[Snyk] Fix for 4 vulnerabilities#470
Conversation
…providers/onekey-alph-provider/yarn.lock to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BNJS-15274301 - https://snyk.io/vuln/SNYK-JS-STABLELIBED25519-15914262 - https://snyk.io/vuln/SNYK-JS-ELLIPTIC-14908844 - https://snyk.io/vuln/SNYK-JS-BASEX-10118294
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "@alephium/walletconnect-provider": "^3.0.0", | ||
| "@alephium/web3": "^3.0.0", |
There was a problem hiding this comment.
🔴 Stale version-specific patch file will fail to apply after @alephium/web3 upgrade to v3.x
The package.json upgrades @alephium/web3 from ^1.5.2 to ^3.0.0, but the existing patch file patches/@alephium+web3+1.5.2.patch is version-pinned to 1.5.2. Since patch-package matches patches by package name and version, this patch will not be applied to the newly installed v3.x package. The postinstall script (packages/providers/onekey-alph-provider/package.json:25) runs patch-package, which will either error out (failing the install) or warn that the patch doesn't match—depending on config. The patch made two important changes: (1) commenting out the global BigInt.prototype['toJSON'] override in @alephium/web3's index.js, and (2) modifying the minified bundle. If the v3.x package still has these issues, the provider will break at runtime; if it doesn't, the stale patch file should be removed to avoid install failures.
Prompt for agents
The patch file at packages/providers/onekey-alph-provider/patches/@alephium+web3+1.5.2.patch is pinned to version 1.5.2 of @alephium/web3. After upgrading to ^3.0.0, patch-package will not find a matching patch. You need to either:
1. If the issues the patch fixed (BigInt.prototype.toJSON override and minified bundle changes) are still present in v3.0.0: Create a new patch file targeting v3.0.0 by installing the new version and re-applying the necessary changes, then running patch-package to generate a new @alephium+web3+3.0.0.patch file.
2. If v3.0.0 no longer has these issues: Delete the stale patches/@alephium+web3+1.5.2.patch file.
Without this fix, running yarn install / npm install will trigger the postinstall script which runs patch-package, and it will either fail or produce a warning about an unmatched patch.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
2 participants
Snyk has created this PR to fix 4 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
packages/providers/onekey-alph-provider/package.jsonpackages/providers/onekey-alph-provider/yarn.lockNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-BNJS-15274301
SNYK-JS-STABLELIBED25519-15914262
SNYK-JS-ELLIPTIC-14908844
SNYK-JS-BASEX-10118294
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.