search

digitalbazaar / ecdsa-secp256k1-verification-key-2019

Other
3 stars 5 forks source link

chore: update dependencies to remove crypto vulnerabilities #14

Closed kdenhartog closed 11 months ago

kdenhartog commented 3 years ago

The previous version of elliptic in use was vulnerable to CVE-2020-13822 and the previous version of node-forge was vulnerable to CVE-2020-7720. This updates the dependencies to secure versions.

aljones15 commented 3 years ago

browser tests failed:

 Error: Cannot find module 'bitcore-message/dist/bitcore-message.js'

This has happened before in other libraries and we made a webpack exception for it. Not sure why this would come back here though.

Yeah the webpack alias is here: https://github.com/digitalbazaar/vc-js/blob/e4799bd0a400d5f7f2535bce872fe72ada06016d/webpack.config.js

p.s. the browser tests for this library fail in all other PRs, but not for this reason in at least 3 of the tests I looked at such as in this PR that updates the tests: https://travis-ci.org/github/digitalbazaar/ecdsa-secp256k1-verification-key-2019/jobs/714042699

p.s. THANK YOU for the code.