search

transmute-industries / sidetree.js

Sidetree Core Protocol and DID Method Drivers
https://identity.foundation/sidetree/spec/
Apache License 2.0
51 stars 26 forks source link

Feature/ei 566 update sidetree dot js packages to latest versions #534

Closed dimgord closed 1 year ago

dimgord commented 1 year ago

For packages/core we still have this after yarn autit:

┌───────────────┬──────────────────────────────────────────────────────────────┐ │ moderate │ Misinterpretation of malicious XML input │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ xmldom │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=0.7.0 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ @transmute/did-key-ed25519 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ @transmute/did-key-ed25519 > @transmute/did-key-common > │ │ │ @did-core/did-ld-json > jsonld-checker > jsonld > xmldom │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://www.npmjs.com/advisories/1089556 │ └───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐ │ critical │ xmldom allows multiple root nodes in a DOM │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ xmldom │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ No patch available │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ @transmute/did-key-ed25519 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ @transmute/did-key-ed25519 > @transmute/did-key-common > │ │ │ @did-core/did-ld-json > jsonld-checker > jsonld > xmldom │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://www.npmjs.com/advisories/1090179 │ └───────────────┴──────────────────────────────────────────────────────────────┘>

I couldn’t put “xmldom”: “^0.7.0” in resolutions, don’t know why :/. And one issue still doesn't have a patch.

OR13 commented 1 year ago

This PR replaces a lot of package names, if the intention is to host those packages in this repo moving forward, I think we probably should have a longer from chat.

Are you in DIF slack?

dimgord commented 1 year ago

Sorry, submitted to a wrong repo...