fix(security): address all dependabot security advisories#483
Merged
mattaereal merged 1 commit intosecurity-alliance:developfrom May 7, 2026
Conversation
Apply pnpm overrides to bump vulnerable transitive dependencies: - lodash-es >=4.18.1 (GHSA-xxjr-mmjv-4gpg, GHSA-r5fr-rjxr-66jc, GHSA-f23m-r3pf-42rh) - yaml >=2.8.4 (GHSA-48c2-rrv3-qjmp) - fast-xml-parser >=5.7.0 (GHSA-gh4j-gqv2-49f6) - hono >=4.12.18 (GHSA-9vqf-7f2p-gf9v, GHSA-69xw-7hcm-h432) pnpm audit returns clean after lockfile regenerate.
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
mattaereal
added a commit
that referenced
this pull request
May 8, 2026
* content(opsec): endpoint security tiers and DPRK liveness verification (#400) * content(opsec): endpoint security tiers and DPRK liveness verification - Add endpoint security device provisioning tiers (managed, VDI, enterprise browser) - Add deepfake liveness verification techniques to DPRK TTP page - Add andrew-chang-gu to contributors.json (username TBD) Co-authored-by: DicksonWu654 <dickson@certik.com> Co-authored-by: andrew-chang-gu <> * chore: fill andrew-chang-gu contributor fields from public LinkedIn profile * Add contributor Andrew Chang-Gu to contributors.json Added new contributor Andrew Chang-Gu with details. --------- Co-authored-by: DicksonWu654 <dickson@certik.com> Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> * Add password manager endpoint hardening guide (#419) * Add password manager endpoint hardening guide * Tone down password manager hardening guide * Shorten password manager hardening guide * Make wallet secret storage guidance explicit * Remove decorative separators from password manager hardening guide * Fix lint in password manager endpoint guide * Tighten password manager endpoint guide * Shorten password manager endpoint guide * Clarify password manager endpoint guidance * Add password manager endpoint hardening guide * Tone down password manager hardening guide * Shorten password manager hardening guide * Make wallet secret storage guidance explicit * Remove decorative separators from password manager hardening guide * Fix lint in password manager endpoint guide * Tighten password manager endpoint guide * Shorten password manager endpoint guide * Clarify password manager endpoint guidance * Expand password manager hardening scope * Revert "Expand password manager hardening scope" This reverts commit 4bf04d6. * docs: tighten password manager browser guidance --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> * Add YubiKey and hardware security key guide (#416) * Add hardware security key guide * Credit Opsek authors on YubiKey guide * Remove decorative separators from hardware security keys guide * Fix lint in hardware security keys guide * Tighten hardware security keys guide * Move hardware security keys guide to endpoint security * Tighten hardware keys guide metadata * Update hardware-security-keys.mdx * Update hardware-security-keys.mdx * Add hardware security key guide * Credit Opsek authors on YubiKey guide * Remove decorative separators from hardware security keys guide * Fix lint in hardware security keys guide * Tighten hardware security keys guide * Move hardware security keys guide to endpoint security * Tighten hardware keys guide metadata * Add YubiKey-specific setup guidance * docs: tighten hardware key setup guidance * Delete AGENTS.md --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> * Chore: add stewards for AI Security and Incident Management fws (#440) * Add stewards for Incident Management and AI Security fws * sync contributors company * Add SSH client and key management hardening guide (#420) * Add SSH client and key management hardening guide * Remove decorative separators from SSH hardening guide * Fix markdownlint spacing in SSH hardening guide * Tighten SSH hardening guide * Shorten SSH hardening guide * Clarify SSH hardening guidance * Introduce SSH certificates for better key management Added a section on using SSH certificates for improved access management. * Clarify SSH host verification guidance * Fix SSH guide markdown formatting * Finish SSH guide review fixes * Add SSH client and key management hardening guide * Remove decorative separators from SSH hardening guide * Fix markdownlint spacing in SSH hardening guide * Tighten SSH hardening guide * Shorten SSH hardening guide * Clarify SSH hardening guidance * Introduce SSH certificates for better key management Added a section on using SSH certificates for improved access management. * Clarify SSH host verification guidance * Fix SSH guide markdown formatting * Finish SSH guide review fixes * Trim unrelated SSH wordlist entries * Update wordlist.txt * Add reviewers to SSH client hardening guide --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> * feat/github workflow to upload images to S3 bucket (#290) * add github workflow to autmatically upload images to S3 * implement review + deps revamp * Reorganize AWS credentials configuration in workflow * Add --ignore-scripts to install step for supply chain attack mitigation --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> * Feature/opsec/mfa (#452) * Added MFA overview, and updated contributors file. * Build fix and language updates. * Refine MFA overview and recommendations Revised language for clarity and emphasis on MFA importance. Updated recommendations for MFA methods and highlighted security considerations for passkeys. * Further clarification about passkey storage. --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> * docs: add CC BY-SA 4.0 licensing notice and metadata (#447) Co-authored-by: frameworks-volunteer <jamesbond777bot@duck.com> * Feedback integration certs (#459) * Port cert revisions and add SFC Identity & Accounts Mirrors the revisions applied in the SEAL-Certs-Template repo (see its CHANGELOG.md for full detail). Summary: - sfc-multisig-ops: ms-2.1.2 strengthened from "evaluate" to "implement"; ms-4.1.1 transaction process consolidated 8 to 5 bullets - sfc-treasury-ops: scope note added; per-actor/per-path exposure limits (tro-2.1.3) and privileged access / root account management (tro-3.1.5) added; trusted-parser bullet on tro-4.1.1; various consolidations and softening (session timeouts, impact thresholds, exposure limits) - sfc-devops-infrastructure: di-1.1.4 split into process + di-1.1.5 list; runner hardening on di-3.1.1; network architecture on di-4.1.1; supply chain mention softened; References section added - sfc-dns-registrar: dns-3.1.1 slimmed to reference the new Identity & Accounts cert for account management - sfc-incident-response: four IR controls consolidated (team roles, contacts, alerting, drills); header reference to Identity & Accounts - sfc-identity-accounts (NEW): horizontal cert covering organizational account management (inventory, phishing-resistant MFA, credential management, recovery methods, lifecycle, takeover monitoring, third- party access) Control IDs are stable; no renames. Baseline text changes do not affect workbook import (keyed on control ID). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Retire SFC Workspace Security; wire in Identity & Accounts The old Workspace Security cert drifted far from SEAL's SME (device management, EDR/MDM, physical/travel security, formal training programs). Its crypto-relevant content (account inventory, phishing-resistant MFA, credential management, account lifecycle, takeover monitoring) is now in the new horizontal Identity & Accounts cert. Generic enterprise IT coverage is better left to ISO 27001 / SOC 2 / CIS. - Delete docs/pages/certs/sfc-workspace-security.mdx - vocs.config.tsx: sidebar updated (add Identity & Accounts, remove Workspace Security) - utils/generate-cert-data.js: CERT_ORDER updated so the overview-page "Export All Certifications" xlsx includes I&A and excludes Workspace - utils/generate-printable-checklists.js: CERT_META updated so the Print button generates an I&A checklist and no longer generates one for Workspace - components/certified-protocols/CertifiedProtocols.tsx: certTypeToName map updated (sfc-ida replaces sfc-ws) - docs/pages/certs/overview.mdx: cert list updated - docs/pages/certs/index.mdx: cert list updated - docs/pages/intro/overview-of-each-framework.mdx: cert list updated The fetched-tags.json and cert-data.json artifacts regenerate at build time. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Surface control IDs in the control card UI Control IDs (e.g., ms-2.1.2) are already in the data model and used by workbook import/export and aria attributes, but were invisible in the rendered card. Surface them inline next to the title so readers and reviewers have a stable reference they can cite. - ControlCard.tsx: render {control.id} before the title with a muted separator - control.css: .control-id styled muted, monospace, 0.875em; .control-id-sep muted, non-bold No behavioral change; purely additive display. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add per-cert version stamps and central changelog Protocols that have certified against an earlier version of a cert need to scope the delta when that cert is revised. Adds explicit versioning so re-certification decisions are data-driven. - Per-cert frontmatter fields: version (semver-ish) and revised (ISO date). Rendered inline near the H1 title: "Revision X.Y · Updated YYYY-MM-DD · Changelog". - New page: docs/pages/certs/changelog.mdx aggregating revision history across all certs with inaugural 2026-04-17 entry covering the feedback-integration-1.1 changes. - vocs.config.tsx: Changelog added to sidebar under SEAL Certifications. All five existing certs stamped at v1.1 (revised 2026-04-17). New Identity & Accounts cert stamped at v1.0. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Regenerate build artifacts - docs/pages/certs/index.mdx: generate-folder-indexes added Changelog row - utils/fetched-tags.json: tags-fetcher regenerated tag map (added /certs/changelog entry; workspace-security replaced by identity-accounts; sectionMappings sort order shuffled) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add ir-2.1.1 threat model to Incident Response Monitoring coverage is only meaningful if it's pointed at the right things. The existing IR cert had team structure, contacts, monitoring, alerting, and playbooks, but no control requiring an explicit threat picture of protocol operations and external dependencies. This control closes that gap and anchors the monitoring and playbook controls to a known threat model. - Insert new ir-2.1.1 (Threat Model for Protocol Operations) at the start of Section 2 (Monitoring, Detection & Alerting) - Existing Section 2 controls shifted: old ir-2.1.1 to ir-2.1.2, ir-2.1.2 to ir-2.1.3, ir-2.1.3 to ir-2.1.4 - Evidence Tracker count 13 to 14 (template repo only) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Rewrite certs overview to align with program roadmap The previous overview was written during RFC Phase (ended Dec 31, 2025) and framed certifications as "proposed" and "being developed." The framework is now stable, published, and moving into active certification with accredited firms. Rewritten to: - Open with the same framing as the internal program-and-roadmap doc: code audits don't catch operational failures, certifications target that gap - List the six modules (with the new Identity & Accounts and Incident Response updated to include threat modeling) - Condense "How Certification Works" into a five-step engagement flow with EAS attestation - Replace the RFC Phase section with a plain Program Status summary of where the program is now - Trim outdated FAQ items (the "Q1 2026 rollout" question) and update wording throughout - Link to the new /certs/changelog page for revision history Shorter overall; aligned with the roadmap doc without duplicating its operational detail. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add back protocol and auditor signup links to certs overview Previous rewrite dropped these along with the RFC Phase framing. Adding them back as a tight "Get Involved" section between Program Status and FAQ. Both entry points currently point at the same typeform (securityalliance.typeform.com/CertsAuditor), matching the original overview page. If protocols and auditors need distinct intake forms later, the URL can be updated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Integrate PR feedback from template repo review Mirrors template-repo commits acddf5c, 2d3a777, 5ae8d0f which applied DicksonWu654's review feedback. Since v1.1 hasn't shipped yet, the changelog entry for v1.1 is updated to reflect final state rather than documenting an intra-PR iteration. - sfc-devops-infrastructure: di-1.1.2 drops the supply-chain parenthetical (Section 2 already handles supply chain); di-1.1.4 and di-1.1.5 merged back into a single di-1.1.4 covering both the tool approval process and the approved-tools list; References section at the bottom removed (other certs don't carry References, so the inconsistency wasn't earning its keep) - sfc-identity-accounts: ida-2.1.1 drops the "(subject to SIM-swap and interception)" parenthetical; ida-4.1.1 drops the inline "(coordinated with SFC - Incident Response monitoring)" parenthetical (the trailing IR coordination bullet still carries that point); "Related certs" list in the page body removed (cross-refs live inline in each vertical cert) - sfc-incident-response: ir-2.1.1 threat model gains a baseline bullet on identifying single points of failure and highly centralized components across onchain and offchain layers (cross-chain messaging providers, oracle providers, critical infrastructure dependencies) - changelog.mdx: v1.1 entry updated to reflect final merged state; DevOps control count is now unchanged at 16, workbook compat note flags the shifted IR Section 2 IDs Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Fix protocol signup typeform URL to CertsWaitlist Both the protocol and auditor signup links in the certs overview were pointing at the same auditor form (CertsAuditor). Protocols should land on the waitlist form (CertsWaitlist) instead. Per PR #459 review comment from DicksonWu654. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Refreshing stewardship page (#460) * Add footer component to add the license in all the pages (#458) * making the contributors display more compact to favor UX + sync domains alphabetical order in fetched tags (#441) * Add Attack Surface Overview page (#435) * Add Attack Surface Overview page with interactive radial threat map Visual security posture dashboard showing 12 attack vectors as a radial diagram. Nodes are color-coded (red/amber/green) by posture state with click-to-toggle and localStorage persistence. Clicking a node opens a detail card with description, attack tags, and framework guide links. Designed for CSOs to quickly assess and communicate security gaps. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Mark Attack Surface Overview as dev content Adds dev: true flag to sidebar entry per contributing guidelines. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Replace selection ring with scale + glow effect on selected nodes Selected nodes now scale up 10% and show a soft color-matched glow instead of a detached ring outline. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add GitHub Actions reminder for attack surface threat data changes Posts an automated PR comment when threatData.ts is modified, reminding contributors to include all required fields and verify framework links. Follows the same pattern as the existing vocs-config-reminder workflow. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address Sara first PR feedback item Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address Sara second PR feedback item Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Smooth-scroll detail card into view when a threat node is clicked Clicking a node on the radial map showed the detail card below the map, but on typical viewports the card landed below the fold, so it wasn't obvious anything had happened. Use scrollIntoView with block: "nearest" on the card when it mounts or the selected vector changes, respecting prefers-reduced-motion. Third PR feedback item addressed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Move attack-surface.mdx into intro/ folder and update links Moved the page to sit alongside the other Introduction pages. Updated sidebar link, internal cross-link in how-to-navigate, and component import path to match the new location. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use react-router Link for framework CTA to avoid full page reload The detail card's framework link used a plain <a> tag which caused a full page reload. Switched to react-router-dom's <Link> for client-side navigation, consistent with the rest of the site. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add standard page components to Attack Surface Overview Adds TagProvider, TagFilter, TagList, and ContributeFooter to match the pattern used by all other Introduction pages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * content: clarify phishing awareness guidance on account claims and channel scope (#445) Clarify that profile labels and platform status indicators are not proof of legitimacy, and state that unsupported platforms should be explicitly identified. * bump dependencies after security alerts (#453) * Add TxScope — Solana multisig pre-signing threat scanner (#444) Adds TxScope to monitoring tools and wallet security tools pages. TxScope is a Solana-native pre-signing transaction threat scanner for Squads Protocol multisigs, filling the non-EVM tooling gap noted in the current tools page. Co-authored-by: black <bob@bobby.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * [codex] Clarify hot vs cold wallet taxonomy (#449) * Clarify hot vs cold wallet taxonomy * Narrow hot vs cold wallet edits --------- Co-authored-by: welttowelt <welttowelt@users.noreply.github.com> * Frontend Web app FW: Add third party script security page (#454) * Add third party script security page in the frontend web app fw * fix Further Reading link * Fix links in web3-supply-chain-threats.mdx * Chore: weekly repo cleanup (#455) * weekly cleanup: - sync badges - fix outputs spellchecker - fix outputs linter - sync contributing files - sync tags * Cleanup of the latest PR merged * sync contributor badges with latest PRs * Fix indentation * feat: add forensic readiness page (#457) * feat: add forensic readiness page (closes #433) * fix: add forensic readiness to sidebar in vocs.config.tsx (refs #457) * chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#425) Bumps the npm_and_yarn group with 2 updates in the / directory: [dompurify](https://github.com/cure53/DOMPurify) and [flatted](https://github.com/WebReflection/flatted). Updates `dompurify` from 3.3.0 to 3.3.3 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.0...3.3.3) Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.3.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> * fix: expand DevSecOps incomplete categories (closes #439) (#461) - code-signing.mdx: Add GPG key generation, subkeys, YubiKey setup, passphrase management, key backup/recovery - continuous-integration-continuous-deployment.mdx: Add SLSA provenance, SBOM generation, OIDC federation for cloud access - repository-hardening.mdx: Add CODEOWNERS patterns, GitHub Advanced Security (CodeQL, secret scanning, dependency review), security policy template - security-testing.mdx: Add severity thresholds table, Semgrep custom rules, false positive management, coverage and mutation testing * fix: remediate PR #461 attribution and review findings (#462) - Update contributors frontmatter: mattaereal as author, scode2277 as reviewer - Replace discontinued keys.mailvelope.com with keyserver.ubuntu.com - Fix CISA link text to match URL (Software Bill of Materials) - Update expired nosemgrep example date to 2027-06-01 - Add note about simplified Semgrep rule example * fix: include hidden files in preview build artifact (closes #469) (#471) The search index lives in docs/dist/.vocs/ (a hidden directory). actions/upload-artifact@v4 excludes hidden files by default, so the .vocs directory was missing from the uploaded artifact. This caused the search index to be absent from preview deployments, breaking the native search (/) on all preview URLs. Adding include-hidden-files: true ensures the .vocs directory (and any other hidden assets) are included in the artifact. * Chore: LLMs generator (#463) * feat: add llms.txt generator + llms-{framework}.txt for all the frameworks we have + changed titles to 2 pages as previously confusing * Add branch-aware links + better hadle of contributing folder * fix: making the generator inherit dev:true from parent sidebar blocks * refactor: restructure llms output with per-page files, folder layout, and tighter routing index * fix: make branch check stronger * fix: add Web3-specific standards (AADAPT, SCWE, EthTrust, SC Top 10) to Integration (closes #176) (#475) * fix: expand VPN services page with HTTPS vs VPN, metadata, threat models (#473) * fix: expand VPN services page with HTTPS vs VPN, metadata, threat models (closes #406) * Update docs/pages/privacy/vpn-services.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * refactor: split VPN services into subcategory pages per review feedback Restructure vpn-services.mdx into a vpns/ directory with sub-pages: - overview.mdx: entrance page with intro and links to subsections - https-vs-vpn.mdx: HTTPS vs VPN comparison and metadata gap - attack-surfaces-public-networks.mdx: public Wi-Fi risks - when-to-use-vpn.mdx: threat model decision framework + choosing a VPN - vpn-limitations.mdx: VPN limitations and DNS leaks - vpn-providers-and-tools.mdx: recommended providers, tools, and resources Update vocs.config.tsx with nested sidebar structure for VPN Services. All new pages include outline: deep for subsection navigation. --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> Co-authored-by: Sara Russo <sararusso984@gmail.com> * chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates (#464) Bumps the npm_and_yarn group with 3 updates in the / directory: [axios](https://github.com/axios/axios), [dompurify](https://github.com/cure53/DOMPurify) and [hono](https://github.com/honojs/hono). Updates `axios` from 1.14.0 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.14.0...v1.15.0) Updates `dompurify` from 3.3.3 to 3.4.1 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.1) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `hono` from 4.12.12 to 4.12.14 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.12...v4.12.14) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.14 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Weekly repo cleanup: (#465) sync badges sync indexes sync tags fix spellchecker outputs fix linter outputs Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> * feat(devsecops): Governance Proposal Security Across the SDLC (#467) Extract §4 (Upgrade Governance) out of data-security-upgrade-checklist into a standalone DevSecOps page focused on smart-contract upgrade governance across the full proposal lifecycle. Add an interactive hero graphic mapping threats onto a 4-stage SDLC, replace raw-markdown checklists with a stateful ChecklistItem component, and extend the content with material that consistently fails in practice but rarely appears on upgrade checklists: invariant suites that run against live mainnet state, and reproducible onchain calldata verified by CI. Page: /devsecops/governance-proposal-security Stages: Plan -> Build and Test -> Review & Audit -> Propose, Verify Onchain Calldata & Monitor New components: - <GovernanceSDLCPipeline /> - SVG pipeline with threat constellations, click-to-expand detail panel, keyboard nav, loop-back "feeds next cycle" arrow. Reuses categoryMeta from attack-surface for visual consistency. Stateless. - <ChecklistItem title="..."> ... </ChecklistItem> - interactive labelled checkbox with localStorage-persisted state and aria-describedby. Replaces every raw markdown "- [ ]" item on the new page. Migrations: - docs/pages/devsecops/data-security-upgrade-checklist.mdx - section 4 removed; page renamed to "Data Security Checklist" (URL preserved). - docs/pages/devsecops/overview.mdx - dropped duplicate "What's inside DevSecOps" section; Contents list is the single entry point (8 entries including the new page and Isolation & Sandboxing). - vocs.config.tsx - sidebar entry added and old Data Security entry renamed. - components/index.ts - exports the two new components. Notable content: - Stage 2: tests must exercise the actual deployment script, and fork-tests must execute the proposal's calldata at HEAD before running the integration + invariant suite. - Stage 3: internal peer review of the proposal by a non-author reviewer; audit scope extends to deploy scripts and proposal payloads. - Stage 4: reproducible calldata built locally + rebuilt in CI, compared byte-for-byte against what's onchain. - Real-World Proposal Failures: Wormhole (Feb 2022), Nomad (Aug 2022), Compound cETH Proposal 117 (Aug 2022), Yearn Finance yUSDT (Apr 2023) - each framed around a specific SDLC failure mode. Contributors: - wrote: quillaudits, dickson, ElliotFriedman - fact-checked: mattaereal Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> * chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates (#477) Bumps the npm_and_yarn group with 3 updates in the / directory: [axios](https://github.com/axios/axios), [uuid](https://github.com/uuidjs/uuid) and [postcss](https://github.com/postcss/postcss). Updates `axios` from 1.15.0 to 1.15.2 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.15.0...v1.15.2) Updates `uuid` from 13.0.0 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v13.0.0...v14.0.0) Updates `postcss` from 8.5.6 to 8.5.14 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.14) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.14 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(opsec): add early-stage standards section with CCSS, remove unlinkable cross-chain placeholder (#480) * docs(devsecops): expand IDE extension verification guidance (#466) Item 1 of the IDE hardening list previously said "trusted sources" without defining what verification looks like. Expand it into a short multi-channel check (publisher match, source-repo cross-reference, install counts / verified-publisher badges / signed releases) and add a one-line threat-model hook explaining why extensions are a high-yield target. Also adds a contributors frontmatter acknowledging historical authors (mattaereal, fredriksvantes) alongside the new contribution. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: normalize ContributeFooter route before GitHub link (#446) * fix: normalize footer contribute path for trailing slash routes * refactor: simplify contribute path normalization * docs(agents): align AGENTS.md with docs/CONTRIBUTING conventions (#470) * AGENTS.md initial commit. * Updates for consistency * Update AGENTS.md Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update AGENTS.md Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update AGENTS.md Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update AGENTS.md Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update AGENTS.md regarding contributors Co-authored-by: Sara Russo <sararusso984@gmail.com> --------- Co-authored-by: Sara Russo <sararusso984@gmail.com> * weekly repo cleanup: (#482) - fixed linter outputs - fixed spellchecker outputs - synced badges - synced tags - synced indexes * fix(security): address all dependabot security advisories (#483) Apply pnpm overrides to bump vulnerable transitive dependencies: - lodash-es >=4.18.1 (GHSA-xxjr-mmjv-4gpg, GHSA-r5fr-rjxr-66jc, GHSA-f23m-r3pf-42rh) - yaml >=2.8.4 (GHSA-48c2-rrv3-qjmp) - fast-xml-parser >=5.7.0 (GHSA-gh4j-gqv2-49f6) - hono >=4.12.18 (GHSA-9vqf-7f2p-gf9v, GHSA-69xw-7hcm-h432) pnpm audit returns clean after lockfile regenerate. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: artemisclaw82 <artemisclaw82@gmail.com> Co-authored-by: DicksonWu654 <dickson@certik.com> Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> Co-authored-by: Dickson Wu <33645481+DicksonWu654@users.noreply.github.com> Co-authored-by: Seth Hallem <seth@certora.com> Co-authored-by: frameworks-volunteer <jamesbond777bot@duck.com> Co-authored-by: Isaac Patka <ipatka@gmail.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Elliot <34463580+ElliotFriedman@users.noreply.github.com> Co-authored-by: Tim Sh <tim.sha256@gmail.com> Co-authored-by: txscope-sol <hello@txscope.com> Co-authored-by: black <bob@bobby.com> Co-authored-by: odin free <58338510+welttowelt@users.noreply.github.com> Co-authored-by: welttowelt <welttowelt@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sawit Trisirisatayawong <12265853+tansawit@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Apply pnpm overrides to bump vulnerable transitive dependencies to patched versions.
Vulnerabilities fixed
Verification