Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 13 updates - #25

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5e58a498dc
Open

build(deps): bump the npm_and_yarn group across 1 directory with 13 updates#25
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5e58a498dc

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubJun 18, 2024

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 7 updates in the / directory:

PackageFromTo
web31.2.61.5.3
json50.5.1removed
webpack3.12.05.92.0
js-yaml3.0.13.14.1
nanoid3.1.20removed
mocha8.4.010.4.0
tough-cookie2.5.0removed
web31.5.34.10.0

Updates web3 from 1.2.6 to 1.5.3

Release notes

Sourced from web3's releases.

web3-eth@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-eth@4.0.0-alpha.0

web3-core-requestmanager@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-core-requestmanager@4.0.0-alpha.0

web3-providers-http@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-providers-http@4.0.0-alpha.0

web3-providers-base@1.0.0-alpha.1

Changed

  • Update version to 1.0.0-alpha.1 for web3-providers-base
  • Update version to 4.0.0-alpha.0 for web3-utils in web3-providers-base

web3-utils@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-utils@4.0.0-alpha.0

web3-packagetemplate@1.0.0-alpha.0

Initial alpha release

Install with yarn add web3-packagetemplate@1.0.0-alpha.0

Changelog

Sourced from web3's changelog.

[1.2.6]

Added

  • Görli testnet ENS registry added to the known registries (#3338)

Changed

[1.2.7]

Added

  • Add revert reason support to sendSignedTransaction (#3345)
  • ENS module extended with the possibility to add a custom registry (#3301)
  • Missing ENS Registry methods and Resolver.supportsInterface method added (#3325)
  • Add optional gas type to AbiItem typescript definitions (for ABIs generated by Vyper) (#3437)
  • Add görli testnet ENS registry to the known registries (#3252)
  • Add auto-reconnect option for Websockets (#3092, #1085, #1391, #1558, #1852, #1646)

Changed

  • Ensure '0x' prefix is existing for Accounts.sign and Accounts.privateKeyToAccount (#3041)
  • Repository cleanup (#3443)
    • Removed old docs/_build folder
    • Removed old bower and meteor artifacts
    • Moved logo assets to own folder
    • Moved github assets to own folder
    • Remove @​types/node from (non-dev) dependency tree (#3965, #3227)
  • Please note: Geth v1.9.12 contains a breaking change for eth_call that will not default to your first account anymore if from is not set. If a sender is not explicitly defined, the eth_call will be executed from address(0). (#3467)
    • This was done to avoid the same input behaving differently in different environments. You should never do eth_call without explicitly setting a sender.
    • This means that if you're calling view methods that refer to a msg.sender without explicitly setting a from address in your request options, you may see unexpected behavior.
    • In web3.js, the from address can be specified on a per-call basis or by setting the defaultAccount property.

Fixed

  • Add missing subscription.on('connected') TS type definition (#3319)
  • Add missing bignumber.js dependency for TS types (#3386)
  • Upgrade swarm-js to 0.1.40 to remove npm vulnerability warning (#3399)
  • Upgrade devDeps to resolve security warnings (#3464)
    • dtslint 0.4.2 => 3.4.1
    • definitelytyped-header-parser 1.0.1 => 3.9.0
  • Race-condition when subscribing to historical logs as first client request (#3389)
  • Fix crash when using Web-Workers by removing any-promise dependency (#3377#2211#1774)
  • MaxListenersExceededWarning event emitter warning mitigated (#1648)

[1.2.8]

Added

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by spacesailor, a new releaser for web3 since your current version.


Removes json5

Updates webpack from 3.12.0 to 5.92.0

Release notes

Sourced from webpack's releases.

v5.92.0

Bug Fixes

  • Correct tidle range's comutation for module federation
  • Consider runtime for pure expression dependency update hash
  • Return value in the subtractRuntime function for runtime logic
  • Fixed failed to resolve promise when eager import a dynamic cjs
  • Avoid generation extra code for external modules when remapping is not required
  • The css/global type now handles the exports name
  • Avoid hashing for @keyframe and @property at-rules in css/global type
  • Fixed mangle with destructuring for JSON modules
  • The stats.hasWarnings() method now respects the ignoreWarnings option
  • Fixed ArrayQueue iterator
  • Correct behavior of __webpack_exports_info__.a.b.canMangle
  • Changed to the correct plugin name for the CommonJsChunkFormatPlugin plugin
  • Set the chunkLoading option to the import when environment is unknown and output is module
  • Fixed when runtimeChunk has no exports when module chunkFormat used
  • [CSS] Fixed parsing minimized CSS import
  • [CSS] URLs in CSS files now have correct public path
  • [CSS] The css module type should not allow parser to switch mode
  • [Types] Improved context module types

New Features

  • Added platform target properties to compiler
  • Improved multi compiler cache location and validating it
  • Support import attributes spec (with keyword)
  • Support node: prefix for Node.js core modules in runtime code
  • Support prefetch/preload for module chunk format
  • Support "..." in the importsFields option for resolver
  • Root module is less prone to be wrapped in IIFE
  • Export InitFragment class for plugins
  • Export compileBooleanMatcher util for plugins
  • Export InputFileSystem and OutputFileSystem types
  • [CSS] Support the esModule generator option for CSS modules
  • [CSS] Support CSS when chunk format is module

v5.91.0

Bug Fixes

  • Deserializer for ignored modules doesn't crash
  • Allow the unsafeCache option to be a proxy object
  • Normalize the snapshot.unmanagedPaths option
  • Fixed fs types
  • Fixed resolve's plugins types
  • Fixed wrongly calculate postOrderIndex
  • Fixed watching types
  • Output import attrbiutes/import assertions for external JS imports
  • Throw an error when DllPlugin needs to generate multiple manifest files, but the path is the same
  • [CSS] Output layer/supports/media for external CSS imports

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by evilebottnawi, a new releaser for webpack since your current version.


Updates js-yaml from 3.0.1 to 3.14.1

Changelog

Sourced from js-yaml's changelog.

[3.14.1] - 2020-12-07

Security

  • Fix possible code execution in (already unsafe) .load() (in &anchor).

[3.14.0] - 2020-05-22

Changed

  • Support safe/loadAll(input, options) variant of call.
  • CI: drop outdated nodejs versions.
  • Dev deps bump.

Fixed

  • Quote = in plain scalars #519.
  • Check the node type for !<?> tag in case user manually specifies it.
  • Verify that there are no null-bytes in input.
  • Fix wrong quote position when writing condensed flow, #526.

[3.13.1] - 2019-04-05

Security

  • Fix possible code execution in (already unsafe) .load(), #480.

[3.13.0] - 2019-03-20

Security

  • Security fix: safeLoad() can hang when arrays with nested refs used as key. Now throws exception for nested arrays. #475.

[3.12.2] - 2019-02-26

Fixed

  • Fix noArrayIndent option for root level, #468.

[3.12.1] - 2019-01-05

Added

  • Added noArrayIndent option, #432.

[3.12.0] - 2018-06-02

Changed

  • Support arrow functions without a block statement, #421.

[3.11.0] - 2018-03-05

Added

  • Add arrow functions suport for !!js/function.

Fixed

  • Fix dump in bin/octal/hex formats for negative integers, #399.

... (truncated)

Commits
  • 37caaad 3.14.1 released
  • 094c0f7 dist rebuild
  • 9586ebe Avoid calling hasOwnProperty of user-controlled objects
  • 34e5072 3.14.0 released
  • 7b25c83 Browser files rebuild
  • 6f73473 Dev deps bump
  • 0c29349 Travis-CI: drop old nodejs versions
  • 10be97e fix(loader): Add support for safe/loadAll(input, options)
  • d6983dd Fix issue #526: wrong quote position writing condensed flow (#527)
  • 93fbf7d fix issue 526 (wrong quote position writing condensed flow)
  • Additional commits viewable in compare view

Updates braces from 2.3.2 to 3.0.2

Changelog

Sourced from braces's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

[3.0.0] - 2018-04-08

v3.0 is a complete refactor, resulting in a faster, smaller codebase, with fewer deps, and a more accurate parser and compiler.

Breaking Changes

  • The undocumented .makeRe method was removed

Non-breaking changes

  • Caching was removed
Commits

Updates elliptic from 6.3.3 to 6.5.4

Commits

Updates express from 4.18.2 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

New Contributors

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

  • Fix routing requests without method
  • deps: body-parser@1.20.2
    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@2.5.2

Other Changes

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

  • Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

  • Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@0.6.0

4.18.3 / 2024-02-29

  • Fix routing requests without method
  • deps: body-parser@1.20.2
    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@2.5.2
  • deps: cookie@0.6.0
    • Add partitioned option
Commits
  • 04bc627 4.19.2
  • da4d763 Improved fix for open redirect allow list bypass
  • 4f0f6cc 4.19.1
  • a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
  • a1fa90f fixed un-edited version in history.md for 4.19.0
  • 11f2b1d build: fix build due to inconsistent supertest behavior in older versions
  • 084e365 4.19.0
  • 0867302 Prevent open redirect allow list bypass due to encodeurl
  • 567c9c6 Add note on how to update docs for new release (#5541)
  • 69a4cf2 deps: cookie@0.6.0
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.


Updates got from 7.1.0 to 9.6.0

Release notes

Sourced from got's releases.

v9.6.0

  • Add init hook (#683) 677d0a4
  • Add beforeError hook (#696) 29ffb44

sindresorhus/got@v9.5.1...v9.6.0

v9.5.1

  • Fix memory leak when using socket timeout and keepalive agent (#694) 203dadc
  • Fix strange timing data for HTTP requests d136e61
  • Correctly preserve original status code when returning cached responses d136e61

sindresorhus/got@v9.5.0...v9.5.1

v9.5.0

  • Remove error thrown for URLs with auth component (#676) 5d20a43
  • Upgrade dependencies a1eadfe

sindresorhus/got@v9.4.0...v9.5.0

v9.4.0

  • Add ability to specify which network error codes to retry on. 9f3a099
  • Add Got options onto responses and errors. 33b838f
  • Correctly clear socket timeout on error. c8e358f

sindresorhus/got@v9.3.2...v9.4.0

v9.3.2

sindresorhus/got@v9.3.1...v9.3.2

v9.3.1

  • Don't override headers defined in the url argument when it's an object. 191e00a
  • Don't set content-length header when upload body size is null. 311b184

sindresorhus/got@v9.3.0...v9.3.1

v9.3.0

  • Add option to allow defaults to be mutable. b392f60
  • Add beforeRedirect, beforeRetry, and afterResponse hooks. 325409c
  • Retry on a few more errors. fbaaa2a
  • Include body property in HTTPError. fdc0fa6
  • Transform user set headers to lowercase. a07b2be
  • Support Electron renderer timings. 25f18be

sindresorhus/got@v9.2.0...v9.3.0

v9.2.2

  • Gracefully handle invalid Location redirect URLs. (#605) 7ae6939

... (truncated)

Commits

Updates yargs-parser from 7.0.0 to 13.1.2

Changelog

Sourced from yargs-parser's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

21.1.1 (2022-08-04)

Bug Fixes

21.1.0 (2022-08-03)

Features

  • allow the browser build to be imported (#443) (a89259f)

Bug Fixes

  • halt-at-non-option: prevent known args from being parsed when "unknown-options-as-args" is enabled (#438) (c474bc1)
  • node version check now uses process.versions.node (#450) (d07bcdb)
  • parse options ending with 3+ hyphens (#434) (4f1060b)

21.0.1 (2022-02-27)

Bug Fixes

21.0.0 (2021-11-15)

⚠ BREAKING CHANGES

  • drops support for 10 (#421)

Bug Fixes

Code Refactoring

20.2.9 (2021-06-20)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for yargs-parser since your current version.


Removes nanoid

Updates mocha from 8.4.0 to 10.4.0

Release notes

Sourced from mocha's releases.

v10.4.0

10.4.0 / 2024-03-26

🎉 Enhancements

🐛 Fixes

🔩 Other

v10.3.0

This is a stable release equivalent to v10.3.0-preminor.0.

What's Changed

... (truncated)

Changelog

Sourced from mocha's changelog.

10.4.0 / 2024-03-26

🎉 Enhancements

🐛 Fixes

🔩 Other

10.3.0 / 2024-02-08

This is a stable release equivalent to 10.30.0-prerelease.

10.3.0-prerelease / 2024-01-18

This is a prerelease version to test our ability to release. Other than removing or updating dependencies, it contains no intended user-facing changes.

🔩 Other

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by voxpelli, a new releaser for mocha since your current version.


Removes tough-cookie

Updates web3 from 1.5.3 to 4.10.0

Release notes

Sourced from web3's releases.

web3-eth@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-eth@4.0.0-alpha.0

web3-core-requestmanager@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-core-requestmanager@4.0.0-alpha.0

web3-providers-http@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-providers-http@4.0.0-alpha.0

web3-providers-base@1.0.0-alpha.1

Changed

  • Update version to 1.0.0-alpha.1 for web3-providers-base
  • Update version to 4.0.0-alpha.0 for web3-utils in web3-providers-base

web3-utils@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-utils@4.0.0-alpha.0

web3-packagetemplate@1.0.0-alpha.0

Initial alpha release

Install with yarn add web3-packagetemplate@1.0.0-alpha.0

Changelog

Sourced from web3's changelog.

[1.2.6]

Added

  • Görli testnet ENS registry added to the known registries (#3338)

Changed

[1.2.7]

Added

  • Add revert reason support to sendSignedTransaction (#3345)
  • ENS module extended with the possibility to add a custom registry (#3301)
  • Missing ENS Registry methods and Resolver.supportsInterface method added (#3325)
  • Add optional gas type to AbiItem typescript definitions (for ABIs generated by Vyper) (#3437)
  • Add görli testnet ENS registry to the known registries (#3252)
  • Add auto-reconnect option for Websockets (#3092, #1085, #1391, #1558, #1852, #1646)

Changed

  • Ensure '0x' prefix is existing for Accounts.sign and Accounts.privateKeyToAccount (#3041)
  • Repository cleanup (#3443)
    • Removed old docs/_build folder
    • Removed old bower and meteor artifacts
    • Moved logo assets to own folder
    • Moved github assets to own folder
    • Remove @​types/node from (non-dev) dependency tree (#3965, #3227)
  • Please note: Geth v1.9.12 contains a breaking change for eth_call that will not default to your first account anymore if from is not set. If a sender is not explicitly defined, the eth_call will be executed from address(0). (#3467)
    • This was done to avoid the same input behaving differently in different environments. You should never do eth_call without explicitly setting a sender.
    • This means that if you're calling view methods that refer to a msg.sender without explicitly setting a from address in your request options, you may see unexpected behavior.
    • In web3.js, the from address can be specified on a per-call basis or by setting the defaultAccount property.

Fixed

  • Add missing subscription.on('connected') TS type definition (#3319)
  • Add missing bignumber.js dependency for TS types (#3386)
  • Upgrade swarm-js to 0.1.40 to remove npm vulnerability warning (#3399)
  • Upgrade devDeps to resolve security warnings (#3464)
    • dtslint 0.4.2 => 3.4.1
    • definitelytyped-header-parser 1.0.1 => 3.9.0
  • Race-condition when subscribing to historical logs...

    Description has been truncated

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 13 u…
471bfdb
…pdates
Bumps the npm_and_yarn group with 7 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [web3](https://github.com/ChainSafe/web3.js) | `1.2.6` | `1.5.3` |
| [json5](https://github.com/json5/json5) | `0.5.1` | `removed` |
| [webpack](https://github.com/webpack/webpack) | `3.12.0` | `5.92.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.0.1` | `3.14.1` |
| [nanoid](https://github.com/ai/nanoid) | `3.1.20` | `removed` |
| [mocha](https://github.com/mochajs/mocha) | `8.4.0` | `10.4.0` |
| [tough-cookie](https://github.com/salesforce/tough-cookie) | `2.5.0` | `removed` |
| [web3](https://github.com/ChainSafe/web3.js) | `1.5.3` | `4.10.0` |
Updates `web3` from 1.2.6 to 1.5.3
- [Release notes](https://github.com/ChainSafe/web3.js/releases)
- [Changelog](https://github.com/web3/web3.js/blob/4.x/CHANGELOG.md)
- [Commits](web3/web3.js@v1.2.6...v1.5.3)
Removes `json5`
Updates `webpack` from 3.12.0 to 5.92.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](webpack/webpack@v3.12.0...v5.92.0)
Updates `js-yaml` from 3.0.1 to 3.14.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.0.1...3.14.1)
Updates `braces` from 2.3.2 to 3.0.2
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/braces/commits/3.0.2)
Updates `elliptic` from 6.3.3 to 6.5.4
- [Commits](indutny/elliptic@v6.3.3...v6.5.4)
Updates `express` from 4.18.2 to 4.19.2
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@4.18.2...4.19.2)
Updates `got` from 7.1.0 to 9.6.0
- [Release notes](https://github.com/sindresorhus/got/releases)
- [Commits](sindresorhus/got@v7.1.0...v9.6.0)
Updates `yargs-parser` from 7.0.0 to 13.1.2
- [Release notes](https://github.com/yargs/yargs-parser/releases)
- [Changelog](https://github.com/yargs/yargs-parser/blob/main/CHANGELOG.md)
- [Commits](https://github.com/yargs/yargs-parser/commits)
Removes `nanoid`
Updates `mocha` from 8.4.0 to 10.4.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](mochajs/mocha@v8.4.0...v10.4.0)
Removes `tough-cookie`
Updates `web3` from 1.5.3 to 4.10.0
- [Release notes](https://github.com/ChainSafe/web3.js/releases)
- [Changelog](https://github.com/web3/web3.js/blob/4.x/CHANGELOG.md)
- [Commits](web3/web3.js@v1.2.6...v1.5.3)
Updates `ws` from 3.3.3 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@3.3.3...8.17.1)
---
updated-dependencies:
- dependency-name: web3
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: json5
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: webpack
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: js-yaml
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: braces
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: elliptic
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: express
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: got
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yargs-parser
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: nanoid
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: mocha
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: tough-cookie
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: web3
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: ws
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added the dependencies Pull requests that update a dependency file label Jun 18, 2024
@dependabotdependabotBot mentioned this pull request Jun 18, 2024
Closed
@socket-security

socket-securityBot commented Jun 18, 2024

Copy link
Copy Markdown

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

PackageNew capabilitiesTransitivesSizePublisher
npm/@adraffy/ens-normalize@1.10.1None0446 kBadraffy
npm/@ethereumjs/rlp@4.0.1None051.6 kBholgerd77
npm/@jridgewell/source-map@0.3.6None+3446 kBjridgewell
npm/@noble/curves@1.4.0None01.39 MBpaulmillr
npm/@noble/hashes@1.4.0None0773 kBpaulmillr
npm/@scure/base@1.1.7None00 B
npm/@scure/bip32@1.4.0None058.7 kBpaulmillr
npm/@scure/bip39@1.3.0None0374 kBpaulmillr
npm/@types/eslint-scope@3.7.7None06.27 kBtypes
npm/@types/eslint@8.56.10None0192 kBtypes
npm/@types/estree@1.0.5None025.7 kBtypes
npm/@types/ws@8.5.3None020.8 kBtypes
npm/@webassemblyjs/ast@1.12.1None0207 kBxtuc
npm/@webassemblyjs/floating-point-hex-parser@1.11.6None05.14 kBxtuc
npm/@webassemblyjs/helper-api-error@1.11.6None05.4 kBxtuc
npm/@webassemblyjs/helper-buffer@1.12.1None010.8 kBxtuc
npm/@webassemblyjs/helper-numbers@1.11.6None06.68 kBxtuc
npm/@webassemblyjs/helper-wasm-bytecode@1.11.6None016 kBxtuc
npm/@webassemblyjs/helper-wasm-section@1.12.1None019.7 kBxtuc
npm/@webassemblyjs/ieee754@1.11.6None03.18 kBxtuc
npm/@webassemblyjs/leb128@1.11.6None030.7 kBxtuc
npm/@webassemblyjs/utf8@1.11.6None07.31 kBxtuc
npm/@webassemblyjs/wasm-edit@1.12.1None034.6 kBxtuc
npm/@webassemblyjs/wasm-gen@1.12.1None028.1 kBxtuc
npm/@webassemblyjs/wasm-opt@1.12.1None014.4 kBxtuc
npm/@webassemblyjs/wasm-parser@1.12.1None0129 kBxtuc
npm/@webassemblyjs/wast-printer@1.12.1None039.6 kBxtuc
npm/@xtuc/ieee754@1.2.0None08.57 kBxtuc
npm/@xtuc/long@4.2.2None0190 kBxtuc
npm/abitype@0.7.1None0475 kBawkweb
npm/acorn-import-attributes@1.9.5None032 kBxtuc
npm/chrome-trace-event@1.0.4None09.81 kBsamccone
npm/crc-32@1.2.2None031 kBsheetjs
npm/cross-fetch@4.0.0network088.1 kBlquixada
npm/enhanced-resolve@5.17.0unsafe0210 kBevilebottnawi
npm/es-module-lexer@1.5.3None090.9 kBguybedford
npm/eventemitter3@5.0.1None073.4 kBlpinca
npm/glob-to-regexp@0.4.1None018.1 kBnickfitzgerald
npm/is-arguments@1.1.1None028.8 kBljharb
npm/is-unicode-supported@0.1.0None03.54 kBsindresorhus
npm/isomorphic-ws@5.0.0None04.04 kBheineiuo
npm/jest-worker@27.5.1environment, shell+294.8 kBsimenb
npm/json-parse-even-better-errors@2.3.1None010.4 kBisaacs
npm/loader-runner@4.3.0eval, filesystem018.4 kBsokra
npm/log-symbols@4.1.0None+363.6 kBsindresorhus
npm/merge-stream@2.0.0None04.31 kBstevemao
npm/mocha@10.4.0environment, eval, filesystem+102.76 MBvoxpelli
npm/node-fetch@2.7.0network0162 kBnode-fetch-bot
npm/serialize-javascript@6.0.0None016.8 kBokuryu
npm/tapable@2.2.1None046.9 kBsokra
npm/terser-webpack-plugin@5.3.10Transitive: environment+2190 kBevilebottnawi
npm/terser@5.31.1environment, eval+12.19 MBfabiosantoscode
npm/tr46@0.0.3None0268 kBsebmaster
npm/watchpack@2.4.1environment, filesystem056.2 kBevilebottnawi
npm/web3-core@4.5.0None00 B
npm/web3-errors@1.2.0None0416 kBluu-alex
npm/web3-eth-abi@4.2.2None0398 kBluu-alex
npm/web3-eth-accounts@4.1.2None+11.44 MBluu-alex
npm/web3-eth-contract@4.5.0None0399 kBluu-alex
npm/web3-eth-ens@4.4.0None00 B
npm/web3-eth-iban@4.0.7None078.4 kBjdevcs
npm/web3-eth-personal@4.0.8None084.7 kBluu-alex
npm/web3-eth@4.8.0None00 B
npm/web3-net@4.1.0None040.5 kBluu-alex
npm/web3-providers-http@4.1.0network027.2 kBjdevcs
npm/web3-providers-ipc@4.0.7filesystem, network033 kBjdevcs
npm/web3-providers-ws@4.0.7None035.4 kBjdevcs
npm/web3-rpc-methods@1.3.0None0135 kBluu-alex
npm/web3-rpc-providers@1.0.0-rc.0None00 B
npm/web3-types@1.7.0None00 B
npm/web3-utils@4.3.0None0534 kBluu-alex
npm/web3-validator@2.0.6Transitive: environment+1991 kBluu-alex
npm/web3@4.10.0None00 B
npm/webidl-conversions@3.0.1None012.4 kBsebmaster
npm/webpack-sources@3.2.3None091.3 kBsokra
npm/webpack@5.92.0environment, filesystem, network, unsafe+15 MBevilebottnawi
npm/whatwg-url@5.0.0None049.9 kBdomenic
npm/workerpool@6.2.1None0330 kBjosdejong
npm/ws@8.17.1None00 B
npm/zod@3.23.8None0667 kBcolinmcd94

🚮 Removed packages:npm/@sindresorhus/is@0.14.0, npm/@szmarczak/http-timer@1.1.2, npm/@ungap/promise-all-settled@1.1.2, npm/@web3-js/scrypt-shim@0.1.0, npm/@web3-js/websocket@1.0.30, npm/accepts@1.3.8, npm/acorn-dynamic-import@2.0.2, npm/aes-js@3.0.0, npm/align-text@0.1.4, npm/ansi-regex@2.1.1, npm/any-promise@1.3.0, npm/argparse@0.1.16, npm/arr-diff@4.0.0, npm/arr-flatten@1.1.0, npm/arr-union@3.1.0, npm/array-flatten@1.1.1, npm/array-unique@0.3.2, npm/asn1.js@5.4.1, npm/asn1@0.2.6, npm/assert-plus@1.0.0, npm/assign-symbols@1.0.0, npm/async-each@1.0.3, npm/async-limiter@1.0.1, npm/asynckit@0.4.0, npm/atob@2.1.2, npm/aws-sign2@0.7.0, npm/aws4@1.12.0, npm/base64-js@1.5.1, npm/base@0.11.2, npm/bcrypt-pbkdf@1.0.2, npm/binary-extensions@1.13.1, npm/bl@1.2.3, npm/bluebird@3.7.2, npm/body-parser@1.20.2, npm/browserify-cipher@1.0.1, npm/browserify-des@1.0.2, npm/browserify-rsa@4.1.0, npm/browserify-sign@4.2.2, npm/browserify-zlib@0.2.0, npm/buffer-alloc-unsafe@1.1.0, npm/buffer-alloc@1.2.0, npm/buffer-crc32@0.2.13, npm/buffer-fill@1.0.0, npm/buffer-to-arraybuffer@0.0.5, npm/buffer@4.9.2, npm/builtin-status-codes@3.0.0, npm/bytes@3.1.2, npm/cache-base@1.0.1, npm/cacheable-request@6.1.0, npm/caseless@0.12.0, npm/center-align@0.1.3, npm/chownr@1.1.4, npm/class-utils@0.3.6, npm/clone-response@1.0.3, npm/code-point-at@1.1.0, npm/collection-visit@1.0.0, npm/combined-stream@1.0.8, npm/component-emitter@1.3.0, npm/console-browserify@1.2.0, npm/constants-browserify@1.0.0, npm/content-disposition@0.5.4, npm/content-type@1.0.5, npm/cookie-signature@1.0.6, npm/cookie@0.5.0, npm/cookiejar@2.1.4, npm/copy-descriptor@0.1.1, npm/cors@2.8.5, npm/create-ecdh@4.0.4, npm/crypto-browserify@3.12.0, npm/d@1.0.1, npm/dashdash@1.14.1, npm/debug@2.6.9, npm/decode-uri-component@0.2.2, npm/decompress-response@3.3.0, npm/decompress-tar@4.1.1, npm/decompress-tarbz2@4.1.1, npm/decompress-targz@4.1.1, npm/decompress-unzip@4.0.1, npm/decompress@4.2.1, npm/defer-to-connect@1.1.3, npm/define-property@2.0.2, npm/delayed-stream@1.0.0, npm/depd@2.0.0, npm/des.js@1.0.1, npm/destroy@1.2.0, npm/diffie-hellman@5.0.3, npm/dom-walk@0.1.2, npm/domain-browser@1.2.0, npm/duplexer3@0.1.5, npm/ecc-jsbn@0.1.2, npm/ee-first@1.1.1, npm/encodeurl@1.0.2, npm/enhanced-resolve@3.4.1, npm/errno@0.1.8, npm/error-ex@1.3.2, npm/es5-ext@0.10.62, npm/es6-iterator@2.0.3, npm/es6-map@0.1.5, npm/es6-set@0.1.6, npm/es6-symbol@3.1.3, npm/es6-weak-map@2.0.3, npm/escape-html@1.0.3, npm/escope@3.6.0, npm/etag@1.8.1, npm/eth-ens-namehash@2.0.8, npm/eth-lib@0.1.29, npm/ethereum-bloom-filters@1.0.10, npm/ethereumjs-common@1.5.2, npm/ethereumjs-tx@2.1.2, npm/ethers@4.0.0-beta.3, npm/ethjs-unit@0.1.6, npm/event-emitter@0.3.5, npm/eventemitter3@3.1.2, npm/expand-brackets@2.1.4, npm/express@4.18.2, npm/ext@1.7.0, npm/extend-shallow@3.0.2, npm/extend@3.0.2, npm/extglob@2.0.4, npm/extsprintf@1.3.0, npm/fd-slicer@1.1.0, npm/file-type@5.2.0, npm/finalhandler@1.2.0, npm/for-in@1.0.2, npm/forever-agent@0.6.1, npm/form-data@2.3.3, npm/forwarded@0.2.0, npm/fragment-cache@0.2.1, npm/fresh@0.5.2, npm/fs-constants@1.0.0, npm/fs-extra@4.0.3, npm/fs-minipass@1.2.7, npm/get-caller-file@1.0.3, npm/get-value@2.0.6, npm/getpass@0.1.7, npm/global@4.4.0, npm/got@9.6.0, npm/growl@1.10.5, npm/har-schema@2.0.0, npm/har-validator@5.1.5, npm/has-symbol-support-x@1.4.2, npm/has-to-string-tag-x@1.4.1, npm/has-value@1.0.0, npm/has-values@1.0.0, npm/hosted-git-info@2.8.9, npm/http-cache-semantics@4.1.1, npm/http-errors@2.0.0, npm/http-https@1.0.0, npm/http-signature@1.2.0, npm/https-browserify@1.0.0, npm/iconv-lite@0.4.24, npm/idna-uts46-hx@2.3.1, npm/ieee754@1.2.1, npm/invert-kv@1.0.0, npm/ipaddr.js@1.9.1, npm/is-accessor-descriptor@0.1.6, npm/is-arrayish@0.2.1, npm/is-binary-path@1.0.1, npm/is-buffer@1.1.6, npm/is-core-module@2.11.0, npm/is-data-descriptor@0.1.4, npm/is-descriptor@0.1.6, npm/is-extendable@0.1.1, npm/is-fullwidth-code-point@1.0.0, npm/is-function@1.0.2, npm/is-natural-number@4.0.1, npm/is-object@1.0.2, npm/is-plain-obj@1.1.0, npm/is-retry-allowed@1.2.0, npm/is-typedarray@1.0.0, npm/is-windows@1.0.2, npm/isstream@0.1.2, npm/isurl@1.0.0, npm/js-sha3@0.8.0, npm/js-yaml@3.0.1, npm/jsbn@0.1.1, npm/json-buffer@3.0.0, npm/json-schema@0.4.0, npm/json-stringify-safe@5.0.1, npm/json5@0.5.1, npm/jsonfile@4.0.0, npm/jsprim@1.4.2, npm/keyv@3.1.0, npm/kind-of@3.2.2, npm/lazy-cache@1.0.4, npm/lcid@1.0.0, npm/load-json-file@2.0.0, npm/loader-runner@2.4.0, npm/log-symbols@4.0.0, npm/longest@1.0.1, npm/lowercase-keys@1.0.1, npm/make-dir@1.3.0, npm/map-cache@0.2.2, npm/map-visit@1.0.0, npm/media-typer@0.3.0, npm/memory-fs@0.4.1, npm/merge-descriptors@1.0.1, npm/methods@1.1.2, npm/micromatch@3.1.10, npm/miller-rabin@4.0.1, npm/mime@1.6.0, npm/mimic-response@1.0.1, npm/min-document@2.19.0, npm/minipass@2.9.0, npm/minizlib@1.3.3, npm/mixin-deep@1.3.2, npm/mkdirp-promise@5.0.1, npm/mocha@8.4.0, npm/mock-fs@4.14.0, npm/ms@2.0.0, npm/nan@2.18.0, npm/nano-json-stream-parser@0.1.2, npm/nanoid@3.1.20, npm/nanomatch@1.2.13, npm/negotiator@0.6.3, npm/next-tick@1.1.0, npm/node-libs-browser@2.2.1, npm/normalize-package-data@2.5.0, npm/normalize-url@4.5.1, npm/number-is-nan@1.0.1, npm/number-to-bn@1.7.0, npm/oauth-sign@0.9.0, npm/object-copy@0.1.0, npm/object-visit@1.0.1, npm/object.pick@1.3.0, npm/oboe@2.1.4, npm/on-finished@2.4.1, npm/os-browserify@0.3.0, npm/os-locale@2.1.0, npm/p-cancelable@1.1.0, npm/p-timeout@1.2.1, npm/pako@1.0.11, npm/parse-asn1@5.1.6, npm/parse-headers@2.0.5, npm/parse-json@2.2.0, npm/parseurl@1.3.3, npm/pascalcase@0.1.1, npm/path-browserify@0.0.1, npm/path-dirname@1.0.2, npm/path-to-regexp@0.1.7, npm/path-type@2.0.0, npm/pend@1.2.0, npm/performance-now@2.1.0, npm/pify@2.3.0, npm/pinkie-promise@2.0.1, npm/pinkie@2.0.4, npm/posix-character-classes@0.1.1, npm/prepend-http@2.0.0, npm/process@0.11.10, npm/proxy-addr@2.0.7, npm/prr@1.0.1, npm/psl@1.9.0, npm/public-encrypt@4.0.3, npm/punycode@1.4.1, npm/qs@6.11.0, npm/query-string@5.1.1, npm/querystring-es3@0.2.1, npm/randomfill@1.0.4, npm/range-parser@1.2.1, npm/raw-body@2.5.2, npm/read-pkg-up@2.0.0, npm/read-pkg@2.0.0, npm/readdirp@2.2.1, npm/regex-not@1.0.2, npm/remove-trailing-separator@1.1.0, npm/repeat-element@1.1.4, npm/repeat-string@1.6.1, npm/request@2.88.2, npm/require-main-filename@1.0.1, npm/resolve-url@0.2.1, npm/resolve@1.22.1, npm/responselike@1.0.2, npm/ret@0.1.15, npm/right-align@0.1.3, npm/safe-regex@1.1.0, npm/safer-buffer@2.1.2, npm/scrypt-js@2.0.3, npm/scryptsy@2.1.0, npm/seek-bzip@1.0.6, npm/send@0.18.0, npm/serialize-javascript@5.0.1, npm/serve-static@1.15.0, npm/servify@0.1.12, npm/set-value@2.0.1, npm/setprototypeof@1.2.0, npm/simple-concat@1.0.1, npm/simple-get@2.8.2, npm/snapdragon-node@2.1.1, npm/snapdragon-util@3.0.1, npm/snapdragon@0.8.2, npm/source-list-map@2.0.1, npm/source-map-resolve@0.5.3, npm/source-map-url@0.4.1, npm/source-map@0.5.7, npm/spdx-correct@3.2.0, npm/spdx-exceptions@2.3.0, npm/spdx-expression-parse@3.0.1, npm/spdx-license-ids@3.0.16, npm/split-string@3.1.0, npm/sshpk@1.18.0, npm/static-extend@0.1.2, npm/statuses@2.0.1, npm/stream-browserify@2.0.2, npm/stream-http@2.8.3, npm/strict-uri-encode@1.1.0, npm/string-width@1.0.2, npm/strip-ansi@3.0.1, npm/strip-dirs@2.1.0, npm/swarm-js@0.1.39, npm/tapable@0.2.9, npm/tar-stream@1.6.2, npm/tar@4.4.19, npm/through@2.3.8, npm/timed-out@4.0.1, npm/timers-browserify@2.0.12, npm/to-arraybuffer@1.0.1, npm/to-buffer@1.1.1, npm/to-object-path@0.3.0, npm/to-readable-stream@1.0.0, npm/to-regex-range@2.1.1, npm/to-regex@3.0.2, npm/toidentifier@1.0.1, npm/tough-cookie@2.5.0, npm/tty-browserify@0.0.0, npm/tunnel-agent@0.6.0, npm/tweetnacl@0.14.5, npm/type-is@1.6.18, npm/type@1.2.0, npm/typedarray-to-buffer@3.1.5, npm/uglify-to-browserify@1.0.2, npm/uglifyjs-webpack-plugin@0.4.6, npm/ultron@1.1.1, npm/unbzip2-stream@1.4.3, npm/underscore.string@2.4.0, npm/underscore@1.7.0, npm/union-value@1.0.1, npm/universalify@0.1.2, npm/unpipe@1.0.0, npm/unset-value@1.0.0, npm/upath@1.2.0, npm/urix@0.1.0, npm/url-parse-lax@3.0.0, npm/url-set-query@1.0.0, npm/url-to-options@1.0.1, npm/url@0.11.3, npm/use@3.1.1, npm/utils-merge@1.0.1, npm/uuid@3.4.0, npm/validate-npm-package-license@3.0.4, npm/vary@1.1.2, npm/verror@1.10.0, npm/vm-browserify@1.1.2, npm/watchpack-chokidar2@2.0.1, npm/watchpack@1.7.5, npm/web3-bzz@1.2.6, npm/web3-core-helpers@1.2.6, npm/web3-core-method@1.2.6, npm/web3-core-promievent@1.2.6, npm/web3-core-requestmanager@1.2.6, npm/web3-core-subscriptions@1.2.6, npm/web3-core@1.2.6, npm/web3-eth-abi@1.2.6, npm/web3-eth-accounts@1.2.6, npm/web3-eth-contract@1.2.6, npm/web3-eth-ens@1.2.6, npm/web3-eth-iban@1.2.6, npm/web3-eth-personal@1.2.6, npm/web3-eth@1.2.6, npm/web3-net@1.2.6, npm/web3-providers-http@1.2.6, npm/web3-providers-ipc@1.2.6, npm/web3-providers-ws@1.2.6, npm/web3-shh@1.2.6, npm/web3-utils@1.2.6, npm/web3@1.2.6, npm/webpack-sources@1.4.3, npm/webpack@3.12.0, npm/wide-align@1.1.3, npm/window-size@0.1.0, npm/workerpool@6.1.0, npm/wrap-ansi@2.1.0, npm/ws@3.3.3, npm/xhr-request-promise@0.1.3, npm/xhr-request@1.1.0, npm/xhr2-cookies@1.1.0, npm/xhr@2.6.0, npm/xmlhttprequest@1.8.0, npm/y18n@3.2.2, npm/yaeti@0.0.6, npm/yauzl@2.10.0

View full report↗︎

@socket-security

socket-securityBot commented Jun 18, 2024

Copy link
Copy Markdown

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

AlertPackageNoteSourceCI
New author npm/merge-stream@2.0.0 🚫
Network access npm/node-fetch@2.7.0 🚫
Network access npm/node-fetch@2.7.0 🚫
Network access npm/node-fetch@2.7.0 🚫
Shell access npm/jest-worker@27.5.1 🚫
Network access npm/cross-fetch@4.0.0 🚫
Network access npm/web3-providers-http@4.1.0 🚫
Network access npm/web3-providers-ipc@4.0.7 🚫
Network access npm/web3-providers-ipc@4.0.7 🚫
New author npm/web3-eth-personal@4.0.8 🚫
New author npm/watchpack@2.4.1 🚫
New author npm/mocha@10.4.0 🚫
New author npm/web3-errors@1.2.0 🚫
New author npm/web3-net@4.1.0 🚫
Network access npm/webpack@5.92.0 🚫
Network access npm/webpack@5.92.0 🚫
Network access npm/webpack@5.92.0 🚫

View full report↗︎

Next steps

What is new author?

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

What is shell access?

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/merge-stream@2.0.0
  • @SocketSecurity ignore npm/node-fetch@2.7.0
  • @SocketSecurity ignore npm/jest-worker@27.5.1
  • @SocketSecurity ignore npm/cross-fetch@4.0.0
  • @SocketSecurity ignore npm/web3-providers-http@4.1.0
  • @SocketSecurity ignore npm/web3-providers-ipc@4.0.7
  • @SocketSecurity ignore npm/web3-eth-personal@4.0.8
  • @SocketSecurity ignore npm/watchpack@2.4.1
  • @SocketSecurity ignore npm/mocha@10.4.0
  • @SocketSecurity ignore npm/web3-errors@1.2.0
  • @SocketSecurity ignore npm/web3-net@4.1.0
  • @SocketSecurity ignore npm/webpack@5.92.0

@MajorLiftMajorLift self-assigned this Oct 24, 2024
@mikespositomikesposito mentioned this pull request Oct 24, 2024
Open
mcmire
mcmire requested changes Jan 23, 2025
View reviewed changes

@mcmiremcmire left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI is failing.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mcmiremcmiremcmire requested changes

Requested changes must be addressed to merge this pull request.

Assignees

@MajorLiftMajorLift

Labels

dependenciesPull requests that update a dependency fileteam-wallet-framework

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mcmire@MajorLift