fix(deps): resolve all critical Dependabot security alerts#931
Open
chengwenxi wants to merge 1 commit intomainfrom
Open
fix(deps): resolve all critical Dependabot security alerts#931chengwenxi wants to merge 1 commit intomainfrom
chengwenxi wants to merge 1 commit intomainfrom
Conversation
Go modules: - Bump google.golang.org/grpc from v1.62.1 to v1.79.3 in oracle, node, ops/tools (CVE: gRPC-Go authorization bypass via missing leading slash) - Remove github.com/btcsuite/btcd v0.20.1-beta from tx-submitter (witness size check bypass); only btcec/v2 sub-module is now used npm (contracts, gas-oracle): - Bump axios to ^1.15.0 (SSRF/header injection vulnerabilities) - Bump elliptic to ^6.6.1 (ECDSA private key extraction) - Bump handlebars to ^4.7.9 (JS injection via AST type confusion) - Bump pbkdf2 to ^3.1.3 (predictable keys / Uint8Array input ignored) - Bump sha.js to ^2.4.12 (missing type checks / hash rewind) - Bump cipher-base to ^1.0.5 (missing type checks / hash rewind) - Bump form-data to ^4.0.4 (unsafe random boundary function) - Bump underscore to ^1.12.1 (arbitrary code execution) - Add yarn resolutions in contracts to force patched transitive versions - Replace gas-oracle/package-lock.json with yarn.lock (npm was using an outdated resolver; yarn already resolves all patched versions) Note: babel-traverse (alert #75) has no patch available in the v6 package. It is a deeply nested transitive dependency from ethereum-waffle/ganache-core (deprecated toolchain). Remediation requires migrating the testing infra to a modern babel v7+ toolchain. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
📝 WalkthroughWalkthroughThis PR updates dependencies across the monorepo: upgrading axios and managing npm resolutions in the contracts package, and updating multiple indirect Go module versions across node, ops/tools, oracle, and tx-submitter packages to align with newer versions of protobuf, cryptography, and gRPC libraries. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (2)
node/go.mod (1)
123-125: Consider adding a CI guard to prevent cross-module version drift.Given the same security-sensitive bumps are repeated across multiple
go.modfiles, a lightweight CI check (go list -m alldiff or policy script) would help keepgrpc/protobuf/x/*versions aligned over time.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@node/go.mod` around lines 123 - 125, The go.mod entries for google.golang.org/genproto, google.golang.org/grpc and google.golang.org/protobuf are drifting across modules; add a lightweight CI guard that runs `go list -m all` (or a small policy script) to collect those module versions across the repo and fail the run on any unexpected divergence. Implement a small script (e.g., check-go-module-versions) that normalizes and compares versions for the modules named (google.golang.org/genproto, google.golang.org/grpc, google.golang.org/protobuf) and exits non-zero on mismatch, then invoke that script as a step in the CI pipeline so PRs that change those module versions are blocked until reconciled.contracts/package.json (1)
99-106: Prefer exactresolutionspins for deterministic security remediation.The caret ranges currently allow version drift across installs. The lockfile shows this is happening—for example,
underscoreresolved to1.13.8instead of1.12.1, andcipher-baseresolved to1.0.7instead of1.0.5. Exact pins ensure reproducible, auditable security fixes.Suggested diff
"resolutions": { - "cipher-base": "^1.0.5", - "elliptic": "^6.6.1", - "form-data": "^4.0.4", - "handlebars": "^4.7.9", - "pbkdf2": "^3.1.3", - "sha.js": "^2.4.12", - "underscore": "^1.12.1" + "cipher-base": "1.0.5", + "elliptic": "6.6.1", + "form-data": "4.0.4", + "handlebars": "4.7.9", + "pbkdf2": "3.1.3", + "sha.js": "2.4.12", + "underscore": "1.12.1" }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@contracts/package.json` around lines 99 - 106, Update the resolutions object in package.json to use exact version pins instead of caret ranges so installs are deterministic; replace entries like "cipher-base": "^1.0.5", "elliptic": "^6.6.1", "form-data": "^4.0.4", "handlebars": "^4.7.9", "pbkdf2": "^3.1.3", "sha.js": "^2.4.12", "underscore": "^1.12.1" with exact strings "cipher-base": "1.0.5", "elliptic": "6.6.1", "form-data": "4.0.4", "handlebars": "4.7.9", "pbkdf2": "3.1.3", "sha.js": "2.4.12", "underscore": "1.12.1" in the resolutions object so the lockfile remains reproducible and security remediation is auditable.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@contracts/package.json`:
- Around line 99-106: Update the resolutions object in package.json to use exact
version pins instead of caret ranges so installs are deterministic; replace
entries like "cipher-base": "^1.0.5", "elliptic": "^6.6.1", "form-data":
"^4.0.4", "handlebars": "^4.7.9", "pbkdf2": "^3.1.3", "sha.js": "^2.4.12",
"underscore": "^1.12.1" with exact strings "cipher-base": "1.0.5", "elliptic":
"6.6.1", "form-data": "4.0.4", "handlebars": "4.7.9", "pbkdf2": "3.1.3",
"sha.js": "2.4.12", "underscore": "1.12.1" in the resolutions object so the
lockfile remains reproducible and security remediation is auditable.
In `@node/go.mod`:
- Around line 123-125: The go.mod entries for google.golang.org/genproto,
google.golang.org/grpc and google.golang.org/protobuf are drifting across
modules; add a lightweight CI guard that runs `go list -m all` (or a small
policy script) to collect those module versions across the repo and fail the run
on any unexpected divergence. Implement a small script (e.g.,
check-go-module-versions) that normalizes and compares versions for the modules
named (google.golang.org/genproto, google.golang.org/grpc,
google.golang.org/protobuf) and exits non-zero on mismatch, then invoke that
script as a step in the CI pipeline so PRs that change those module versions are
blocked until reconciled.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4b68ec09-b154-4fe4-983c-f3d6d816e78b
⛔ Files ignored due to path filters (8)
contracts/yarn.lockis excluded by!**/yarn.lock,!**/*.lockgas-oracle/package-lock.jsonis excluded by!**/package-lock.jsongas-oracle/yarn.lockis excluded by!**/yarn.lock,!**/*.lockgo.work.sumis excluded by!**/*.sumnode/go.sumis excluded by!**/*.sumops/tools/go.sumis excluded by!**/*.sumoracle/go.sumis excluded by!**/*.sumtx-submitter/go.sumis excluded by!**/*.sum
📒 Files selected for processing (5)
contracts/package.jsonnode/go.modops/tools/go.modoracle/go.modtx-submitter/go.mod
💤 Files with no reviewable changes (1)
- tx-submitter/go.mod
chengwenxi
requested review from
a team and
SecurityLife
and removed request for
a team
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
google.golang.org/grpcv1.62.1 → v1.79.3 inoracle/,node/,ops/tools/— fixes gRPC-Go authorization bypass via missing leading slash in:path(alerts modify qanet-deploy-config #525-Enable parsing log level for different modules #527)github.com/btcsuite/btcdv0.20.1-beta fromtx-submitter/— fixes witness size checking bypass (alert declaration redundancy #126); only thebtcec/v2sub-module is retainedaxiosto ^1.15.0 — fixes SSRF via header injection and NO_PROXY hostname normalization bypass (alerts Update submitter & oracle external sign version #573-fix server api #576)ellipticto ^6.6.1 — fixes ECDSA private key extraction upon signing malformed input (alerts Fix ChallengeState #213, Blob metadata #215)handlebarsto ^4.7.9 — fixes JavaScript injection via AST type confusion (alerts Fix batch hash #547, Adjust submitter flag name #551)pbkdf2to ^3.1.3 — fixes predictable keys from uninitialized memory and silently ignored Uint8Array input (alerts Audit ToB 03 & 10: Fix mint inflation #277, Feature/release 0.1.x ops #278, Skip genesis batch #437, fix chunks append with nil rows #438)sha.jsto ^2.4.12 — fixes missing type checks leading to hash rewind (alerts Fix cherry-pick action #291, fix cherry pick workflow #292)cipher-baseto ^1.0.5 — fixes missing type checks leading to hash rewind (alerts Update derivation metrics #289, Fix cherry-pick action #290)form-datato ^4.0.4 — fixes unsafe random function for choosing boundary (alerts Bump the go_modules group across 6 directories with 2 updates #283-Update derivation metrics #286)underscoreto ^1.12.1 — fixes arbitrary code execution (alert Support EIP4844 #6)resolutionsincontracts/package.jsonto force patched versions of transitive dependenciesgas-oracle/from npm to yarn — the existingpackage-lock.jsonhad outdated transitive dependencies; yarn resolves all patched versions. This also makes gas-oracle consistent with contracts.Not fixed in this PR
babel-traverse(alert Update compose #75) — no patched version exists for the v6 package. This is a deeply nested transitive dependency from the deprecatedethereum-waffle/ganache-coretoolchain. Remediation requires migrating testing infrastructure to a modern Babel v7+ setup (@babel/traverse≥ 7.23.2).Verification
oracle,node,ops/tools,tx-submitter) compile successfully withgo build ./...yarn installsucceeds in bothcontracts/andgas-oracle/Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Chores