From bb81e20ecf9a0bb7b045c947cd7e815220915c44 Mon Sep 17 00:00:00 2001 From: Mohammad Al Faiyaz Date: Fri, 23 Oct 2026 14:23:59 -0400 Subject: [PATCH 1/2] fix: bump toml to 5.0.1 to fix osv-scanner findings toml@4.3.0 (root resolutions force-pin; only consumer is bitgo > stellar-sdk@10.4.1, which calls toml.parse() on /.well-known/stellar.toml responses) is in the affected range of advisories fixed in toml 5.0.1, most notably GHSA-4qx8-w7c3-pj3p (CVE-2026-114141, quadratic-complexity DoS in toml.parse() via many array-of-tables headers; CVSS 4.0 HIGH, fails the release HIGH/CRITICAL osv-scanner gate), plus GHSA-9j65-hcg3-gc64 (quadratic DoS via long dotted keys) and GHSA-9qmh-m7c6-f92p (super-linear CPU via oversized integer literals). v5.0.0 breaking change vs 4.3.0: integer values outside the safe (+/-2^53-1) or 64-bit range now throw at parse time instead of silently rounding; opt-in lossless handling via toml.parse(input, { bigint: true }). stellar-sdk's StellarTomlResolver only parses stellar.toml documents (string/URL values); verified by the sdk-coin-xlm federation unit tests. osv-scanner diff vs the master lockfile shows exactly the three flagged toml advisories removed and no new findings introduced. Ticket: INFOSEC-730 --- package.json | 2 +- yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 3a071e29d6e..86f567a2afe 100644 --- a/package.json +++ b/package.json @@ -61,7 +61,7 @@ }, "resolutions": { "fflate": "0.8.3", - "toml": "4.3.0", + "toml": "5.0.1", "smol-toml": "1.7.1", "**/cliui/strip-ansi": "6.0.1", "**/cliui/string-width": "4.2.3", diff --git a/yarn.lock b/yarn.lock index ca2a392727e..127ceebbb53 100644 --- a/yarn.lock +++ b/yarn.lock @@ -20293,10 +20293,10 @@ toidentifier@1.0.1: resolved "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz" integrity sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA== -toml@4.3.0, toml@^2.3.0: - version "4.3.0" - resolved "https://registry.npmjs.org/toml/-/toml-4.3.0.tgz#10e2ff83296ec17d8935bf02364e4969cfeaae67" - integrity sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A== +toml@5.0.1, toml@^2.3.0: + version "5.0.1" + resolved "https://registry.npmjs.org/toml/-/toml-5.0.1.tgz#67ca011810a2dd8741c2cede1027ee2084b73d67" + integrity sha512-EqYNA/YvUNndrA2B3O2ojzLQoTQrBxeZ9UIjQwk8t10oe6n7dwclBwd9IdZQTOKwe6vWX+AXtl6IntXRbepdxQ== tonweb@^0.0.62: version "0.0.62" From 5acf0cbb666df90d577d9ee89b863d6b7c349fdc Mon Sep 17 00:00:00 2001 From: Mohammad Al Faiyaz Date: Fri, 23 Oct 2026 15:04:43 -0400 Subject: [PATCH 2/2] chore(root): allow INFOSEC- issue prefix for commitlint The INFOSEC- ticket prefix (used by the security team for dependency upgrade tickets, e.g. INFOSEC-730) was missing from the commitlint parser issuePrefixes, so commit footers referencing INFOSEC tickets failed the references-empty rule in CI (PR #10044 commit-lint job). Mirrors the earlier WEB- prefix addition in ef0927d78a. Ticket: INFOSEC-730 --- commitlint.config.js | 1 + 1 file changed, 1 insertion(+) diff --git a/commitlint.config.js b/commitlint.config.js index 8f25961b38c..5133099d18c 100644 --- a/commitlint.config.js +++ b/commitlint.config.js @@ -49,6 +49,7 @@ module.exports = { 'HSM-', 'INC-', 'INF-', + 'INFOSEC-', 'IR-', 'IS-', 'ITHD-',