From 5cef19dcc28fbcb4c3504564566d4f5a5c52ec50 Mon Sep 17 00:00:00 2001 From: J-Dog Date: Tue, 6 Oct 2026 03:17:37 -0700 Subject: [PATCH 1/3] chore(release): v0.22.5 --- CHANGELOG.md | 5 +++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1320ee6a..333b83cf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.22.5] - 2026-10-06 + +### Changed +- Pinned the v0.22.5 hub tag in the release manifest for the signer-set peer catch-up fix. + ## [0.22.4] - 2026-10-05 ### Changed diff --git a/package-lock.json b/package-lock.json index cd6310a9..4de56296 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "xchain-node", - "version": "0.22.4", + "version": "0.22.5", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "xchain-node", - "version": "0.22.4", + "version": "0.22.5", "license": "AGPL-3.0-or-later", "dependencies": { "@dankest-llc/xchain-sdk": "^0.18.0", diff --git a/package.json b/package.json index 68387a7f..e6886bba 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "xchain-node", - "version": "0.22.4", + "version": "0.22.5", "description": "xchain-node allows users to install, configure and run XChain platform nodes.", "license": "AGPL-3.0-or-later", "repository": { From d6c63ab066ff7dab58df5c8bbd6aac721cc46bb2 Mon Sep 17 00:00:00 2001 From: J-Dog Date: Tue, 6 Oct 2026 03:39:38 -0700 Subject: [PATCH 2/3] Release v0.22.5 manifest --- src/release-manifest.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/release-manifest.json b/src/release-manifest.json index 7e47ee93..1f9ac8a5 100644 --- a/src/release-manifest.json +++ b/src/release-manifest.json @@ -1,9 +1,9 @@ { "_comment": [ - "Pinned component set for XChain Platform v0.22.4.", + "Pinned component set for XChain Platform v0.22.5.", "Generated by bin/write-release-manifest.js from the ACTUAL tagged master merge commits.", "xchain-node is the carrier and is not listed: checking out its tag IS this manifest.", - "A train tags only the repos it touches. This one moves xchain-indexer, xchain-hub, xchain-sync, xchain-explorer and xchain-sdk.", + "A train tags only the repos it touches. This one moves xchain-hub.", "Every other component is unchanged and keeps the tag it already carries, which is", "what section 4 means by a version being the platform version at which a component", "last changed. A gap is unchanged, not skipped.", @@ -12,8 +12,8 @@ "repo's origin/master, and is a GPG-signed annotated tag verifying against the", "platform release key (fingerprint 1DA7C4896F56EA22CF491EDF4361611A82F90B70)." ], - "platform_version": "0.22.4", - "released": "2026-10-05", + "platform_version": "0.22.5", + "released": "2026-10-06", "components": { "xchain-vm": { "tag": "v0.21.3", @@ -28,8 +28,8 @@ "commit": "4ac2c37375d4b1e55d13ed081d723e1ef17537f2" }, "xchain-hub": { - "tag": "v0.22.4", - "commit": "bb07dffac7811e8437365a30062d66a2017f8d39" + "tag": "v0.22.5", + "commit": "e8ea5011f781fd24ef3a868cc665d7dabe7dfe63" }, "xchain-sync": { "tag": "v0.22.4", From 8b855941221f9edf6d5ac1878dbee1a8b05446f4 Mon Sep 17 00:00:00 2001 From: J-Dog Date: Tue, 6 Oct 2026 03:54:34 -0700 Subject: [PATCH 3/3] Move proxy-addr to 2.0.8 for GHSA-jqcg-44mw-7w3h npm audit reports proxy-addr 2.0.7, reached through express, as critical: IP spoofing via an IPv4-mapped IPv6 trust subnet. 2.0.8 is inside express's ^2.0.7 range, so only the lockfile moves. --- CHANGELOG.md | 3 +++ package-lock.json | 10 +++++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 333b83cf..a80b23f1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed - Pinned the v0.22.5 hub tag in the release manifest for the signer-set peer catch-up fix. +### Security +- Moved proxy-addr to 2.0.8 for the IPv4-mapped IPv6 trust subnet advisory GHSA-jqcg-44mw-7w3h. + ## [0.22.4] - 2026-10-05 ### Changed diff --git a/package-lock.json b/package-lock.json index 4de56296..3c0ab4c1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5090,9 +5090,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", - "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -5100,6 +5100,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/proxy-from-env": {