From 21b2017a66aac8ccb47a5524581eed164e63c4d8 Mon Sep 17 00:00:00 2001 From: maryia-deriv Date: Thu, 18 Jun 2026 13:05:00 +0300 Subject: [PATCH 1/4] Revert "JSON Schema Update" This reverts commit 18b11c4524aec220ba023be5233bede99717d374. --- config/v3/new_account_virtual/example.json | 7 - config/v3/new_account_virtual/receive.json | 82 ----- config/v3/new_account_virtual/send.json | 333 --------------------- static/data/v3.yml | 2 - 4 files changed, 424 deletions(-) delete mode 100644 config/v3/new_account_virtual/example.json delete mode 100644 config/v3/new_account_virtual/receive.json delete mode 100644 config/v3/new_account_virtual/send.json diff --git a/config/v3/new_account_virtual/example.json b/config/v3/new_account_virtual/example.json deleted file mode 100644 index d5818c7a..00000000 --- a/config/v3/new_account_virtual/example.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "new_account_virtual": 1, - "type": "trading", - "client_password": "C0rrect_p4ssword", - "residence": "id", - "verification_code": "uoJvVuQ6" -} diff --git a/config/v3/new_account_virtual/receive.json b/config/v3/new_account_virtual/receive.json deleted file mode 100644 index 02762dab..00000000 --- a/config/v3/new_account_virtual/receive.json +++ /dev/null @@ -1,82 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-04/schema#", - "title": "New Virtual-Money Account (response)", - "description": "Create virtual-money account", - "type": "object", - "required": [ - "echo_req", - "msg_type" - ], - "properties": { - "new_account_virtual": { - "title": "new_account_virtual", - "description": "New virtual-money account details", - "type": "object", - "additionalProperties": false, - "required": [ - "balance", - "client_id", - "currency", - "email", - "oauth_token" - ], - "properties": { - "balance": { - "description": "Account balance", - "type": "number" - }, - "client_id": { - "description": "ID of the new virtual-money account", - "type": "string" - }, - "currency": { - "description": "Account currency", - "type": "string" - }, - "currency_type": { - "description": "Currency type against the currency", - "type": "string" - }, - "email": { - "description": "Email of the new virtual-money account", - "type": "string" - }, - "login_code": { - "description": "[Optional] One-time code for passwordless login, valid for 1 minute", - "type": "string" - }, - "oauth_token": { - "description": "Oauth token for the client's login session (so that the user may be logged in immediately)", - "type": "string" - }, - "refresh_token": { - "description": "Refresh token to perform PTA, only for the first ever created account", - "type": "string" - }, - "type": { - "description": "Account type", - "type": "string", - "enum": [ - "trading", - "wallet" - ] - } - } - }, - "echo_req": { - "description": "Echo of the request made.", - "type": "object" - }, - "msg_type": { - "description": "Action name of the request made.", - "type": "string", - "enum": [ - "new_account_virtual" - ] - }, - "req_id": { - "description": "Optional field sent in request to map to response, present only when request contains `req_id`.", - "type": "integer" - } - } -} diff --git a/config/v3/new_account_virtual/send.json b/config/v3/new_account_virtual/send.json deleted file mode 100644 index 680383c5..00000000 --- a/config/v3/new_account_virtual/send.json +++ /dev/null @@ -1,333 +0,0 @@ -{ - "$schema": "http://json-schema.org/draft-04/schema#", - "title": "New Virtual-Money Account (request)", - "description": "Create a new virtual-money account.", - "type": "object", - "auth_required": 0, - "additionalProperties": false, - "required": [ - "new_account_virtual" - ], - "properties": { - "new_account_virtual": { - "description": "Must be `1`", - "type": "integer", - "enum": [ - 1 - ] - }, - "ad_platform_cookies": { - "description": "[Optional] Advertising platform cookie identifiers from various platforms for conversion tracking.", - "type": "object", - "additionalProperties": false, - "properties": { - "_ga": { - "description": "[Optional] Google Analytics client ID. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._-]{1,200}$" - }, - "_ga_measurement_id": { - "description": "[Optional] Google Analytics measurement ID with _ga_ prefix (e.g., _ga_DSZS6HSFWQ, _ga_R0D2Z1965W). Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^_ga_[A-Z0-9]{5,20}$" - }, - "_ga_measurement_value": { - "description": "[Optional] Google Analytics measurement ID specific cookie value. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._$-]{1,200}$" - }, - "fbc": { - "description": "[Optional] Facebook click identifier from _fbc cookie. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._-]{1,300}$" - }, - "fbp": { - "description": "[Optional] Facebook browser identifier from _fbp cookie. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._-]{1,300}$" - }, - "gbraid": { - "description": "[Optional] Google Browser Ad ID. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._-]{1,300}$" - }, - "gclid": { - "description": "[Optional] Google Click Identifier from _gcl_aw cookie. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._-]{1,300}$" - }, - "msclkid": { - "description": "[Optional] Microsoft Click ID. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._-]{1,300}$" - }, - "scclid": { - "description": "[Optional] Snapchat click identifier from _ScCid cookie. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._-]{1,300}$" - }, - "ttclid": { - "description": "[Optional] TikTok click identifier. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._-]{1,300}$" - }, - "wbraid": { - "description": "[Optional] Google Web Browser Ad ID. Value must match Regex pattern to be recorded", - "type": "string", - "pattern": "^[A-Za-z0-9._-]{1,300}$" - } - } - }, - "affiliate_token": { - "description": "[Optional] Affiliate token, within 100 characters.", - "type": "string", - "pattern": "^[\\w-]{0,100}$" - }, - "affiliate_token_type": { - "description": "[Optional] Type of affiliate_token, used to identify the purpose of the token (client or partner tagging)", - "type": "string", - "enum": [ - "client", - "partner" - ] - }, - "client_password": { - "description": "Password (Accepts any printable ASCII character. Must be within 8-25 characters, and include numbers, lowercase and uppercase letters. Must not be the same as the user's email address).", - "type": "string", - "pattern": "^(?=.*[a-z])(?=.*[0-9])(?=.*[A-Z])[ -~]{8,25}$", - "sensitive": 1 - }, - "date_first_contact": { - "description": "[Optional] Date of first contact, format: `yyyy-mm-dd` in GMT timezone.", - "type": "string", - "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$" - }, - "email": { - "description": "[Optional] Email address for signup.", - "type": "string", - "pattern": "^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,63}$" - }, - "email_consent": { - "description": "[Optional] Boolean value: 1 or 0, indicating whether the client has given consent for marketing emails.", - "type": "integer", - "enum": [ - 1, - 0 - ] - }, - "gclid_url": { - "description": "[Optional] Google Click Identifier to track source.", - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - "residence": { - "description": "2-letter country code (obtained from `residence_list` call).", - "type": "string", - "pattern": "^[a-z]{2}$" - }, - "signup_device": { - "description": "[Optional] Show whether user has used mobile or desktop.", - "type": "string", - "enum": [ - "desktop", - "mobile" - ] - }, - "type": { - "description": "Account type", - "type": "string", - "default": "trading", - "enum": [ - "trading", - "wallet", - "dynamic" - ] - }, - "utm_ad_id": { - "description": "[Optional] Identifier of particular ad. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_adgroup_id": { - "description": "[Optional] Identifier of ad group in the campaign. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_adrollclk_id": { - "description": "[Optional] Unique identifier of click on AdRoll ads platform. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_campaign": { - "description": "[Optional] Identifies a specific product promotion or strategic campaign such as a spring sale or other promotions. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_campaign_id": { - "description": "[Optional] Identifier of paid ad campaign. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_content": { - "description": "[Optional] Used to differentiate similar content, or links within the same ad. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_fbcl_id": { - "description": "[Optional] Unique identifier of click on Facebook ads platform. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_gl_client_id": { - "description": "[Optional] Unique visitor identifier on Google Ads platform. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_medium": { - "description": "[Optional] Identifies the medium the link was used upon such as: email, CPC, or other methods of sharing. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_msclk_id": { - "description": "[Optional] Unique click identifier on Microsoft Bing ads platform. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_sccid": { - "description": "[Optional] The Snapchat click Identifier to track source. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_source": { - "description": "[Optional] Identifies the source of traffic such as: search engine, newsletter, or other referral. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_term": { - "description": "[Optional] Used to send information related to the campaign term like paid search keywords. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "utm_ttclid": { - "description": "[Optional] The TikTok click Identifier to track source. Value must match Regex pattern to be recorded", - "anyOf": [ - { - "type": "string", - "pattern": "^[a-zA-Z0-9\\s\\-\\.\\_]{0,100}$" - }, - { - "type": "string" - } - ] - }, - "verification_code": { - "description": "Email verification code (received from a `verify_email` call, which must be done first).", - "type": "string", - "pattern": "^\\w{8,128}$" - }, - "loginid": { - "description": "[Optional] The login id of the user. Mandatory when multiple tokens were provided during authorize.", - "type": "string", - "pattern": "^[A-Za-z]+[0-9]+$" - }, - "passthrough": { - "description": "[Optional] Used to pass data through the websocket, which may be retrieved via the `echo_req` output field.", - "type": "object" - }, - "req_id": { - "description": "[Optional] Used to map request to response.", - "type": "integer" - } - } -} diff --git a/static/data/v3.yml b/static/data/v3.yml index b9c60506..f9b5889b 100644 --- a/static/data/v3.yml +++ b/static/data/v3.yml @@ -119,8 +119,6 @@ groups: title: 'New Real-Money Account: Deriv Investment (Europe) Ltd' - name: new_account_real title: 'New Real-Money Account: Default Landing Company' - - name: new_account_virtual - title: New Virtual-Money Account - name: new_account_wallet title: New Real-Money Wallet Account - name: new_account_wallet_and_trading From dcd6fcf52e1e680c27ba64e914d208a9d6d56457 Mon Sep 17 00:00:00 2001 From: maryia-deriv Date: Thu, 18 Jun 2026 13:16:22 +0300 Subject: [PATCH 2/4] chore: remove legacy API retirement banner and "Read the update" CTAs Remove the global LegacyBanner ("The Deriv legacy API is being retired.") rendered in the layout, the matching "Read the update" button on the home hero, and the now-unused localization strings (en + fr). - Delete src/components/LegacyBanner (component + styles) - Drop banner render + unused useLocation/pathname in theme/Layout - Remove "Read the update" button and unused useDocusaurusContext in HeroHeader - Prune orphaned strings from i18n/en/code.json and i18n/fr/code.json Co-Authored-By: Claude Opus 4.8 (1M context) --- i18n/en/code.json | 6 --- i18n/fr/code.json | 6 --- .../LegacyBanner/LegacyBanner.module.scss | 42 ------------------- src/components/LegacyBanner/index.tsx | 35 ---------------- src/features/Home/HeroHeader/HeroHeader.tsx | 11 ----- src/theme/Layout/index.tsx | 4 -- 6 files changed, 104 deletions(-) delete mode 100644 src/components/LegacyBanner/LegacyBanner.module.scss delete mode 100644 src/components/LegacyBanner/index.tsx diff --git a/i18n/en/code.json b/i18n/en/code.json index 5dcaadb2..eb39aefc 100644 --- a/i18n/en/code.json +++ b/i18n/en/code.json @@ -1202,9 +1202,6 @@ "Go to home": { "message": "Go to home" }, - "The Deriv legacy API is being retired.": { - "message": "The Deriv legacy API is being retired." - }, "What's New": { "message": "What's New" }, @@ -1334,9 +1331,6 @@ "Go to new Deriv API": { "message": "Go to new Deriv API" }, - "Read the update": { - "message": "Read the update" - }, "Important update about the Legacy API": { "message": "Important update about the Legacy API" }, diff --git a/i18n/fr/code.json b/i18n/fr/code.json index e56e758d..1baef69b 100644 --- a/i18n/fr/code.json +++ b/i18n/fr/code.json @@ -1202,9 +1202,6 @@ "Go to home": { "message": "Rentrez à la page d'accueil" }, - "The Deriv legacy API is being retired.": { - "message": "L'API Deriv legacy ne sera plus disponible." - }, "What's New": { "message": "Nouveautés" }, @@ -1334,9 +1331,6 @@ "Go to new Deriv API": { "message": "Accéder au nouveau Deriv API" }, - "Read the update": { - "message": "Lire la mise à jour" - }, "Important update about the Legacy API": { "message": "Mise à jour importante concernant l'API legacy" }, diff --git a/src/components/LegacyBanner/LegacyBanner.module.scss b/src/components/LegacyBanner/LegacyBanner.module.scss deleted file mode 100644 index a0dca5dc..00000000 --- a/src/components/LegacyBanner/LegacyBanner.module.scss +++ /dev/null @@ -1,42 +0,0 @@ -.banner { - display: flex; - align-items: center; - justify-content: center; - gap: 16px; - width: 100%; - background-color: #fff3cd; - border-bottom: 1px solid #ffc107; - padding: 10px 24px; - font-family: var(--inter-font-family); - font-size: 14px; - line-height: 1.5; - - @media (max-width: 768px) { - flex-direction: column; - gap: 8px; - text-align: center; - padding: 12px 16px; - } -} - -.text { - display: inline-flex; - align-items: center; - gap: 8px; - color: #181c25; - font-weight: 400; -} - -.icon { - flex-shrink: 0; -} - -.bannerLink { - color: #181c25 !important; - font-weight: 600; - text-decoration: underline !important; - - &:hover { - color: #ff444f !important; - } -} diff --git a/src/components/LegacyBanner/index.tsx b/src/components/LegacyBanner/index.tsx deleted file mode 100644 index e969bea3..00000000 --- a/src/components/LegacyBanner/index.tsx +++ /dev/null @@ -1,35 +0,0 @@ -import React from 'react'; -import { Button } from '@deriv-com/quill-ui'; -import { useHistory, useLocation } from '@docusaurus/router'; -import useDocusaurusContext from '@docusaurus/useDocusaurusContext'; -import Translate from '@docusaurus/Translate'; -import styles from './LegacyBanner.module.scss'; - -export const LegacyBanner = () => { - const history = useHistory(); - const { pathname } = useLocation(); - const { - i18n: { currentLocale }, - } = useDocusaurusContext(); - - const is_en = currentLocale === 'en'; - const updates_path = `${!is_en ? `/${currentLocale}` : ''}/updates`; - - if (pathname === updates_path) return null; - - return ( -
- - The Deriv legacy API is being retired. - - -
- ); -}; diff --git a/src/features/Home/HeroHeader/HeroHeader.tsx b/src/features/Home/HeroHeader/HeroHeader.tsx index dedc7e8b..3ca1dd22 100644 --- a/src/features/Home/HeroHeader/HeroHeader.tsx +++ b/src/features/Home/HeroHeader/HeroHeader.tsx @@ -2,14 +2,8 @@ import React from 'react'; import { Button, Text } from '@deriv/ui'; import styles from './HeroHeader.module.scss'; import Translate from '@docusaurus/Translate'; -import useDocusaurusContext from '@docusaurus/useDocusaurusContext'; export const HeroHeader = () => { - const { - i18n: { currentLocale }, - } = useDocusaurusContext(); - const updates_path = `${currentLocale !== 'en' ? `/${currentLocale}` : ''}/updates`; - return (
@@ -40,11 +34,6 @@ export const HeroHeader = () => { Go to new Deriv API - - -
diff --git a/src/theme/Layout/index.tsx b/src/theme/Layout/index.tsx index d132f0a9..b0c50a10 100644 --- a/src/theme/Layout/index.tsx +++ b/src/theme/Layout/index.tsx @@ -11,9 +11,7 @@ import LayoutProvider from '@theme/Layout/Provider'; import ErrorPageContent from '@theme/ErrorPageContent'; import type { Props } from '@theme/Layout'; import { Header } from '@site/src/components/Header'; -import { LegacyBanner } from '@site/src/components/LegacyBanner'; import useOfficialContentsContext from '@site/src/hooks/useOfficialContentsContext'; -import { useLocation } from '@docusaurus/router'; import styles from './styles.module.css'; export default function Layout(props: Props): JSX.Element { @@ -26,7 +24,6 @@ export default function Layout(props: Props): JSX.Element { description, } = props; const { is_official_domain } = useOfficialContentsContext(); - const { pathname } = useLocation(); useKeyboardNavigation(); @@ -36,7 +33,6 @@ export default function Layout(props: Props): JSX.Element { - {pathname !== '/updates' && }
From b05b04087a2afd8210b7c9c546672668ba53a86d Mon Sep 17 00:00:00 2001 From: maryia-deriv Date: Thu, 18 Jun 2026 13:27:35 +0300 Subject: [PATCH 3/4] fix: bump protobufjs and ws overrides to patch HIGH CVEs Trivy flagged two HIGH vulnerabilities in the lockfile: - protobufjs 7.5.8 -> 7.6.1 (CVE-2026-48712: DoS via unbounded Any expansion during JSON conversion) - ws 8.20.1 -> 8.21.0 (CVE-2026-48779: memory exhaustion DoS from tiny fragments and data chunks) Both were already pinned via overrides at the vulnerable versions; bump them to the fixed releases and regenerate package-lock.json. Co-Authored-By: Claude Opus 4.8 (1M context) --- package-lock.json | 35 +++++++++++++++++------------------ package.json | 4 ++-- 2 files changed, 19 insertions(+), 20 deletions(-) diff --git a/package-lock.json b/package-lock.json index 7c12021f..c315a9d3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8486,19 +8486,18 @@ "license": "BSD-3-Clause" }, "node_modules/@protobufjs/eventemitter": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz", - "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==", + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz", + "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==", "license": "BSD-3-Clause" }, "node_modules/@protobufjs/fetch": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz", - "integrity": "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==", + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz", + "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==", "license": "BSD-3-Clause", "dependencies": { - "@protobufjs/aspromise": "^1.1.1", - "@protobufjs/inquire": "^1.1.0" + "@protobufjs/aspromise": "^1.1.1" } }, "node_modules/@protobufjs/float": { @@ -27966,24 +27965,24 @@ "license": "ISC" }, "node_modules/protobufjs": { - "version": "7.5.8", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.8.tgz", - "integrity": "sha512-dvpCIeLPbXZS/Ete7yLaO7RenOdken2NHKykBXbsaGxZT0UTltcarBciw+A78SRQs9iMAAVpsYA+l8b1hTePIA==", + "version": "7.6.1", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.1.tgz", + "integrity": "sha512-4K0myLaWL5EteuSAro91EGFgcfVgxb64Jx+7oDAY6GOkXD4M69yuSEljNcInGVCA5sOPxmZ/EqDLj2x0Q0+Ygg==", "hasInstallScript": true, "license": "BSD-3-Clause", "dependencies": { "@protobufjs/aspromise": "^1.1.2", "@protobufjs/base64": "^1.1.2", "@protobufjs/codegen": "^2.0.5", - "@protobufjs/eventemitter": "^1.1.0", - "@protobufjs/fetch": "^1.1.0", + "@protobufjs/eventemitter": "^1.1.1", + "@protobufjs/fetch": "^1.1.1", "@protobufjs/float": "^1.0.2", - "@protobufjs/inquire": "^1.1.1", + "@protobufjs/inquire": "^1.1.2", "@protobufjs/path": "^1.1.2", "@protobufjs/pool": "^1.1.0", "@protobufjs/utf8": "^1.1.1", "@types/node": ">=13.7.0", - "long": "^5.0.0" + "long": "^5.3.2" }, "engines": { "node": ">=12.0.0" @@ -34425,9 +34424,9 @@ } }, "node_modules/ws": { - "version": "8.20.1", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz", - "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==", + "version": "8.21.0", + "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz", + "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==", "license": "MIT", "engines": { "node": ">=10.0.0" diff --git a/package.json b/package.json index 08eb7bd7..aa4d224c 100644 --- a/package.json +++ b/package.json @@ -130,14 +130,14 @@ "lodash": "4.18.0", "lodash-es": "4.18.0", "dompurify": "3.4.0", - "protobufjs": "7.5.8", + "protobufjs": "7.6.1", "@babel/plugin-transform-modules-systemjs": "7.29.4", "fast-uri": "3.1.2", "simple-git": "3.36.0", "js-cookie": "3.0.7", "uuid": "11.1.1", "qs": "6.15.2", - "ws": "8.20.1", + "ws": "8.21.0", "postcss": "8.5.10", "shell-quote": "1.8.4" }, From f6a061cad7beeda76ceadb2b800a86df9acfbf4b Mon Sep 17 00:00:00 2001 From: maryia-deriv Date: Thu, 18 Jun 2026 14:00:04 +0300 Subject: [PATCH 4/4] fix: bump protobufjs override to 7.6.3 for GHSA-f38q-mgvj-vph7 7.6.1 is affected by CVE-2026-54269 (schema-derived names can shadow runtime-significant properties). Bump to the patched 7.6.3 release. Co-Authored-By: Claude Opus 4.8 (1M context) --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index c315a9d3..af3c2778 100644 --- a/package-lock.json +++ b/package-lock.json @@ -27965,9 +27965,9 @@ "license": "ISC" }, "node_modules/protobufjs": { - "version": "7.6.1", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.1.tgz", - "integrity": "sha512-4K0myLaWL5EteuSAro91EGFgcfVgxb64Jx+7oDAY6GOkXD4M69yuSEljNcInGVCA5sOPxmZ/EqDLj2x0Q0+Ygg==", + "version": "7.6.3", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.3.tgz", + "integrity": "sha512-+k0vdJKNdW+Vu+dYe8tZA/VvQb6XKNWexC6URwBFXxNnjLJz9nQJCemGyNgRAWD+B7+nGNc9qMPGwcD7s4nzUw==", "hasInstallScript": true, "license": "BSD-3-Clause", "dependencies": { diff --git a/package.json b/package.json index aa4d224c..142cd374 100644 --- a/package.json +++ b/package.json @@ -130,7 +130,7 @@ "lodash": "4.18.0", "lodash-es": "4.18.0", "dompurify": "3.4.0", - "protobufjs": "7.6.1", + "protobufjs": "7.6.3", "@babel/plugin-transform-modules-systemjs": "7.29.4", "fast-uri": "3.1.2", "simple-git": "3.36.0",