v0.12.243 — bigint-buffer is out of the tree

Clears the last high-severity dependency alert. npm audit on this repo goes from 4 high / 17 low to 0 high / 17 low.

Security — bigint-buffer is gone

bigint-buffer's native toBigIntLE() carries an unpatched buffer overflow (GHSA-3gc7-fjrx-p6mg). There is no fixed release anywhere: 1.1.5 is the last publish, from 2019, and @trufflesuite/bigint-buffer@1.1.10 ships a byte-identical src/bigint-buffer.c — a prebuild fork, not a security fork. Overriding onto it would have laundered the advisory without fixing anything, which is why that was never done here.

It reached us four levels down:

@blockrun/llm → @solana/spl-token → @solana/buffer-layout-utils → bigint-buffer

ClawRouter never executes that path. We import the EVM createPaymentPayload, not createSolanaPaymentPayload, and Solana payments go through @x402/svm. It landed in every consumer's lockfile anyway, because @solana/spl-token was an optional dependency of @blockrun/llm and npm installs those automatically.

Fixed upstream in @blockrun/llm@3.10.0: the Solana packages became optional peer dependencies, which npm does not auto-install. Consumers who make Solana payments through that SDK install @solana/web3.js and @solana/spl-token explicitly and get an error naming the install command if they forget.

Here, the floor moves to @blockrun/llm@^3.10.0 and the lockfile is regenerated.

Trap worth recording

Bumping the dependency alone did not drop it. npm install @blockrun/llm@^3.10.0 updated the SDK but kept the stale transitive entry — the optional-dependency-to-optional-peer change only takes effect after a full rm -rf node_modules package-lock.json regeneration. Same class as the override staleness fixed in v0.12.240.

Verification

npm ls bigint-buffer returns empty. dist/ still contains zero references to spl-token, buffer-layout-utils, or toBigIntLE. @solana/kit re-confirmed at 5.5.1 after the regeneration (the v5-vs-v6 split is what broke Solana signing back in March). 716 tests pass; typecheck, lint, prettier, and build + dist smoke all clean.

Confirmed against the published artifact: installing @blockrun/clawrouter@0.12.243 into a clean project pulls @blockrun/llm@3.10.0 and no bigint-buffer.

Remaining

17 low from the elliptic chain under @polymarket/* (ethers v5). 6.6.1 is the latest release and is still inside the advisory's range, so there is nothing to move to.