Skip to content

Conversation

@tom2drum
Copy link
Collaborator

@tom2drum tom2drum commented Dec 4, 2025

Description and Related Issue(s)

This PR updates multiple dependencies to newer versions to mitigate security vulnerabilities identified in the project's dependency tree. The updates include both direct dependencies and transitive dependency resolutions to ensure a more secure dependency graph.

Proposed Changes

  • Updated direct dependencies:

    • @reown/appkit: 1.7.0 → 1.7.20
    • @reown/appkit-adapter-wagmi: 1.7.0 → 1.7.20
    • swagger-ui-react: 5.28.0 → 5.30.3
    • valibot: 0.38.0 → 1.2.0
    • viem: 2.23.14 → 2.41.2
    • wagmi: 2.14.15 → 2.19.5
    • svg-icons-cli: ^0.0.5 → 0.0.8
  • Removed unused dependency: chakra-react-select

  • Added yarn resolutions for transitive dependencies to ensure consistent, secure versions across the dependency tree:

    • valibot resolutions for @lifi/widget and @lifi/wallet-management
    • ws resolution for wagmi and dappscout-iframe
    • axios, tar-fs, and node-forge resolutions for various packages
    • glob resolution for svg-icons-cli

No changes were made to environment variables.

Breaking or Incompatible Changes

None. All updates are backward-compatible within their respective major versions.

Additional Information

These updates address security vulnerabilities while maintaining compatibility with the existing codebase. The yarn resolutions ensure that transitive dependencies use secure versions, preventing potential security issues from nested dependencies.

Checklist for PR author

  • I have tested these changes locally.
  • I added tests to cover any new functionality, following this guide
  • Whenever I fix a bug, I include a regression test to ensure that the bug does not reappear silently.
  • If I have added, changed, renamed, or removed an environment variable
    • I updated the list of environment variables in the documentation
    • I made the necessary changes to the validator script according to the guide
    • I added "ENVs" label to this pull request

@tom2drum tom2drum added the dependencies Pull requests that update a dependency file label Dec 4, 2025
@tom2drum tom2drum merged commit 1a87cd2 into main Dec 4, 2025
11 checks passed
@tom2drum tom2drum deleted the tom2drum/deps-audit-fix-2 branch December 4, 2025 17:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants