chore(deps): update dependency uuid to v11.1.1 [security] by renovate[bot] · Pull Request #320 · genlayerlabs/genlayer-cli

renovate · 2026-05-22T12:17:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
uuid	`11.1.0` → `11.1.1`

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6()API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "import {v4,v5,v6} from './dist-node/index.js';const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';for (const [name,fn] of [ ['v4()',()=>v4({},new Uint8Array(8),4)], ['v5()',()=>v5('x',ns,new Uint8Array(8),4)], ['v6()',()=>v6({},new Uint8Array(8),4)],]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); }}"

Observed:

v4() THREW RangeError
v5() NO_THROW
v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
170, 170, 170, 170,
75, 224, 100, 63
]
v6 [
187, 187, 187, 187,
31, 19, 185, 64
]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4()/v1()/v7():

if(offset<0||offset+16>buf.length){thrownewRangeError(`UUID byte range ${offset}:${offset+15} is out of buffer bounds`);}

Apply to:

src/v35.ts (covers v3() and v5())
src/v6.ts

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

`v11.1.1`

Compare Source

Bug Fixes

backport GHSA-w5hq-g745-h8pq fix (32389c8)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:51Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

renovate · 2026-06-10T17:11:08Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:53Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

@ygd58

* fix(system): propagate command-check and version parse fixes to v0.40-dev (#350) Propagates #349 to v0.40-dev. * docs: add branching guide (#353) * docs: add branching guide * ci: harden testnet smoke timeout * feat: support fee profiles in contract commands (#355) * feat: support fee profiles in contract commands * test: make fee profile deploy test portable * feat: staking validators discovery (#357) * feat: add staking validators discovery * feat: epoch-aware validator listing with below-min indicator * fix(staking): account-less client for read-only staking queries getReadOnlyStakingClient threw 'Account not found' on fresh installs; listings and other reads don't need a local account. * feat: vesting commands (#358) * feat: add vesting commands * feat(vesting): validator subcommands — create/join, deposit, exit, claim, operator-transfer, set-identity, list/status Drives the CON-607 Vesting.sol validator leg through the SDK's named vestingValidator* actions; list/status enumerate getValidatorWallets with per-wallet deposited principal. * chore(deps): update dependency uuid to v11.1.1 [security] (#320) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(init): use backend provider id "google" for Gemini (#359) Selecting Gemini during `genlayer init` failed with: Requested providers '{'geminiai'}' do not match any stored providers. The selected provider id is forwarded verbatim to sim_createRandomValidators, but the backend's llm_provider table stores Gemini as "google". Rename the provider id geminiai -> google so it matches. Display name ("Gemini") and env var (GEMINI_API_KEY) are unchanged. Since "geminiai" never resolved to a valid provider, no working configuration relied on it. Fixes#271 Co-authored-by: Edgars Nemše <edgars@genlayerlabs.com> * fix(docs-sync): stop overwriting the generated root _meta.json (#352) The sync-docs workflow rsynced the generated category-based docs/api-references/_meta.json into genlayer-docs and then immediately overwrote it with a hardcoded heredoc containing the pre-grouping flat command list (init, up, deploy, ...). Those keys no longer match the directory layout, so the genlayer-docs sidebar rendered broken entries on every sync (fixed manually in genlayer-docs#426; this removes the cause). Also make the generated root meta complete: - add "index": "Overview" for the generated index.mdx - append ungrouped top-level commands (estimate-fees, finalize, finalize-batch) so they get explicit nav entries instead of relying on Nextra's implicit append Snapshot under docs/api-references regenerated against current main (picks up the new estimate-fees command and latest help text). Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io> * fix: drop getSlashingAddress from validator-history (#361) getSlashingAddress() was removed from the genlayer-js SDK (v0.39+/v2-dev), causing `genlayer staking validator-history` to crash with `client.getSlashingAddress is not a function` before any history is fetched. Resolve the idleness (slashing) contract address dynamically via viem readContract against consensusMainContract.getIdlenessAddress(), falling back to the staking contract address if resolution fails so reward events still display. Port of #344 (by @ygd58) from the dead v0.39 line to v0.40-dev. Supersedes #344. Fixes#341 Co-authored-by: Edgars <edgars@entropicsolutions.io> * feat(network): custom network profiles with deployment-file import (#362) * feat(network): custom network profiles with deployment-file import genlayer network add <alias> --base <built-in> [--deployment <json>] [--rpc <url>] [--consensus-main|--consensus-data|--staking|--fee-manager |--rounds-storage|--appeals <addr>] [--chain-id <n>] [--deployment-key <path>] Profiles persist as base + address overrides only; resolveNetwork loads the base chain fresh from genlayer-js and applies overrides, so ABIs never go stale. network set/list/info/remove and StakingAction --network accept custom aliases. The consensus deployments.json shape is parsed by walking the tree for ContractName->address leaves (ConsensusMain, ConsensusData, GenStaking/Staking, FeeManager, Rounds/RoundsStorage, Appeals); flags take precedence over the file. Adds a prepare script so npm install from a git ref builds dist. Verified: 576 vitest tests, full manual smoke (add/list/set/info/remove with a deployment file). * chore(deps): bump genlayer-js to v2-dev tip for vesting actions The locked v2-dev SHA (28e99fbc) predates the vesting client actions; vestingValidatorJoin and friends land at 666d1156. Verified live: vesting validator create succeeds against a #1162-branch consensus deployment. * docs(cli): regenerate API references; fix option placeholder regex The docs generator's option regex only matched <word> placeholders, so flags with dots or hyphens in the value name (--base <built-in-alias>, --deployment <path.json>, --deployment-key <dot.path>) were silently dropped from the options tables. Widen to <[^>]+> and regenerate: adds the network add/remove pages and the previously undocumented vesting command section (validator create/deposit/exit/claim, operator-transfer, set-identity, delegate/undelegate/claim/withdraw/list). * fix(vesting): resolve validator wallet address in create output The join receipt does not carry the new wallet address, so the output printed validatorWallet: undefined. Read getValidatorWallets from the vesting contract after the join and report the newest entry. Verified live against a #1162-branch deployment. * fix: make git install build lifecycle robust (#363) * fix: make git install build script self contained * chore: refresh genlayer-js lockfile * fix: make keychain dependency optional * fix: restore git prepare build * fix: include build dependency for git installs * chore: keep esbuild as dev dependency * ci: publish prereleases to npm dist tags (#364) * ci: add clarke cli tarball release * ci: publish prereleases to npm dist tags * Release v0.40.0-rc1 [skip ci] --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tobu <36818942+Tobu8888@users.noreply.github.com> Co-authored-by: Albert Castellana <acastellana@users.noreply.github.com> Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io>

renovate · 2026-05-22T12:17:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
uuid	`11.1.0` → `11.1.1`

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6()API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "import {v4,v5,v6} from './dist-node/index.js';const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';for (const [name,fn] of [ ['v4()',()=>v4({},new Uint8Array(8),4)], ['v5()',()=>v5('x',ns,new Uint8Array(8),4)], ['v6()',()=>v6({},new Uint8Array(8),4)],]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); }}"

Observed:

v4() THREW RangeError
v5() NO_THROW
v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
170, 170, 170, 170,
75, 224, 100, 63
]
v6 [
187, 187, 187, 187,
31, 19, 185, 64
]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4()/v1()/v7():

if(offset<0||offset+16>buf.length){thrownewRangeError(`UUID byte range ${offset}:${offset+15} is out of buffer bounds`);}

Apply to:

src/v35.ts (covers v3() and v5())
src/v6.ts

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

`v11.1.1`

Compare Source

Bug Fixes

backport GHSA-w5hq-g745-h8pq fix (32389c8)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:51Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

renovate · 2026-06-10T17:11:08Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:53Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

@ygd58

* fix(system): propagate command-check and version parse fixes to v0.40-dev (#350) Propagates #349 to v0.40-dev. * docs: add branching guide (#353) * docs: add branching guide * ci: harden testnet smoke timeout * feat: support fee profiles in contract commands (#355) * feat: support fee profiles in contract commands * test: make fee profile deploy test portable * feat: staking validators discovery (#357) * feat: add staking validators discovery * feat: epoch-aware validator listing with below-min indicator * fix(staking): account-less client for read-only staking queries getReadOnlyStakingClient threw 'Account not found' on fresh installs; listings and other reads don't need a local account. * feat: vesting commands (#358) * feat: add vesting commands * feat(vesting): validator subcommands — create/join, deposit, exit, claim, operator-transfer, set-identity, list/status Drives the CON-607 Vesting.sol validator leg through the SDK's named vestingValidator* actions; list/status enumerate getValidatorWallets with per-wallet deposited principal. * chore(deps): update dependency uuid to v11.1.1 [security] (#320) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(init): use backend provider id "google" for Gemini (#359) Selecting Gemini during `genlayer init` failed with: Requested providers '{'geminiai'}' do not match any stored providers. The selected provider id is forwarded verbatim to sim_createRandomValidators, but the backend's llm_provider table stores Gemini as "google". Rename the provider id geminiai -> google so it matches. Display name ("Gemini") and env var (GEMINI_API_KEY) are unchanged. Since "geminiai" never resolved to a valid provider, no working configuration relied on it. Fixes#271 Co-authored-by: Edgars Nemše <edgars@genlayerlabs.com> * fix(docs-sync): stop overwriting the generated root _meta.json (#352) The sync-docs workflow rsynced the generated category-based docs/api-references/_meta.json into genlayer-docs and then immediately overwrote it with a hardcoded heredoc containing the pre-grouping flat command list (init, up, deploy, ...). Those keys no longer match the directory layout, so the genlayer-docs sidebar rendered broken entries on every sync (fixed manually in genlayer-docs#426; this removes the cause). Also make the generated root meta complete: - add "index": "Overview" for the generated index.mdx - append ungrouped top-level commands (estimate-fees, finalize, finalize-batch) so they get explicit nav entries instead of relying on Nextra's implicit append Snapshot under docs/api-references regenerated against current main (picks up the new estimate-fees command and latest help text). Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io> * fix: drop getSlashingAddress from validator-history (#361) getSlashingAddress() was removed from the genlayer-js SDK (v0.39+/v2-dev), causing `genlayer staking validator-history` to crash with `client.getSlashingAddress is not a function` before any history is fetched. Resolve the idleness (slashing) contract address dynamically via viem readContract against consensusMainContract.getIdlenessAddress(), falling back to the staking contract address if resolution fails so reward events still display. Port of #344 (by @ygd58) from the dead v0.39 line to v0.40-dev. Supersedes #344. Fixes#341 Co-authored-by: Edgars <edgars@entropicsolutions.io> * feat(network): custom network profiles with deployment-file import (#362) * feat(network): custom network profiles with deployment-file import genlayer network add <alias> --base <built-in> [--deployment <json>] [--rpc <url>] [--consensus-main|--consensus-data|--staking|--fee-manager |--rounds-storage|--appeals <addr>] [--chain-id <n>] [--deployment-key <path>] Profiles persist as base + address overrides only; resolveNetwork loads the base chain fresh from genlayer-js and applies overrides, so ABIs never go stale. network set/list/info/remove and StakingAction --network accept custom aliases. The consensus deployments.json shape is parsed by walking the tree for ContractName->address leaves (ConsensusMain, ConsensusData, GenStaking/Staking, FeeManager, Rounds/RoundsStorage, Appeals); flags take precedence over the file. Adds a prepare script so npm install from a git ref builds dist. Verified: 576 vitest tests, full manual smoke (add/list/set/info/remove with a deployment file). * chore(deps): bump genlayer-js to v2-dev tip for vesting actions The locked v2-dev SHA (28e99fbc) predates the vesting client actions; vestingValidatorJoin and friends land at 666d1156. Verified live: vesting validator create succeeds against a #1162-branch consensus deployment. * docs(cli): regenerate API references; fix option placeholder regex The docs generator's option regex only matched <word> placeholders, so flags with dots or hyphens in the value name (--base <built-in-alias>, --deployment <path.json>, --deployment-key <dot.path>) were silently dropped from the options tables. Widen to <[^>]+> and regenerate: adds the network add/remove pages and the previously undocumented vesting command section (validator create/deposit/exit/claim, operator-transfer, set-identity, delegate/undelegate/claim/withdraw/list). * fix(vesting): resolve validator wallet address in create output The join receipt does not carry the new wallet address, so the output printed validatorWallet: undefined. Read getValidatorWallets from the vesting contract after the join and report the newest entry. Verified live against a #1162-branch deployment. * fix: make git install build lifecycle robust (#363) * fix: make git install build script self contained * chore: refresh genlayer-js lockfile * fix: make keychain dependency optional * fix: restore git prepare build * fix: include build dependency for git installs * chore: keep esbuild as dev dependency * ci: publish prereleases to npm dist tags (#364) * ci: add clarke cli tarball release * ci: publish prereleases to npm dist tags * Release v0.40.0-rc1 [skip ci] --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tobu <36818942+Tobu8888@users.noreply.github.com> Co-authored-by: Albert Castellana <acastellana@users.noreply.github.com> Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io>

renovate · 2026-05-22T12:17:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
uuid	`11.1.0` → `11.1.1`

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6()API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "import {v4,v5,v6} from './dist-node/index.js';const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';for (const [name,fn] of [ ['v4()',()=>v4({},new Uint8Array(8),4)], ['v5()',()=>v5('x',ns,new Uint8Array(8),4)], ['v6()',()=>v6({},new Uint8Array(8),4)],]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); }}"

Observed:

v4() THREW RangeError
v5() NO_THROW
v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
170, 170, 170, 170,
75, 224, 100, 63
]
v6 [
187, 187, 187, 187,
31, 19, 185, 64
]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4()/v1()/v7():

if(offset<0||offset+16>buf.length){thrownewRangeError(`UUID byte range ${offset}:${offset+15} is out of buffer bounds`);}

Apply to:

src/v35.ts (covers v3() and v5())
src/v6.ts

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

`v11.1.1`

Compare Source

Bug Fixes

backport GHSA-w5hq-g745-h8pq fix (32389c8)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:51Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

renovate · 2026-06-10T17:11:08Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:53Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

@ygd58

* fix(system): propagate command-check and version parse fixes to v0.40-dev (#350) Propagates #349 to v0.40-dev. * docs: add branching guide (#353) * docs: add branching guide * ci: harden testnet smoke timeout * feat: support fee profiles in contract commands (#355) * feat: support fee profiles in contract commands * test: make fee profile deploy test portable * feat: staking validators discovery (#357) * feat: add staking validators discovery * feat: epoch-aware validator listing with below-min indicator * fix(staking): account-less client for read-only staking queries getReadOnlyStakingClient threw 'Account not found' on fresh installs; listings and other reads don't need a local account. * feat: vesting commands (#358) * feat: add vesting commands * feat(vesting): validator subcommands — create/join, deposit, exit, claim, operator-transfer, set-identity, list/status Drives the CON-607 Vesting.sol validator leg through the SDK's named vestingValidator* actions; list/status enumerate getValidatorWallets with per-wallet deposited principal. * chore(deps): update dependency uuid to v11.1.1 [security] (#320) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(init): use backend provider id "google" for Gemini (#359) Selecting Gemini during `genlayer init` failed with: Requested providers '{'geminiai'}' do not match any stored providers. The selected provider id is forwarded verbatim to sim_createRandomValidators, but the backend's llm_provider table stores Gemini as "google". Rename the provider id geminiai -> google so it matches. Display name ("Gemini") and env var (GEMINI_API_KEY) are unchanged. Since "geminiai" never resolved to a valid provider, no working configuration relied on it. Fixes#271 Co-authored-by: Edgars Nemše <edgars@genlayerlabs.com> * fix(docs-sync): stop overwriting the generated root _meta.json (#352) The sync-docs workflow rsynced the generated category-based docs/api-references/_meta.json into genlayer-docs and then immediately overwrote it with a hardcoded heredoc containing the pre-grouping flat command list (init, up, deploy, ...). Those keys no longer match the directory layout, so the genlayer-docs sidebar rendered broken entries on every sync (fixed manually in genlayer-docs#426; this removes the cause). Also make the generated root meta complete: - add "index": "Overview" for the generated index.mdx - append ungrouped top-level commands (estimate-fees, finalize, finalize-batch) so they get explicit nav entries instead of relying on Nextra's implicit append Snapshot under docs/api-references regenerated against current main (picks up the new estimate-fees command and latest help text). Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io> * fix: drop getSlashingAddress from validator-history (#361) getSlashingAddress() was removed from the genlayer-js SDK (v0.39+/v2-dev), causing `genlayer staking validator-history` to crash with `client.getSlashingAddress is not a function` before any history is fetched. Resolve the idleness (slashing) contract address dynamically via viem readContract against consensusMainContract.getIdlenessAddress(), falling back to the staking contract address if resolution fails so reward events still display. Port of #344 (by @ygd58) from the dead v0.39 line to v0.40-dev. Supersedes #344. Fixes#341 Co-authored-by: Edgars <edgars@entropicsolutions.io> * feat(network): custom network profiles with deployment-file import (#362) * feat(network): custom network profiles with deployment-file import genlayer network add <alias> --base <built-in> [--deployment <json>] [--rpc <url>] [--consensus-main|--consensus-data|--staking|--fee-manager |--rounds-storage|--appeals <addr>] [--chain-id <n>] [--deployment-key <path>] Profiles persist as base + address overrides only; resolveNetwork loads the base chain fresh from genlayer-js and applies overrides, so ABIs never go stale. network set/list/info/remove and StakingAction --network accept custom aliases. The consensus deployments.json shape is parsed by walking the tree for ContractName->address leaves (ConsensusMain, ConsensusData, GenStaking/Staking, FeeManager, Rounds/RoundsStorage, Appeals); flags take precedence over the file. Adds a prepare script so npm install from a git ref builds dist. Verified: 576 vitest tests, full manual smoke (add/list/set/info/remove with a deployment file). * chore(deps): bump genlayer-js to v2-dev tip for vesting actions The locked v2-dev SHA (28e99fbc) predates the vesting client actions; vestingValidatorJoin and friends land at 666d1156. Verified live: vesting validator create succeeds against a #1162-branch consensus deployment. * docs(cli): regenerate API references; fix option placeholder regex The docs generator's option regex only matched <word> placeholders, so flags with dots or hyphens in the value name (--base <built-in-alias>, --deployment <path.json>, --deployment-key <dot.path>) were silently dropped from the options tables. Widen to <[^>]+> and regenerate: adds the network add/remove pages and the previously undocumented vesting command section (validator create/deposit/exit/claim, operator-transfer, set-identity, delegate/undelegate/claim/withdraw/list). * fix(vesting): resolve validator wallet address in create output The join receipt does not carry the new wallet address, so the output printed validatorWallet: undefined. Read getValidatorWallets from the vesting contract after the join and report the newest entry. Verified live against a #1162-branch deployment. * fix: make git install build lifecycle robust (#363) * fix: make git install build script self contained * chore: refresh genlayer-js lockfile * fix: make keychain dependency optional * fix: restore git prepare build * fix: include build dependency for git installs * chore: keep esbuild as dev dependency * ci: publish prereleases to npm dist tags (#364) * ci: add clarke cli tarball release * ci: publish prereleases to npm dist tags * Release v0.40.0-rc1 [skip ci] --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tobu <36818942+Tobu8888@users.noreply.github.com> Co-authored-by: Albert Castellana <acastellana@users.noreply.github.com> Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io>

renovate · 2026-05-22T12:17:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
uuid	`11.1.0` → `11.1.1`

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6()API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "import {v4,v5,v6} from './dist-node/index.js';const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';for (const [name,fn] of [ ['v4()',()=>v4({},new Uint8Array(8),4)], ['v5()',()=>v5('x',ns,new Uint8Array(8),4)], ['v6()',()=>v6({},new Uint8Array(8),4)],]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); }}"

Observed:

v4() THREW RangeError
v5() NO_THROW
v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
170, 170, 170, 170,
75, 224, 100, 63
]
v6 [
187, 187, 187, 187,
31, 19, 185, 64
]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4()/v1()/v7():

if(offset<0||offset+16>buf.length){thrownewRangeError(`UUID byte range ${offset}:${offset+15} is out of buffer bounds`);}

Apply to:

src/v35.ts (covers v3() and v5())
src/v6.ts

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

`v11.1.1`

Compare Source

Bug Fixes

backport GHSA-w5hq-g745-h8pq fix (32389c8)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:51Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

renovate · 2026-06-10T17:11:08Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:53Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

@ygd58

* fix(system): propagate command-check and version parse fixes to v0.40-dev (#350) Propagates #349 to v0.40-dev. * docs: add branching guide (#353) * docs: add branching guide * ci: harden testnet smoke timeout * feat: support fee profiles in contract commands (#355) * feat: support fee profiles in contract commands * test: make fee profile deploy test portable * feat: staking validators discovery (#357) * feat: add staking validators discovery * feat: epoch-aware validator listing with below-min indicator * fix(staking): account-less client for read-only staking queries getReadOnlyStakingClient threw 'Account not found' on fresh installs; listings and other reads don't need a local account. * feat: vesting commands (#358) * feat: add vesting commands * feat(vesting): validator subcommands — create/join, deposit, exit, claim, operator-transfer, set-identity, list/status Drives the CON-607 Vesting.sol validator leg through the SDK's named vestingValidator* actions; list/status enumerate getValidatorWallets with per-wallet deposited principal. * chore(deps): update dependency uuid to v11.1.1 [security] (#320) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(init): use backend provider id "google" for Gemini (#359) Selecting Gemini during `genlayer init` failed with: Requested providers '{'geminiai'}' do not match any stored providers. The selected provider id is forwarded verbatim to sim_createRandomValidators, but the backend's llm_provider table stores Gemini as "google". Rename the provider id geminiai -> google so it matches. Display name ("Gemini") and env var (GEMINI_API_KEY) are unchanged. Since "geminiai" never resolved to a valid provider, no working configuration relied on it. Fixes#271 Co-authored-by: Edgars Nemše <edgars@genlayerlabs.com> * fix(docs-sync): stop overwriting the generated root _meta.json (#352) The sync-docs workflow rsynced the generated category-based docs/api-references/_meta.json into genlayer-docs and then immediately overwrote it with a hardcoded heredoc containing the pre-grouping flat command list (init, up, deploy, ...). Those keys no longer match the directory layout, so the genlayer-docs sidebar rendered broken entries on every sync (fixed manually in genlayer-docs#426; this removes the cause). Also make the generated root meta complete: - add "index": "Overview" for the generated index.mdx - append ungrouped top-level commands (estimate-fees, finalize, finalize-batch) so they get explicit nav entries instead of relying on Nextra's implicit append Snapshot under docs/api-references regenerated against current main (picks up the new estimate-fees command and latest help text). Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io> * fix: drop getSlashingAddress from validator-history (#361) getSlashingAddress() was removed from the genlayer-js SDK (v0.39+/v2-dev), causing `genlayer staking validator-history` to crash with `client.getSlashingAddress is not a function` before any history is fetched. Resolve the idleness (slashing) contract address dynamically via viem readContract against consensusMainContract.getIdlenessAddress(), falling back to the staking contract address if resolution fails so reward events still display. Port of #344 (by @ygd58) from the dead v0.39 line to v0.40-dev. Supersedes #344. Fixes#341 Co-authored-by: Edgars <edgars@entropicsolutions.io> * feat(network): custom network profiles with deployment-file import (#362) * feat(network): custom network profiles with deployment-file import genlayer network add <alias> --base <built-in> [--deployment <json>] [--rpc <url>] [--consensus-main|--consensus-data|--staking|--fee-manager |--rounds-storage|--appeals <addr>] [--chain-id <n>] [--deployment-key <path>] Profiles persist as base + address overrides only; resolveNetwork loads the base chain fresh from genlayer-js and applies overrides, so ABIs never go stale. network set/list/info/remove and StakingAction --network accept custom aliases. The consensus deployments.json shape is parsed by walking the tree for ContractName->address leaves (ConsensusMain, ConsensusData, GenStaking/Staking, FeeManager, Rounds/RoundsStorage, Appeals); flags take precedence over the file. Adds a prepare script so npm install from a git ref builds dist. Verified: 576 vitest tests, full manual smoke (add/list/set/info/remove with a deployment file). * chore(deps): bump genlayer-js to v2-dev tip for vesting actions The locked v2-dev SHA (28e99fbc) predates the vesting client actions; vestingValidatorJoin and friends land at 666d1156. Verified live: vesting validator create succeeds against a #1162-branch consensus deployment. * docs(cli): regenerate API references; fix option placeholder regex The docs generator's option regex only matched <word> placeholders, so flags with dots or hyphens in the value name (--base <built-in-alias>, --deployment <path.json>, --deployment-key <dot.path>) were silently dropped from the options tables. Widen to <[^>]+> and regenerate: adds the network add/remove pages and the previously undocumented vesting command section (validator create/deposit/exit/claim, operator-transfer, set-identity, delegate/undelegate/claim/withdraw/list). * fix(vesting): resolve validator wallet address in create output The join receipt does not carry the new wallet address, so the output printed validatorWallet: undefined. Read getValidatorWallets from the vesting contract after the join and report the newest entry. Verified live against a #1162-branch deployment. * fix: make git install build lifecycle robust (#363) * fix: make git install build script self contained * chore: refresh genlayer-js lockfile * fix: make keychain dependency optional * fix: restore git prepare build * fix: include build dependency for git installs * chore: keep esbuild as dev dependency * ci: publish prereleases to npm dist tags (#364) * ci: add clarke cli tarball release * ci: publish prereleases to npm dist tags * Release v0.40.0-rc1 [skip ci] --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tobu <36818942+Tobu8888@users.noreply.github.com> Co-authored-by: Albert Castellana <acastellana@users.noreply.github.com> Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io>

renovate · 2026-05-22T12:17:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
uuid	`11.1.0` → `11.1.1`

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6()API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "import {v4,v5,v6} from './dist-node/index.js';const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';for (const [name,fn] of [ ['v4()',()=>v4({},new Uint8Array(8),4)], ['v5()',()=>v5('x',ns,new Uint8Array(8),4)], ['v6()',()=>v6({},new Uint8Array(8),4)],]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); }}"

Observed:

v4() THREW RangeError
v5() NO_THROW
v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
170, 170, 170, 170,
75, 224, 100, 63
]
v6 [
187, 187, 187, 187,
31, 19, 185, 64
]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4()/v1()/v7():

if(offset<0||offset+16>buf.length){thrownewRangeError(`UUID byte range ${offset}:${offset+15} is out of buffer bounds`);}

Apply to:

src/v35.ts (covers v3() and v5())
src/v6.ts

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

`v11.1.1`

Compare Source

Bug Fixes

backport GHSA-w5hq-g745-h8pq fix (32389c8)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:51Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

renovate · 2026-06-10T17:11:08Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:53Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

@ygd58

* fix(system): propagate command-check and version parse fixes to v0.40-dev (#350) Propagates #349 to v0.40-dev. * docs: add branching guide (#353) * docs: add branching guide * ci: harden testnet smoke timeout * feat: support fee profiles in contract commands (#355) * feat: support fee profiles in contract commands * test: make fee profile deploy test portable * feat: staking validators discovery (#357) * feat: add staking validators discovery * feat: epoch-aware validator listing with below-min indicator * fix(staking): account-less client for read-only staking queries getReadOnlyStakingClient threw 'Account not found' on fresh installs; listings and other reads don't need a local account. * feat: vesting commands (#358) * feat: add vesting commands * feat(vesting): validator subcommands — create/join, deposit, exit, claim, operator-transfer, set-identity, list/status Drives the CON-607 Vesting.sol validator leg through the SDK's named vestingValidator* actions; list/status enumerate getValidatorWallets with per-wallet deposited principal. * chore(deps): update dependency uuid to v11.1.1 [security] (#320) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(init): use backend provider id "google" for Gemini (#359) Selecting Gemini during `genlayer init` failed with: Requested providers '{'geminiai'}' do not match any stored providers. The selected provider id is forwarded verbatim to sim_createRandomValidators, but the backend's llm_provider table stores Gemini as "google". Rename the provider id geminiai -> google so it matches. Display name ("Gemini") and env var (GEMINI_API_KEY) are unchanged. Since "geminiai" never resolved to a valid provider, no working configuration relied on it. Fixes#271 Co-authored-by: Edgars Nemše <edgars@genlayerlabs.com> * fix(docs-sync): stop overwriting the generated root _meta.json (#352) The sync-docs workflow rsynced the generated category-based docs/api-references/_meta.json into genlayer-docs and then immediately overwrote it with a hardcoded heredoc containing the pre-grouping flat command list (init, up, deploy, ...). Those keys no longer match the directory layout, so the genlayer-docs sidebar rendered broken entries on every sync (fixed manually in genlayer-docs#426; this removes the cause). Also make the generated root meta complete: - add "index": "Overview" for the generated index.mdx - append ungrouped top-level commands (estimate-fees, finalize, finalize-batch) so they get explicit nav entries instead of relying on Nextra's implicit append Snapshot under docs/api-references regenerated against current main (picks up the new estimate-fees command and latest help text). Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io> * fix: drop getSlashingAddress from validator-history (#361) getSlashingAddress() was removed from the genlayer-js SDK (v0.39+/v2-dev), causing `genlayer staking validator-history` to crash with `client.getSlashingAddress is not a function` before any history is fetched. Resolve the idleness (slashing) contract address dynamically via viem readContract against consensusMainContract.getIdlenessAddress(), falling back to the staking contract address if resolution fails so reward events still display. Port of #344 (by @ygd58) from the dead v0.39 line to v0.40-dev. Supersedes #344. Fixes#341 Co-authored-by: Edgars <edgars@entropicsolutions.io> * feat(network): custom network profiles with deployment-file import (#362) * feat(network): custom network profiles with deployment-file import genlayer network add <alias> --base <built-in> [--deployment <json>] [--rpc <url>] [--consensus-main|--consensus-data|--staking|--fee-manager |--rounds-storage|--appeals <addr>] [--chain-id <n>] [--deployment-key <path>] Profiles persist as base + address overrides only; resolveNetwork loads the base chain fresh from genlayer-js and applies overrides, so ABIs never go stale. network set/list/info/remove and StakingAction --network accept custom aliases. The consensus deployments.json shape is parsed by walking the tree for ContractName->address leaves (ConsensusMain, ConsensusData, GenStaking/Staking, FeeManager, Rounds/RoundsStorage, Appeals); flags take precedence over the file. Adds a prepare script so npm install from a git ref builds dist. Verified: 576 vitest tests, full manual smoke (add/list/set/info/remove with a deployment file). * chore(deps): bump genlayer-js to v2-dev tip for vesting actions The locked v2-dev SHA (28e99fbc) predates the vesting client actions; vestingValidatorJoin and friends land at 666d1156. Verified live: vesting validator create succeeds against a #1162-branch consensus deployment. * docs(cli): regenerate API references; fix option placeholder regex The docs generator's option regex only matched <word> placeholders, so flags with dots or hyphens in the value name (--base <built-in-alias>, --deployment <path.json>, --deployment-key <dot.path>) were silently dropped from the options tables. Widen to <[^>]+> and regenerate: adds the network add/remove pages and the previously undocumented vesting command section (validator create/deposit/exit/claim, operator-transfer, set-identity, delegate/undelegate/claim/withdraw/list). * fix(vesting): resolve validator wallet address in create output The join receipt does not carry the new wallet address, so the output printed validatorWallet: undefined. Read getValidatorWallets from the vesting contract after the join and report the newest entry. Verified live against a #1162-branch deployment. * fix: make git install build lifecycle robust (#363) * fix: make git install build script self contained * chore: refresh genlayer-js lockfile * fix: make keychain dependency optional * fix: restore git prepare build * fix: include build dependency for git installs * chore: keep esbuild as dev dependency * ci: publish prereleases to npm dist tags (#364) * ci: add clarke cli tarball release * ci: publish prereleases to npm dist tags * Release v0.40.0-rc1 [skip ci] --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tobu <36818942+Tobu8888@users.noreply.github.com> Co-authored-by: Albert Castellana <acastellana@users.noreply.github.com> Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io>

renovate · 2026-05-22T12:17:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
uuid	`11.1.0` → `11.1.1`

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6()API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "import {v4,v5,v6} from './dist-node/index.js';const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';for (const [name,fn] of [ ['v4()',()=>v4({},new Uint8Array(8),4)], ['v5()',()=>v5('x',ns,new Uint8Array(8),4)], ['v6()',()=>v6({},new Uint8Array(8),4)],]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); }}"

Observed:

v4() THREW RangeError
v5() NO_THROW
v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
170, 170, 170, 170,
75, 224, 100, 63
]
v6 [
187, 187, 187, 187,
31, 19, 185, 64
]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4()/v1()/v7():

if(offset<0||offset+16>buf.length){thrownewRangeError(`UUID byte range ${offset}:${offset+15} is out of buffer bounds`);}

Apply to:

src/v35.ts (covers v3() and v5())
src/v6.ts

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

`v11.1.1`

Compare Source

Bug Fixes

backport GHSA-w5hq-g745-h8pq fix (32389c8)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:51Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

renovate · 2026-06-10T17:11:08Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:53Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

@ygd58

* fix(system): propagate command-check and version parse fixes to v0.40-dev (#350) Propagates #349 to v0.40-dev. * docs: add branching guide (#353) * docs: add branching guide * ci: harden testnet smoke timeout * feat: support fee profiles in contract commands (#355) * feat: support fee profiles in contract commands * test: make fee profile deploy test portable * feat: staking validators discovery (#357) * feat: add staking validators discovery * feat: epoch-aware validator listing with below-min indicator * fix(staking): account-less client for read-only staking queries getReadOnlyStakingClient threw 'Account not found' on fresh installs; listings and other reads don't need a local account. * feat: vesting commands (#358) * feat: add vesting commands * feat(vesting): validator subcommands — create/join, deposit, exit, claim, operator-transfer, set-identity, list/status Drives the CON-607 Vesting.sol validator leg through the SDK's named vestingValidator* actions; list/status enumerate getValidatorWallets with per-wallet deposited principal. * chore(deps): update dependency uuid to v11.1.1 [security] (#320) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(init): use backend provider id "google" for Gemini (#359) Selecting Gemini during `genlayer init` failed with: Requested providers '{'geminiai'}' do not match any stored providers. The selected provider id is forwarded verbatim to sim_createRandomValidators, but the backend's llm_provider table stores Gemini as "google". Rename the provider id geminiai -> google so it matches. Display name ("Gemini") and env var (GEMINI_API_KEY) are unchanged. Since "geminiai" never resolved to a valid provider, no working configuration relied on it. Fixes#271 Co-authored-by: Edgars Nemše <edgars@genlayerlabs.com> * fix(docs-sync): stop overwriting the generated root _meta.json (#352) The sync-docs workflow rsynced the generated category-based docs/api-references/_meta.json into genlayer-docs and then immediately overwrote it with a hardcoded heredoc containing the pre-grouping flat command list (init, up, deploy, ...). Those keys no longer match the directory layout, so the genlayer-docs sidebar rendered broken entries on every sync (fixed manually in genlayer-docs#426; this removes the cause). Also make the generated root meta complete: - add "index": "Overview" for the generated index.mdx - append ungrouped top-level commands (estimate-fees, finalize, finalize-batch) so they get explicit nav entries instead of relying on Nextra's implicit append Snapshot under docs/api-references regenerated against current main (picks up the new estimate-fees command and latest help text). Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io> * fix: drop getSlashingAddress from validator-history (#361) getSlashingAddress() was removed from the genlayer-js SDK (v0.39+/v2-dev), causing `genlayer staking validator-history` to crash with `client.getSlashingAddress is not a function` before any history is fetched. Resolve the idleness (slashing) contract address dynamically via viem readContract against consensusMainContract.getIdlenessAddress(), falling back to the staking contract address if resolution fails so reward events still display. Port of #344 (by @ygd58) from the dead v0.39 line to v0.40-dev. Supersedes #344. Fixes#341 Co-authored-by: Edgars <edgars@entropicsolutions.io> * feat(network): custom network profiles with deployment-file import (#362) * feat(network): custom network profiles with deployment-file import genlayer network add <alias> --base <built-in> [--deployment <json>] [--rpc <url>] [--consensus-main|--consensus-data|--staking|--fee-manager |--rounds-storage|--appeals <addr>] [--chain-id <n>] [--deployment-key <path>] Profiles persist as base + address overrides only; resolveNetwork loads the base chain fresh from genlayer-js and applies overrides, so ABIs never go stale. network set/list/info/remove and StakingAction --network accept custom aliases. The consensus deployments.json shape is parsed by walking the tree for ContractName->address leaves (ConsensusMain, ConsensusData, GenStaking/Staking, FeeManager, Rounds/RoundsStorage, Appeals); flags take precedence over the file. Adds a prepare script so npm install from a git ref builds dist. Verified: 576 vitest tests, full manual smoke (add/list/set/info/remove with a deployment file). * chore(deps): bump genlayer-js to v2-dev tip for vesting actions The locked v2-dev SHA (28e99fbc) predates the vesting client actions; vestingValidatorJoin and friends land at 666d1156. Verified live: vesting validator create succeeds against a #1162-branch consensus deployment. * docs(cli): regenerate API references; fix option placeholder regex The docs generator's option regex only matched <word> placeholders, so flags with dots or hyphens in the value name (--base <built-in-alias>, --deployment <path.json>, --deployment-key <dot.path>) were silently dropped from the options tables. Widen to <[^>]+> and regenerate: adds the network add/remove pages and the previously undocumented vesting command section (validator create/deposit/exit/claim, operator-transfer, set-identity, delegate/undelegate/claim/withdraw/list). * fix(vesting): resolve validator wallet address in create output The join receipt does not carry the new wallet address, so the output printed validatorWallet: undefined. Read getValidatorWallets from the vesting contract after the join and report the newest entry. Verified live against a #1162-branch deployment. * fix: make git install build lifecycle robust (#363) * fix: make git install build script self contained * chore: refresh genlayer-js lockfile * fix: make keychain dependency optional * fix: restore git prepare build * fix: include build dependency for git installs * chore: keep esbuild as dev dependency * ci: publish prereleases to npm dist tags (#364) * ci: add clarke cli tarball release * ci: publish prereleases to npm dist tags * Release v0.40.0-rc1 [skip ci] --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tobu <36818942+Tobu8888@users.noreply.github.com> Co-authored-by: Albert Castellana <acastellana@users.noreply.github.com> Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io>

renovate · 2026-05-22T12:17:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
uuid	`11.1.0` → `11.1.1`

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6()API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "import {v4,v5,v6} from './dist-node/index.js';const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';for (const [name,fn] of [ ['v4()',()=>v4({},new Uint8Array(8),4)], ['v5()',()=>v5('x',ns,new Uint8Array(8),4)], ['v6()',()=>v6({},new Uint8Array(8),4)],]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); }}"

Observed:

v4() THREW RangeError
v5() NO_THROW
v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
170, 170, 170, 170,
75, 224, 100, 63
]
v6 [
187, 187, 187, 187,
31, 19, 185, 64
]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4()/v1()/v7():

if(offset<0||offset+16>buf.length){thrownewRangeError(`UUID byte range ${offset}:${offset+15} is out of buffer bounds`);}

Apply to:

src/v35.ts (covers v3() and v5())
src/v6.ts

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

`v11.1.1`

Compare Source

Bug Fixes

backport GHSA-w5hq-g745-h8pq fix (32389c8)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:51Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

renovate · 2026-06-10T17:11:08Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:53Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

@ygd58

* fix(system): propagate command-check and version parse fixes to v0.40-dev (#350) Propagates #349 to v0.40-dev. * docs: add branching guide (#353) * docs: add branching guide * ci: harden testnet smoke timeout * feat: support fee profiles in contract commands (#355) * feat: support fee profiles in contract commands * test: make fee profile deploy test portable * feat: staking validators discovery (#357) * feat: add staking validators discovery * feat: epoch-aware validator listing with below-min indicator * fix(staking): account-less client for read-only staking queries getReadOnlyStakingClient threw 'Account not found' on fresh installs; listings and other reads don't need a local account. * feat: vesting commands (#358) * feat: add vesting commands * feat(vesting): validator subcommands — create/join, deposit, exit, claim, operator-transfer, set-identity, list/status Drives the CON-607 Vesting.sol validator leg through the SDK's named vestingValidator* actions; list/status enumerate getValidatorWallets with per-wallet deposited principal. * chore(deps): update dependency uuid to v11.1.1 [security] (#320) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(init): use backend provider id "google" for Gemini (#359) Selecting Gemini during `genlayer init` failed with: Requested providers '{'geminiai'}' do not match any stored providers. The selected provider id is forwarded verbatim to sim_createRandomValidators, but the backend's llm_provider table stores Gemini as "google". Rename the provider id geminiai -> google so it matches. Display name ("Gemini") and env var (GEMINI_API_KEY) are unchanged. Since "geminiai" never resolved to a valid provider, no working configuration relied on it. Fixes#271 Co-authored-by: Edgars Nemše <edgars@genlayerlabs.com> * fix(docs-sync): stop overwriting the generated root _meta.json (#352) The sync-docs workflow rsynced the generated category-based docs/api-references/_meta.json into genlayer-docs and then immediately overwrote it with a hardcoded heredoc containing the pre-grouping flat command list (init, up, deploy, ...). Those keys no longer match the directory layout, so the genlayer-docs sidebar rendered broken entries on every sync (fixed manually in genlayer-docs#426; this removes the cause). Also make the generated root meta complete: - add "index": "Overview" for the generated index.mdx - append ungrouped top-level commands (estimate-fees, finalize, finalize-batch) so they get explicit nav entries instead of relying on Nextra's implicit append Snapshot under docs/api-references regenerated against current main (picks up the new estimate-fees command and latest help text). Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io> * fix: drop getSlashingAddress from validator-history (#361) getSlashingAddress() was removed from the genlayer-js SDK (v0.39+/v2-dev), causing `genlayer staking validator-history` to crash with `client.getSlashingAddress is not a function` before any history is fetched. Resolve the idleness (slashing) contract address dynamically via viem readContract against consensusMainContract.getIdlenessAddress(), falling back to the staking contract address if resolution fails so reward events still display. Port of #344 (by @ygd58) from the dead v0.39 line to v0.40-dev. Supersedes #344. Fixes#341 Co-authored-by: Edgars <edgars@entropicsolutions.io> * feat(network): custom network profiles with deployment-file import (#362) * feat(network): custom network profiles with deployment-file import genlayer network add <alias> --base <built-in> [--deployment <json>] [--rpc <url>] [--consensus-main|--consensus-data|--staking|--fee-manager |--rounds-storage|--appeals <addr>] [--chain-id <n>] [--deployment-key <path>] Profiles persist as base + address overrides only; resolveNetwork loads the base chain fresh from genlayer-js and applies overrides, so ABIs never go stale. network set/list/info/remove and StakingAction --network accept custom aliases. The consensus deployments.json shape is parsed by walking the tree for ContractName->address leaves (ConsensusMain, ConsensusData, GenStaking/Staking, FeeManager, Rounds/RoundsStorage, Appeals); flags take precedence over the file. Adds a prepare script so npm install from a git ref builds dist. Verified: 576 vitest tests, full manual smoke (add/list/set/info/remove with a deployment file). * chore(deps): bump genlayer-js to v2-dev tip for vesting actions The locked v2-dev SHA (28e99fbc) predates the vesting client actions; vestingValidatorJoin and friends land at 666d1156. Verified live: vesting validator create succeeds against a #1162-branch consensus deployment. * docs(cli): regenerate API references; fix option placeholder regex The docs generator's option regex only matched <word> placeholders, so flags with dots or hyphens in the value name (--base <built-in-alias>, --deployment <path.json>, --deployment-key <dot.path>) were silently dropped from the options tables. Widen to <[^>]+> and regenerate: adds the network add/remove pages and the previously undocumented vesting command section (validator create/deposit/exit/claim, operator-transfer, set-identity, delegate/undelegate/claim/withdraw/list). * fix(vesting): resolve validator wallet address in create output The join receipt does not carry the new wallet address, so the output printed validatorWallet: undefined. Read getValidatorWallets from the vesting contract after the join and report the newest entry. Verified live against a #1162-branch deployment. * fix: make git install build lifecycle robust (#363) * fix: make git install build script self contained * chore: refresh genlayer-js lockfile * fix: make keychain dependency optional * fix: restore git prepare build * fix: include build dependency for git installs * chore: keep esbuild as dev dependency * ci: publish prereleases to npm dist tags (#364) * ci: add clarke cli tarball release * ci: publish prereleases to npm dist tags * Release v0.40.0-rc1 [skip ci] --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tobu <36818942+Tobu8888@users.noreply.github.com> Co-authored-by: Albert Castellana <acastellana@users.noreply.github.com> Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io>

renovate · 2026-05-22T12:17:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
uuid	`11.1.0` → `11.1.1`

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6()API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "import {v4,v5,v6} from './dist-node/index.js';const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';for (const [name,fn] of [ ['v4()',()=>v4({},new Uint8Array(8),4)], ['v5()',()=>v5('x',ns,new Uint8Array(8),4)], ['v6()',()=>v6({},new Uint8Array(8),4)],]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); }}"

Observed:

v4() THREW RangeError
v5() NO_THROW
v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
170, 170, 170, 170,
75, 224, 100, 63
]
v6 [
187, 187, 187, 187,
31, 19, 185, 64
]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4()/v1()/v7():

if(offset<0||offset+16>buf.length){thrownewRangeError(`UUID byte range ${offset}:${offset+15} is out of buffer bounds`);}

Apply to:

src/v35.ts (covers v3() and v5())
src/v6.ts

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

`v11.1.1`

Compare Source

Bug Fixes

backport GHSA-w5hq-g745-h8pq fix (32389c8)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:45Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-06-10T14:57:51Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

renovate · 2026-06-10T17:11:08Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:52Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

github-actions · 2026-07-01T21:30:53Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.40-dev, the active development branch. Pushes to v0.40-dev automatically fast-forward main.

@ygd58

* fix(system): propagate command-check and version parse fixes to v0.40-dev (#350) Propagates #349 to v0.40-dev. * docs: add branching guide (#353) * docs: add branching guide * ci: harden testnet smoke timeout * feat: support fee profiles in contract commands (#355) * feat: support fee profiles in contract commands * test: make fee profile deploy test portable * feat: staking validators discovery (#357) * feat: add staking validators discovery * feat: epoch-aware validator listing with below-min indicator * fix(staking): account-less client for read-only staking queries getReadOnlyStakingClient threw 'Account not found' on fresh installs; listings and other reads don't need a local account. * feat: vesting commands (#358) * feat: add vesting commands * feat(vesting): validator subcommands — create/join, deposit, exit, claim, operator-transfer, set-identity, list/status Drives the CON-607 Vesting.sol validator leg through the SDK's named vestingValidator* actions; list/status enumerate getValidatorWallets with per-wallet deposited principal. * chore(deps): update dependency uuid to v11.1.1 [security] (#320) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(init): use backend provider id "google" for Gemini (#359) Selecting Gemini during `genlayer init` failed with: Requested providers '{'geminiai'}' do not match any stored providers. The selected provider id is forwarded verbatim to sim_createRandomValidators, but the backend's llm_provider table stores Gemini as "google". Rename the provider id geminiai -> google so it matches. Display name ("Gemini") and env var (GEMINI_API_KEY) are unchanged. Since "geminiai" never resolved to a valid provider, no working configuration relied on it. Fixes#271 Co-authored-by: Edgars Nemše <edgars@genlayerlabs.com> * fix(docs-sync): stop overwriting the generated root _meta.json (#352) The sync-docs workflow rsynced the generated category-based docs/api-references/_meta.json into genlayer-docs and then immediately overwrote it with a hardcoded heredoc containing the pre-grouping flat command list (init, up, deploy, ...). Those keys no longer match the directory layout, so the genlayer-docs sidebar rendered broken entries on every sync (fixed manually in genlayer-docs#426; this removes the cause). Also make the generated root meta complete: - add "index": "Overview" for the generated index.mdx - append ungrouped top-level commands (estimate-fees, finalize, finalize-batch) so they get explicit nav entries instead of relying on Nextra's implicit append Snapshot under docs/api-references regenerated against current main (picks up the new estimate-fees command and latest help text). Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io> * fix: drop getSlashingAddress from validator-history (#361) getSlashingAddress() was removed from the genlayer-js SDK (v0.39+/v2-dev), causing `genlayer staking validator-history` to crash with `client.getSlashingAddress is not a function` before any history is fetched. Resolve the idleness (slashing) contract address dynamically via viem readContract against consensusMainContract.getIdlenessAddress(), falling back to the staking contract address if resolution fails so reward events still display. Port of #344 (by @ygd58) from the dead v0.39 line to v0.40-dev. Supersedes #344. Fixes#341 Co-authored-by: Edgars <edgars@entropicsolutions.io> * feat(network): custom network profiles with deployment-file import (#362) * feat(network): custom network profiles with deployment-file import genlayer network add <alias> --base <built-in> [--deployment <json>] [--rpc <url>] [--consensus-main|--consensus-data|--staking|--fee-manager |--rounds-storage|--appeals <addr>] [--chain-id <n>] [--deployment-key <path>] Profiles persist as base + address overrides only; resolveNetwork loads the base chain fresh from genlayer-js and applies overrides, so ABIs never go stale. network set/list/info/remove and StakingAction --network accept custom aliases. The consensus deployments.json shape is parsed by walking the tree for ContractName->address leaves (ConsensusMain, ConsensusData, GenStaking/Staking, FeeManager, Rounds/RoundsStorage, Appeals); flags take precedence over the file. Adds a prepare script so npm install from a git ref builds dist. Verified: 576 vitest tests, full manual smoke (add/list/set/info/remove with a deployment file). * chore(deps): bump genlayer-js to v2-dev tip for vesting actions The locked v2-dev SHA (28e99fbc) predates the vesting client actions; vestingValidatorJoin and friends land at 666d1156. Verified live: vesting validator create succeeds against a #1162-branch consensus deployment. * docs(cli): regenerate API references; fix option placeholder regex The docs generator's option regex only matched <word> placeholders, so flags with dots or hyphens in the value name (--base <built-in-alias>, --deployment <path.json>, --deployment-key <dot.path>) were silently dropped from the options tables. Widen to <[^>]+> and regenerate: adds the network add/remove pages and the previously undocumented vesting command section (validator create/deposit/exit/claim, operator-transfer, set-identity, delegate/undelegate/claim/withdraw/list). * fix(vesting): resolve validator wallet address in create output The join receipt does not carry the new wallet address, so the output printed validatorWallet: undefined. Read getValidatorWallets from the vesting contract after the join and report the newest entry. Verified live against a #1162-branch deployment. * fix: make git install build lifecycle robust (#363) * fix: make git install build script self contained * chore: refresh genlayer-js lockfile * fix: make keychain dependency optional * fix: restore git prepare build * fix: include build dependency for git installs * chore: keep esbuild as dev dependency * ci: publish prereleases to npm dist tags (#364) * ci: add clarke cli tarball release * ci: publish prereleases to npm dist tags * Release v0.40.0-rc1 [skip ci] --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tobu <36818942+Tobu8888@users.noreply.github.com> Co-authored-by: Albert Castellana <acastellana@users.noreply.github.com> Co-authored-by: Albert Castellana <albert@genlayer.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Edgars <edgars@entropicsolutions.io>

renovateBotforce-pushed the renovate/npm-uuid-vulnerability branch 2 times, most recently from b681dae to 7fe547cCompare May 28, 2026 21:02

renovateBotforce-pushed the renovate/npm-uuid-vulnerability branch from 7fe547c to 7677f37Compare June 10, 2026 14:57

renovateBot changed the base branch from v0.39 to mainJune 10, 2026 14:57

github-actionsBot changed the base branch from main to v0.40-devJune 10, 2026 14:57

renovateBot changed the title ~~chore(deps): update dependency uuid to v11.1.1 [security]~~chore(deps): update dependency uuid to v11.1.1 [security] - autoclosedJul 1, 2026

renovateBot closed this Jul 1, 2026

renovateBot deleted the renovate/npm-uuid-vulnerability branch July 1, 2026 01:05

chore(deps): update dependency uuid to v11.1.1 [security]
33fa729

renovateBot changed the title ~~chore(deps): update dependency uuid to v11.1.1 [security] - autoclosed~~chore(deps): update dependency uuid to v11.1.1 [security]Jul 1, 2026

renovateBot reopened this Jul 1, 2026

renovateBotforce-pushed the renovate/npm-uuid-vulnerability branch from 33fa729 to 7677f37Compare July 1, 2026 21:30

renovateBot changed the base branch from v0.40-dev to mainJuly 1, 2026 21:30

renovateBotforce-pushed the renovate/npm-uuid-vulnerability branch from 7677f37 to 33fa729Compare July 1, 2026 21:30

github-actionsBot changed the base branch from main to v0.40-devJuly 1, 2026 21:30

MuncleUscles merged commit 45a3ce9 into v0.40-devJul 7, 2026
20 of 21 checks passed