Update account generation to use code from 5.4.0-rc.1

[Amxx]

Upgradeable version is a bit challenging because only part of the parent contracts must be used in their upgradeable version.

Only contract that should be used from the upgradeable packages are:

draft-AccountERC7579Hooked.sol
draft-AccountERC7579HookedUpgradeable.sol
MultiSignerERC7913Upgradeable.sol
MultiSignerERC7913WeightedUpgradeable.sol
SignerECDSAUpgradeable.sol
SignerERC7913Upgradeable.sol
SignerP256Upgradeable.sol
SignerRSAUpgradeable.sol

while EIP712, and ERC7739 have an upgradeable version, they should not be used here. Using the vanila version of EIP712 so that the domain doesn't have to be initialized, and is shared accross all clones/proxies.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​nomicfoundation/​hardhat-toolbox@​5.0.0
	@​openzeppelin/​hardhat-upgrades@​3.9.0
	hardhat@​2.22.19
	@​openzeppelin/​contracts-upgradeable@​5.3.0
	@​openzeppelin/​contracts@​5.3.0

View full report

[ericglau]

Thanks for the PR. Here is a checklist of some remaining items that are needed:

• The minimum version should be updated to ^5.4.0 in packages/core/solidity/src/utils/version.ts
• Please add a changeset, mentioning that this is a potentially breaking change because it requires Contracts v5.4.0.
• An Upgradeability section should be added to the Account tab in the UI, in packages/ui/src/solidity/AccountControls.svelte
• Should the Experimental status be removed from the Account tab in the UI? If so, the following need to be updated:

  • contracts-wizard/packages/ui/src/solidity/App.svelte

    Line 247 in df1bdff

    experimentalContracts={['Stablecoin', 'RealWorldAsset', 'Account']}

  • contracts-wizard/packages/ui/src/solidity/App.svelte

    Line 261 in df1bdff

    <button class:selected={tab === 'Account'} on:click={() => (tab = 'Account')}> Account* </button>

  • contracts-wizard/packages/ui/src/solidity/AccountControls.svelte

    Lines 27 to 30 in df1bdff

    	<div class="text-sm text-gray-500">
    	<strong>* Experimental:</strong>
    	<span class="italic">Some of the following features are not audited and are subject to change</span>
    	</div>

  • The note in https://github.com/OpenZeppelin/contracts-wizard/blob/update/account-from-vanilla-5.4.0-rc/packages/core/solidity/README.md#contract-types
• Evaluate or test whether this works with Remix, downloaded Hardhat package, or downloaded Foundry package. If it should work, update the conditions in

  contracts-wizard/packages/ui/src/solidity/App.svelte

  Lines 150 to 167 in df1bdff

  	} else if (
  	opts?.kind === 'Stablecoin' ||
  	opts?.kind === 'RealWorldAsset' ||
  	opts?.kind === 'Account' ||
  	(opts?.kind === 'ERC20' && opts.crossChainBridging)
  	) {
  	return {
  	openInRemix: false,
  	downloadHardhat: false,
  	downloadFoundry: false,
  	};
  	} else {
  	return {
  	openInRemix: true,
  	downloadHardhat: true,
  	downloadFoundry: true,
  	};
  	}

• Schemas/definitions for function calling from AI assistants/MCP should be updated to allow upgradeability for Account. This includes:

  • contracts-wizard/packages/ui/api/ai-assistant/function-definitions/solidity.ts

    Lines 235 to 239 in df1bdff

    	upgradeable: {
    	type: 'boolean',
    	enum: [false],
    	description: 'Upgradeability is not yet available for features that use @openzeppelin/community-contracts',
    	},

  • packages/mcp/src/solidity/schemas.ts

[ericglau]

If upgradeable is false, none of the imports use Initializable. In that case, does this still need to disable initializers? If so, it should add the import:

Suggested change

	// Add locking constructor
	// Add locking constructor
	c.addParent({
	name: 'Initializable',
	path: '@openzeppelin/contracts/proxy/utils/Initializable.sol',
	});

[ericglau]

This condition is not possible.

[ericglau]

If this should be an error, it can throw OptionsError and the UI can catch and display it. See

contracts-wizard/packages/core/solidity/src/governor.ts

Line 198 in 4b86b07

throw new OptionsError({

and

contracts-wizard/packages/ui/src/solidity/GovernorControls.svelte

Line 90 in 4b86b07

<input bind:value={opts.proposalThreshold} placeholder="0" use:error={errors?.proposalThreshold} />

for example.

[ericglau]

These should be bumped to 5.4.0 when it is released, before merging this PR.

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click for details)
Block		[email protected] has a Critical CVE. CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL) Affected versions: < 6.6.1 Patched version: 6.6.1 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Critical CVE. CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL) Affected versions: < 6.6.1 Patched version: 6.6.1 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Critical CVE. CVE: GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos (CRITICAL) Affected versions: >= 3.0.10 < 3.1.3 Patched version: 3.1.3 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/@openzeppelin/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Critical CVE. CVE: GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys (CRITICAL) Affected versions: < 3.1.3 Patched version: 3.1.3 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/@openzeppelin/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Critical CVE. CVE: GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys (CRITICAL) Affected versions: < 3.1.3 Patched version: 3.1.3 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/@openzeppelin/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Critical CVE. CVE: GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos (CRITICAL) Affected versions: >= 3.0.10 < 3.1.3 Patched version: 3.1.3 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/@openzeppelin/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a High CVE. CVE: GHSA-jr5f-v2jv-69x6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL (HIGH) Affected versions: >= 1.0.0 < 1.8.2; < 0.30.0 Patched version: 0.30.0 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a High CVE. CVE: GHSA-jr5f-v2jv-69x6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL (HIGH) Affected versions: >= 1.0.0 < 1.8.2; < 0.30.0 Patched version: 0.30.0 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a High CVE. CVE: GHSA-xq7p-g2vc-g82p Homograph attack allows Unicode lookalike characters to bypass validation. (HIGH) Affected versions: = 5.0.0, 4.0.0; >= 5.0.0 < 5.0.1; >= 4.0.0 < 4.0.1; < 3.0.11 Patched version: 3.0.11 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a High CVE. CVE: GHSA-xq7p-g2vc-g82p Homograph attack allows Unicode lookalike characters to bypass validation. (HIGH) Affected versions: = 5.0.0, 4.0.0; >= 5.0.0 < 5.0.1; >= 4.0.0 < 4.0.1; < 3.0.11 Patched version: 3.0.11 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a High CVE. CVE: GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers (HIGH) Affected versions: >= 2.1.0 < 5.2.4; >= 6.0.0 < 6.2.3; >= 7.0.0 < 7.5.10; >= 8.0.0 < 8.17.1 Patched version: 5.2.4 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a High CVE. CVE: GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers (HIGH) Affected versions: >= 2.1.0 < 5.2.4; >= 6.0.0 < 6.2.3; >= 7.0.0 < 7.5.10; >= 8.0.0 < 8.17.1 Patched version: 5.2.4 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-pxg6-pf52-xh8x cookie accepts cookie name, path, and domain with out of bounds characters (LOW) Affected versions: < 0.7.0 Patched version: 0.7.0 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-pxg6-pf52-xh8x cookie accepts cookie name, path, and domain with out of bounds characters (LOW) Affected versions: < 0.7.0 Patched version: 0.7.0 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-49q7-c7j4-3p7m Elliptic allows BER-encoded signatures (LOW) Affected versions: >= 5.2.1 < 6.5.7 Patched version: 6.5.7 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-f7q4-pwc6-w24p Elliptic's EDDSA missing signature length check (LOW) Affected versions: >= 4.0.0 < 6.5.7 Patched version: 6.5.7 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-977x-g7h5-7qgw Elliptic's ECDSA missing check for whether leading bit of r and s is zero (LOW) Affected versions: >= 2.0.0 < 6.5.7 Patched version: 6.5.7 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-434g-2637-qmqr Elliptic's verify function omits uniqueness validation (LOW) Affected versions: < 6.5.6 Patched version: 6.5.6 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-fc9h-whq2-v747 Valid ECDSA signatures erroneously rejected in Elliptic (LOW) Affected versions: < 6.6.0 Patched version: 6.6.0 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-fc9h-whq2-v747 Valid ECDSA signatures erroneously rejected in Elliptic (LOW) Affected versions: < 6.6.0 Patched version: 6.6.0 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-434g-2637-qmqr Elliptic's verify function omits uniqueness validation (LOW) Affected versions: < 6.5.6 Patched version: 6.5.6 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-977x-g7h5-7qgw Elliptic's ECDSA missing check for whether leading bit of r and s is zero (LOW) Affected versions: >= 2.0.0 < 6.5.7 Patched version: 6.5.7 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		[email protected] has a Low CVE. CVE: GHSA-f7q4-pwc6-w24p Elliptic's EDDSA missing signature length check (LOW) Affected versions: >= 4.0.0 < 6.5.7 Patched version: 6.5.7 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 6 more rows in the dashboard

View full report