Skip to content

Update account generation to use code from 5.4.0-rc.1 #577

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

Amxx
Copy link
Contributor

@Amxx Amxx commented Jun 20, 2025

Upgradeable version is a bit challenging because only part of the parent contracts must be used in their upgradeable version.

Only contract that should be used from the upgradeable packages are:

draft-AccountERC7579Hooked.sol
draft-AccountERC7579HookedUpgradeable.sol
MultiSignerERC7913Upgradeable.sol
MultiSignerERC7913WeightedUpgradeable.sol
SignerECDSAUpgradeable.sol
SignerERC7913Upgradeable.sol
SignerP256Upgradeable.sol
SignerRSAUpgradeable.sol

while EIP712, and ERC7739 have an upgradeable version, they should not be used here. Using the vanila version of EIP712 so that the domain doesn't have to be initialized, and is shared accross all clones/proxies.

Copy link

socket-security bot commented Jun 20, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​nomicfoundation/​hardhat-toolbox@​5.0.0971007590100
Added@​openzeppelin/​hardhat-upgrades@​3.9.09910010087100
Addedhardhat@​2.22.19941008910080
Added@​openzeppelin/​contracts-upgradeable@​5.3.010010010093100
Added@​openzeppelin/​contracts@​5.3.010010010094100

View full report

@Amxx Amxx marked this pull request as ready for review June 20, 2025 13:00
Copy link
Member

@ericglau ericglau left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR. Here is a checklist of some remaining items that are needed:

return;
}
case 'ERC7702': {
// Add locking constructor
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If upgradeable is false, none of the imports use Initializable. In that case, does this still need to disable initializers? If so, it should add the import:

Suggested change
// Add locking constructor
// Add locking constructor
c.addParent({
name: 'Initializable',
path: '@openzeppelin/contracts/proxy/utils/Initializable.sol',
});

name: 'ERC7739',
path: '@openzeppelin/contracts/utils/cryptography/signers/draft-ERC7739.sol',
});
} else if (opts.signatureValidation === 'ERC1271' && !opts.signatureValidation) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This condition is not possible.

c.addNatspecTag('@custom:oz-upgrades-unsafe-allow', 'constructor');
c.addConstructorCode(`_disableInitializers();`);

// todo: error if upgradeable is set ?
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this should be an error, it can throw OptionsError and the UI can catch and display it. See

and
<input bind:value={opts.proposalThreshold} placeholder="0" use:error={errors?.proposalThreshold} />
for example.

Comment on lines +26 to +27
"@openzeppelin/contracts": "^5.4.0-rc.1",
"@openzeppelin/contracts-upgradeable": "^5.4.0-rc.1",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These should be bumped to 5.4.0 when it is released, before merging this PR.

Copy link

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert (click for details)
Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL)

Affected versions: < 6.6.1

Patched version: 6.6.1

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL)

Affected versions: < 6.6.1

Patched version: 6.6.1

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos (CRITICAL)

Affected versions: >= 3.0.10 < 3.1.3

Patched version: 3.1.3

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/@openzeppelin/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys (CRITICAL)

Affected versions: < 3.1.3

Patched version: 3.1.3

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/@openzeppelin/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys (CRITICAL)

Affected versions: < 3.1.3

Patched version: 3.1.3

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/@openzeppelin/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos (CRITICAL)

Affected versions: >= 3.0.10 < 3.1.3

Patched version: 3.1.3

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/@openzeppelin/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
[email protected] has a High CVE.

CVE: GHSA-jr5f-v2jv-69x6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL (HIGH)

Affected versions: >= 1.0.0 < 1.8.2; < 0.30.0

Patched version: 0.30.0

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
[email protected] has a High CVE.

CVE: GHSA-jr5f-v2jv-69x6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL (HIGH)

Affected versions: >= 1.0.0 < 1.8.2; < 0.30.0

Patched version: 0.30.0

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
[email protected] has a High CVE.

CVE: GHSA-xq7p-g2vc-g82p Homograph attack allows Unicode lookalike characters to bypass validation. (HIGH)

Affected versions: = 5.0.0, 4.0.0; >= 5.0.0 < 5.0.1; >= 4.0.0 < 4.0.1; < 3.0.11

Patched version: 3.0.11

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
[email protected] has a High CVE.

CVE: GHSA-xq7p-g2vc-g82p Homograph attack allows Unicode lookalike characters to bypass validation. (HIGH)

Affected versions: = 5.0.0, 4.0.0; >= 5.0.0 < 5.0.1; >= 4.0.0 < 4.0.1; < 3.0.11

Patched version: 3.0.11

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
[email protected] has a High CVE.

CVE: GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers (HIGH)

Affected versions: >= 2.1.0 < 5.2.4; >= 6.0.0 < 6.2.3; >= 7.0.0 < 7.5.10; >= 8.0.0 < 8.17.1

Patched version: 5.2.4

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
[email protected] has a High CVE.

CVE: GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers (HIGH)

Affected versions: >= 2.1.0 < 5.2.4; >= 6.0.0 < 6.2.3; >= 7.0.0 < 7.5.10; >= 8.0.0 < 8.17.1

Patched version: 5.2.4

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-pxg6-pf52-xh8x cookie accepts cookie name, path, and domain with out of bounds characters (LOW)

Affected versions: < 0.7.0

Patched version: 0.7.0

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-pxg6-pf52-xh8x cookie accepts cookie name, path, and domain with out of bounds characters (LOW)

Affected versions: < 0.7.0

Patched version: 0.7.0

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-49q7-c7j4-3p7m Elliptic allows BER-encoded signatures (LOW)

Affected versions: >= 5.2.1 < 6.5.7

Patched version: 6.5.7

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-f7q4-pwc6-w24p Elliptic's EDDSA missing signature length check (LOW)

Affected versions: >= 4.0.0 < 6.5.7

Patched version: 6.5.7

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-977x-g7h5-7qgw Elliptic's ECDSA missing check for whether leading bit of r and s is zero (LOW)

Affected versions: >= 2.0.0 < 6.5.7

Patched version: 6.5.7

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-434g-2637-qmqr Elliptic's verify function omits uniqueness validation (LOW)

Affected versions: < 6.5.6

Patched version: 6.5.6

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-fc9h-whq2-v747 Valid ECDSA signatures erroneously rejected in Elliptic (LOW)

Affected versions: < 6.6.0

Patched version: 6.6.0

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-fc9h-whq2-v747 Valid ECDSA signatures erroneously rejected in Elliptic (LOW)

Affected versions: < 6.6.0

Patched version: 6.6.0

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-434g-2637-qmqr Elliptic's verify function omits uniqueness validation (LOW)

Affected versions: < 6.5.6

Patched version: 6.5.6

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-977x-g7h5-7qgw Elliptic's ECDSA missing check for whether leading bit of r and s is zero (LOW)

Affected versions: >= 2.0.0 < 6.5.7

Patched version: 6.5.7

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-f7q4-pwc6-w24p Elliptic's EDDSA missing signature length check (LOW)

Affected versions: >= 4.0.0 < 6.5.7

Patched version: 6.5.7

From: packages/core/solidity/src/environments/hardhat/package-lock.jsonnpm/@nomicfoundation/[email protected]npm/@nomicfoundation/[email protected]npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 6 more rows in the dashboard

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants