD/kmbVG8h5xKBYvM1L3lR1Zn4555cQ8GkYbJa8aJSipLPndE1k6zK2w== -fast-uri@3.1.3, fast-uri@^3.0.1: - version "3.1.3" - resolved "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz#f695a40f006aba505631573a0021ddb21194ad11" - integrity sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg== +fast-uri@3.1.5, fast-uri@^3.0.1: + version "3.1.5" + resolved "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz#610f37419a030270430cecd68d74e3d4d96725d0" + integrity sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw== fastest-levenshtein@^1.0.12: version "1.0.16" @@ -13161,13 +13161,10 @@ iobuffer@^5.3.2: resolved "https://registry.npmjs.org/iobuffer/-/iobuffer-5.4.0.tgz" integrity sha512-DRebOWuqDvxunfkNJAlc3IzWIPD5xVxwUNbHr7xKB8E6aLJxIPfNX3CoMJghcFjpv6RWQsrcJbghtEwSPoJqMA== -ip-address@^9.0.5: - version "9.0.5" - resolved "https://registry.npmjs.org/ip-address/-/ip-address-9.0.5.tgz" - integrity sha512-zHtQzGojZXTwZTHQqra+ETKd4Sn3vgi7uBmlPoXVWZqYvuKmtI0l/VZTjqGmJY9x88GGOaZ9+G9ES8hC4T4X8g== - dependencies: - jsbn "1.1.0" - sprintf-js "^1.1.3" +ip-address@10.4.0, ip-address@^10.1.1: + version "10.4.0" + resolved "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz#c5910bc541b6eae287765d1e4846be0308a05d93" + integrity sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ== ipaddr.js@1.9.1: version "1.9.1" @@ -13893,11 +13890,6 @@ js-yaml@4.1.0, js-yaml@4.3.0, js-yaml@^3.13.1, js-yaml@^3.14.1, js-yaml@^4.1.0: dependencies: argparse "^2.0.1" -jsbn@1.1.0: - version "1.1.0" - resolved "https://registry.npmjs.org/jsbn/-/jsbn-1.1.0.tgz" - integrity sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A== - jsbn@~0.1.0: version "0.1.1" resolved "https://registry.npmjs.org/jsbn/-/jsbn-0.1.1.tgz" @@ -19065,10 +19057,10 @@ socket.io-adapter@~2.5.2: debug "~4.3.4" ws "~8.17.1" -socket.io-parser@~4.2.4: - version "4.2.6" - resolved "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz#19156bf179af3931abd05260cfb1491822578a6f" - integrity sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg== +socket.io-parser@4.2.7, socket.io-parser@~4.2.4: + version "4.2.7" + resolved "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.7.tgz#679e51fe24d1c81df90fc5f7efe4a5f432fe99c0" + integrity sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg== dependencies: "@socket.io/component-emitter" "~3.1.0" debug "~4.4.1" @@ -19113,12 +19105,12 @@ socks-proxy-agent@^8.0.2, socks-proxy-agent@^8.0.3, socks-proxy-agent@^8.0.5: debug "^4.3.4" socks "^2.8.3" -socks@2.7.3, socks@^2.6.2, socks@^2.8.3: - version "2.7.3" - resolved "https://registry.npmjs.org/socks/-/socks-2.7.3.tgz#7d8a75d7ce845c0a96f710917174dba0d543a785" - integrity sha512-vfuYK48HXCTFD03G/1/zkIls3Ebr2YNa4qU9gHDZdblHLiqhJrJGkY3+0Nx0JpN9qBhJbVObc1CNciT1bIZJxw== +socks@2.8.9, socks@^2.6.2, socks@^2.8.3: + version "2.8.9" + resolved "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz#aa5f130ca0f88a43fa44faf4869c50d22aa27752" + integrity sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw== dependencies: - ip-address "^9.0.5" + ip-address "^10.1.1" smart-buffer "^4.2.0" sodium-native@^3.3.0: @@ -19274,11 +19266,6 @@ split@^1.0.1: dependencies: through "2" -sprintf-js@^1.1.3: - version "1.1.3" - resolved "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz" - integrity sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA== - sprintf-js@~1.0.2: version "1.0.3" resolved "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz"