OpenZeppelin / defender-client

Monorepo for all defender-client npm packages
https://docs.openzeppelin.com/defender/
MIT License
56 stars 47 forks source link

[Snyk] Security upgrade ethers from 5.7.2 to 6.0.0 #588

Open tirumerla opened 3 months ago

tirumerla commented 3 months ago

This PR was automatically created by Snyk using the credentials of a real user.


![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123) ### Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project. #### Snyk changed the following file(s): - `examples/keeper-network/package.json` #### Note for [zero-installs](https://yarnpkg.com/features/zero-installs) users If you are using the Yarn feature [zero-installs](https://yarnpkg.com/features/zero-installs) that was introduced in Yarn V2, note that this PR does not update the `.yarn/cache/` directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run `yarn` to update the contents of the `./yarn/cache` directory. If you are not using zero-install you can ignore this as your flow should likely be unchanged.
⚠️ Warning ``` Failed to update the yarn.lock, please update manually before merging. ```
#### Vulnerabilities that will be fixed with an upgrade: | | Issue | Score | :-------------------------:|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png 'high severity') | Denial of Service (DoS)
[SNYK-JS-WS-7266574](https://snyk.io/vuln/SNYK-JS-WS-7266574) |   **768**   --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - Max score is 1000. Note that the real score may have changed since the PR was raised. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._ For more information: 🧐 [View latest project report](https://app.snyk.io/org/carlosfkrause/project/99d26e03-2d54-4d45-b5e6-aa5056b705bc?utm_source=github&utm_medium=referral&page=fix-pr) 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates) 🛠 [Adjust project settings](https://app.snyk.io/org/carlosfkrause/project/99d26e03-2d54-4d45-b5e6-aa5056b705bc?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Denial of Service (DoS)](https://learn.snyk.io/lesson/redos/?loc=fix-pr) [//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"ethers","from":"5.7.2","to":"6.0.0"}],"env":"prod","issuesToFix":[{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-WS-7266574","priority_score":768,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"freshness","label":true,"score":71},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"}],"prId":"81962bc5-93e9-4a13-a9a3-42b747117ce5","prPublicId":"81962bc5-93e9-4a13-a9a3-42b747117ce5","packageManager":"yarn","priorityScoreList":[768],"projectPublicId":"99d26e03-2d54-4d45-b5e6-aa5056b705bc","projectUrl":"https://app.snyk.io/org/carlosfkrause/project/99d26e03-2d54-4d45-b5e6-aa5056b705bc?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","pr-warning-shown","priorityScore"],"type":"auto","upgrade":["SNYK-JS-WS-7266574"],"vulns":["SNYK-JS-WS-7266574"],"patch":[],"isBreakingChange":true,"remediationStrategy":"vuln"}'
socket-security[bot] commented 3 months ago

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/jest-util@29.7.0 environment +7 606 kB simenb
npm/js-yaml@4.1.0 None 0 405 kB vitaly
npm/json-stringify-safe@5.0.1 None 0 12.7 kB isaacs
npm/json5@2.2.3 None 0 235 kB jordanbtucker
npm/jsonfile@6.1.0 filesystem +1 24.4 kB ryanzim
npm/jsonparse@1.3.1 None 0 36.8 kB creationix
npm/keyv@4.5.4 None +1 33.2 kB jaredwray
npm/kind-of@6.0.3 None 0 22.8 kB doowb
npm/lerna@7.4.2 Transitive: environment, eval, filesystem, network, shell, unsafe +242 35 MB jameshenry
npm/make-dir@4.0.0 filesystem 0 9.91 kB sindresorhus
npm/merge2@1.4.1 None 0 8.9 kB zensh
npm/minimatch@3.1.2 None +3 57.8 kB isaacs
npm/minimist@1.2.8 None 0 54.5 kB ljharb
npm/minipass@4.2.8 None 0 69.4 kB isaacs
npm/minizlib@2.1.2 None 0 17.3 kB isaacs
npm/mkdirp@1.0.4 environment, filesystem 0 19.1 kB isaacs
npm/ms@2.1.2 None 0 6.84 kB styfle
npm/negotiator@0.6.3 None 0 27.4 kB dougwilson
npm/node-fetch@2.6.7 network +2 508 kB endless
npm/node-gyp-build@4.8.1 environment, filesystem 0 13.4 kB mafintosh
npm/node-machine-id@1.1.12 environment, eval, shell 0 35.8 kB automation-stack
npm/normalize-package-data@3.0.3 None 0 27.9 kB gar
npm/npm-registry-fetch@14.0.5 environment, filesystem, network Transitive: shell +43 2.76 MB npm-cli-ops
npm/npmlog@6.0.2 None +8 121 kB lukekarrys
npm/nx-cloud@19.0.0 environment, filesystem, shell, unsafe +5 802 kB altan-nrwl
npm/nx@16.10.0 environment, filesystem, network, shell, unsafe Transitive: eval +42 89.4 MB nrwl-jason
npm/once@1.4.0 None +1 7.01 kB isaacs
npm/onetime@5.1.2 None +1 10.6 kB sindresorhus
npm/open@8.4.2 environment, filesystem, shell +2 54.5 kB sindresorhus
npm/p-limit@3.1.0 None +1 13.8 kB sindresorhus
npm/p-map@4.0.0 None +3 25.3 kB sindresorhus
npm/p-reduce@2.1.0 None 0 6.14 kB sindresorhus
npm/parse-json@5.2.0 None +4 34.3 kB sindresorhus
npm/path-key@3.1.1 None 0 4.55 kB sindresorhus
npm/path-scurry@1.11.1 filesystem +1 1.22 MB isaacs
npm/picocolors@1.0.1 environment 0 5.15 kB alexeyraspopov
npm/picomatch@2.3.1 None 0 90 kB mrmlnc
npm/prettier@2.8.8 environment, filesystem, unsafe 0 11.2 MB prettier-bot
npm/pretty-format@29.7.0 Transitive: environment +3 533 kB simenb
npm/protocols@2.0.1 None 0 9.29 kB ionicabizau
npm/read-package-json@6.0.4 filesystem Transitive: environment, shell +17 685 kB npm-cli-ops
npm/readable-stream@3.6.2 environment +1 138 kB matteo.collina
npm/resolve@1.22.8 environment, filesystem +2 159 kB ljharb
npm/retry@0.12.0 None 0 32.2 kB tim-kos
npm/safer-buffer@2.1.2 None 0 42.3 kB chalker
npm/signal-exit@3.0.7 None 0 9.96 kB isaacs
npm/sigstore@1.9.0 network, shell Transitive: environment, filesystem +35 1.5 MB bdehamer
npm/slash@3.0.0 None 0 3.51 kB sindresorhus
npm/source-map@0.6.1 None 0 805 kB tromey
npm/ssri@9.0.1 None 0 37.5 kB nlf
npm/string-width@4.2.3 None +1 103 kB sindresorhus
npm/strip-ansi@6.0.1 None +1 9.7 kB sindresorhus
npm/strong-log-transformer@2.1.0 filesystem 0 16.4 kB rmg
npm/tar@6.1.11 environment, filesystem 0 161 kB isaacs
npm/through@2.3.8 None 0 12.5 kB dominictarr
npm/ts-jest@29.1.3 environment, filesystem, unsafe Transitive: eval, network, shell +62 2.35 MB kul
npm/type-check@0.4.0 None +1 57.9 kB gkz
npm/typescript@4.9.5 None 0 66.8 MB typescript-bot
npm/util-deprecate@1.0.2 None 0 5.48 kB tootallnate
npm/uuid@9.0.1 None 0 123 kB ctavan
npm/validate-npm-package-license@3.0.4 None 0 16.6 kB kemitchell
npm/validate-npm-package-name@5.0.0 None +1 10.6 kB lukekarrys
npm/wcwidth@1.0.1 None 0 14.2 kB timoxley
npm/which@2.0.2 environment Transitive: filesystem +1 20.9 kB isaacs
npm/yallist@4.0.0 None 0 14.8 kB isaacs
npm/yargs-parser@20.2.4 environment, filesystem 0 120 kB oss-bot
npm/yargs@17.7.2 environment, filesystem +5 376 kB oss-bot

🚮 Removed packages: npm/@aws-crypto/crc32@3.0.0, npm/@aws-crypto/ie11-detection@3.0.0, npm/@aws-crypto/sha256-browser@3.0.0, npm/@aws-crypto/sha256-js@3.0.0, npm/@aws-crypto/util@1.2.2, npm/@aws-crypto/util@3.0.0, npm/@aws-sdk/client-lambda@3.582.0, npm/@aws-sdk/types@3.418.0, npm/@aws-sdk/types@3.465.0, npm/@aws-sdk/types@3.577.0, npm/@aws-sdk/util-utf8-browser@3.259.0, npm/@ethereumjs/common@2.6.5, npm/@ethereumjs/rlp@4.0.1, npm/@ethereumjs/tx@3.5.2, npm/@ethereumjs/util@8.1.0, npm/@ethersproject/abi@5.7.0, npm/@ethersproject/abstract-provider@5.7.0, npm/@ethersproject/abstract-signer@5.7.0, npm/@ethersproject/address@5.7.0, npm/@ethersproject/base64@5.7.0, npm/@ethersproject/basex@5.7.0, npm/@ethersproject/bignumber@5.7.0, npm/@ethersproject/bytes@5.7.0, npm/@ethersproject/constants@5.7.0, npm/@ethersproject/contracts@5.7.0, npm/@ethersproject/hash@5.7.0, npm/@ethersproject/hdnode@5.7.0, npm/@ethersproject/json-wallets@5.7.0, npm/@ethersproject/keccak256@5.7.0, npm/@ethersproject/logger@5.7.0, npm/@ethersproject/networks@5.7.1, npm/@ethersproject/pbkdf2@5.7.0, npm/@ethersproject/properties@5.7.0, npm/@ethersproject/providers@5.7.2, npm/@ethersproject/random@5.7.0, npm/@ethersproject/rlp@5.7.0, npm/@ethersproject/sha2@5.7.0, npm/@ethersproject/signing-key@5.7.0, npm/@ethersproject/solidity@5.7.0, npm/@ethersproject/strings@5.7.0, npm/@ethersproject/transactions@5.7.0, npm/@ethersproject/units@5.7.0, npm/@ethersproject/wallet@5.7.0, npm/@ethersproject/web@5.7.1, npm/@ethersproject/wordlists@5.7.0, npm/@noble/curves@1.3.0, npm/@noble/hashes@1.3.3, npm/@openzeppelin/defender-admin-client@1.50.0, npm/@openzeppelin/defender-admin-client@1.54.2, npm/@openzeppelin/defender-autotask-client@1.54.2, npm/@openzeppelin/defender-base-client@1.48.0, npm/@openzeppelin/defender-base-client@1.49.0, npm/@openzeppelin/defender-base-client@1.50.0, npm/@openzeppelin/defender-base-client@1.54.0-rc.0, npm/@openzeppelin/defender-relay-client@1.54.0-rc.0, npm/@openzeppelin/defender-sentinel-client@1.48.0, npm/@openzeppelin/defender-sentinel-client@1.54.2, npm/@openzeppelin/platform-deploy-client@0.7.0, npm/@sindresorhus/is@4.6.0, npm/@smithy/types@2.3.3, npm/@smithy/types@2.7.0, npm/@szmarczak/http-timer@4.0.6, npm/@types/async-retry@1.4.8, npm/@types/bn.js@5.1.5, npm/@types/cacheable-request@6.0.3, npm/@types/fs-extra@9.0.13, npm/abortcontroller-polyfill@1.7.5, npm/accepts@1.3.8, npm/amazon-cognito-identity-js@6.3.12, npm/amazon-cognito-identity-js@6.3.6, npm/amazon-cognito-identity-js@6.3.7, npm/array-flatten@1.1.1, npm/asn1@0.2.6, npm/assert-plus@1.0.0, npm/async-limiter@1.0.1, npm/async-retry@1.3.3, npm/available-typed-arrays@1.0.7, npm/aws-sdk@2.1626.0, npm/aws-sign2@0.7.0, npm/aws4@1.13.0, npm/axios@1.6.1, npm/axios@1.6.2, npm/base-x@3.0.9, npm/bcrypt-pbkdf@1.0.2, npm/bignumber.js@9.1.2, npm/bluebird@3.7.2, npm/bn.js@5.2.1, npm/body-parser@1.20.2, npm/brorand@1.1.0, npm/buffer-to-arraybuffer@0.0.5, npm/buffer@4.9.2, npm/bufferutil@4.0.8, npm/cacheable-lookup@5.0.4, npm/cacheable-request@7.0.4, npm/call-bind@1.0.7, npm/caseless@0.12.0, npm/cids@0.7.5, npm/cipher-base@1.0.4, npm/content-disposition@0.5.4, npm/content-hash@2.5.2, npm/content-type@1.0.5, npm/cookie-signature@1.0.6, npm/cookie@0.6.0, npm/core-util-is@1.0.3, npm/cors@2.8.5, npm/create-hash@1.2.0, npm/create-hmac@1.1.7, npm/cross-fetch@4.0.0, npm/d@1.0.2, npm/dashdash@1.14.1, npm/decode-uri-component@0.2.2, npm/decompress-response@3.3.0, npm/defer-to-connect@2.0.1, npm/dom-walk@0.1.2, npm/ecc-jsbn@0.1.2, npm/elliptic@6.5.4, npm/elliptic@6.5.5, npm/encodeurl@1.0.2, npm/end-of-stream@1.4.4, npm/es5-ext@0.10.64, npm/es6-promise@4.2.8, npm/es6-symbol@3.1.4, npm/escape-html@1.0.3, npm/etag@1.8.1, npm/eth-ens-namehash@2.0.8, npm/eth-lib@0.2.8, npm/ethereum-bloom-filters@1.1.0, npm/ethereum-cryptography@0.1.3, npm/ethers@5.7.2, npm/ethjs-unit@0.1.6, npm/express@4.19.2, npm/extend@3.0.2, npm/extsprintf@1.3.0, npm/fast-base64-decode@1.0.0, npm/follow-redirects@1.15.1, npm/follow-redirects@1.15.4, npm/forever-agent@0.6.1, npm/form-data-encoder@1.7.1, npm/get-intrinsic@1.2.4, npm/getpass@0.1.7, npm/got@12.1.0, npm/har-schema@2.0.0, npm/har-validator@5.1.5, npm/has-tostringtag@1.0.2, npm/hash.js@1.1.7, npm/hmac-drbg@1.0.1, npm/http-https@1.0.0, npm/http-signature@1.2.0, npm/http2-wrapper@2.2.1, npm/is-typedarray@1.0.0, npm/isarray@1.0.0, npm/isomorphic-unfetch@3.1.0, npm/isstream@0.1.2, npm/jest-mock-extended@1.0.18, npm/js-cookie@2.2.1, npm/js-sha3@0.8.0, npm/minimalistic-assert@1.0.1, npm/minimalistic-crypto-utils@1.0.1, npm/node-fetch@2.7.0, npm/retry@0.13.1, npm/tr46@0.0.3, npm/unfetch@4.2.0, npm/webidl-conversions@3.0.1

View full report↗︎

socket-security[bot] commented 3 months ago

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
Install scripts npm/nx@16.10.0
  • Install script: postinstall
  • Source: node ./bin/post-install
🚫

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/nx@16.10.0