From ea96da443a732f293a710e755a28a99301d7967c Mon Sep 17 00:00:00 2001 From: Rob Konsdorf Date: Tue, 18 Aug 2026 22:39:46 -0400 Subject: [PATCH] chore(deps): lift the runtime crypto and utility dependencies past their advisories elliptic below 6.6.1 accepts signatures it should reject, and this package verifies real signatures, so that one is the reason for the change. lodash, and both the 4.x and 5.x bn.js lines, carry their own advisories and sit in the same runtime graph that ships to consumers. Every declared range already admitted the patched version, so package.json needs no change. The lockfile is edited in place rather than regenerated. Yarn 1 renormalizes the whole file on any write, which here also dropped ten resolution specs and reformatted package.json; the four edited blocks keep the diff to what the advisories require, and a frozen install validates the integrity hashes. --- yarn.lock | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/yarn.lock b/yarn.lock index da47d94..bbad9d3 100644 --- a/yarn.lock +++ b/yarn.lock @@ -500,14 +500,14 @@ binary-extensions@^2.0.0: integrity sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw== bn.js@^4.11.9: - version "4.12.0" - resolved "https://registry.npmjs.org/bn.js/-/bn.js-4.12.0.tgz" - integrity sha512-c98Bf3tPniI+scsdk237ku1Dc3ujXQTSgyiPUDEOe7tRkhrqridvh8klBv0HCEso1OLOYcHuCv/cS6DNxKH+ZA== + version "4.12.3" + resolved "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz" + integrity sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g== bn.js@^5.2.0: - version "5.2.1" - resolved "https://registry.npmjs.org/bn.js/-/bn.js-5.2.1.tgz" - integrity sha512-eXRvHzWyYPBuB4NBy0cmYQjGitUrtqwbvlzP3G6VFnNRbsZQIxQ10PbKKHt8gZ/HW/D/747aDl+QkDqg3KQLMQ== + version "5.2.3" + resolved "https://registry.npmjs.org/bn.js/-/bn.js-5.2.3.tgz" + integrity sha512-EAcmnPkxpntVL+DS7bO1zhcZNvCkxqtkd0ZY53h06GNQ3DEkkGZ/gKgmDv6DdZQGj9BgfSPKtJJ7Dp1GPP8f7w== brace-expansion@^1.1.7: version "1.1.11" @@ -806,9 +806,9 @@ electron-to-chromium@^1.4.668: integrity sha512-6Fmg8QkkumNOwuZ/5mIbMU9WI3H2fmn5ajcVya64I5Yr5CcNmO7vcLt0Y7c96DCiMO5/9G+4sI2r6eEvdg1F7A== elliptic@^6.5.4: - version "6.5.5" - resolved "https://registry.npmjs.org/elliptic/-/elliptic-6.5.5.tgz" - integrity sha512-7EjbcmUm17NQFu4Pmgmq2olYMj8nwMnpcddByChSUjArp8F5DQWcIcpriwO4ZToLNAJig0yiyjswfyGNje/ixw== + version "6.6.1" + resolved "https://registry.npmjs.org/elliptic/-/elliptic-6.6.1.tgz" + integrity sha512-RaddvvMatK2LJHqFJ+YA4WysVN5Ita9E35botqIYspQ4TkRAlCicdzKOjlyv/1Za5RyTNn7di//eEV0uTAfe3g== dependencies: bn.js "^4.11.9" brorand "^1.1.0" @@ -1384,9 +1384,9 @@ locate-path@^6.0.0: p-locate "^5.0.0" lodash@^4.17.21: - version "4.17.21" - resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz" - integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg== + version "4.18.0" + resolved "https://registry.npmjs.org/lodash/-/lodash-4.18.0.tgz" + integrity sha512-l1mfj2atMqndAHI3ls7XqPxEjV2J9ZkcNyHpoZA3r2T1LLwDB69jgkMWh71YKwhBbK0G2f4WSn05ahmQXVxupA== log-symbols@4.1.0: version "4.1.0"