Dependabot Fix#45
Conversation
Adds package.json `overrides` for ~35 transitive packages flagged by Dependabot. All affected packages are dev/build tooling (hardhat plugins, ganache, web3 stack); none are imported into the compiled Solidity bytecode of CPOOL or its OFT bridges, and none run in production. The overrides ensure top-level resolution to patched versions; a small number of legacy nested copies (e.g. `request/node_modules/form-data@2.3.3`, `ganache/node_modules/elliptic@6.5.4`) remain because npm overrides won't cross major versions in deep nested paths — those will be dismissed as tolerable_risk in a follow-up since the affected code never runs. Resolves the bulk of Dependabot alerts on this repo: handlebars (critical #173, high #170-#172, #174, medium #168, #167), sha.js #127, cipher-base #126, pbkdf2 #145+#121, path-to-regexp #112+#101+#176, form-data top-level #124+#123, undici #136+#118+#113+#91+#90+#164-#167, ws #95+#94, tar (#138-#163 series), minimatch (#153-#158), brace-expansion #169+#120, picomatch #182+#183, lodash #181+#180+#141, lodash.template #179+#93, elliptic top-level #114+#107+#110+#99+#98+#97+#135 (note: ganache-nested 6.5.4 unresolved), serialize-javascript #116+#159+#175, immutable #162, base-x #117, bn.js #152+#151, secp256k1 top-level #109, qs #144+#134, ajv #150, js-yaml #132, follow-redirects #184, nanoid #111, tough-cookie #69, tmp #125, yargs-parser top-level #4 (legacy nested 2.4.1 in @ensdomains/ens unresolved), diff #139, min-document #130, cookie #106, serve-static #104, send #105, express #103, body-parser #102, micromatch #100, ansi-regex #38+#36, uuid #185. Unfixable (dismiss as tolerable_risk in follow-up): - #135 elliptic risky-primitive (no patch available) - #93 lodash.template command injection (no patch — package deprecated) - #66 request SSRF (no patch — package deprecated) - #128 web3-core-subscriptions, #129 web3-core-method (no patch)
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 49 minutes and 52 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
0xlinus
changed the title
|
@dependabot rebase |
2 participants
ALL fixes introduced and details.
npm overridesplus regenerated lockfile to patch vulnerable direct and transitive packages.Details:
tmp,elliptic,secp256k1,undici,tar,minimatch,brace-expansion,picomatch,path-to-regexp,qs,express,send,serve-static,micromatch, and related transitive packages.