Repository navigation
Conversation
@coral-xyz/anchor, @metaplex-foundation/js, @roamhq/wrtc, simple-peer, @types/simple-peer, @simplewebauthn/server, @simplewebauthn/browser, sigstore, falcon-js, mlkem, ntru, pqcrypto, sphincs, js-sha3, libsodium-wrappers-sumo and lodash have no import, require, config or script reference anywhere in the repository. Falcon is implemented with falcon-sign and ML-DSA / ML-KEM with @noble/post-quantum, which stay. The lockfile was regenerated without installing; no remaining package changes its resolved version (only hoisting moves). bun.lock entries go from 2118 to 1926 and the production closure from 1777 to 1583 packages, about 100 MB less for every consumer. superdilithium stays because the typedoc workflow patches it; dotenv stays for the jest setup.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
 [High impact] The latest changes appear safe to merge, with the previous npm install blocker fixed.
|
Re-resolve bun.lock inside the existing package.json ranges. No declared
range changed except @ton/core (below), so the published dependency
metadata is unchanged. Lockfile entries drop from 2118 to 1842; 263
name@version identities are new or moved, 441 are gone.
Audit (bun audit, same advisory database): 223 findings (8 critical,
105 high, 96 moderate, 14 low) on main -> 80 (3 critical, 38 high,
36 moderate, 3 low).
Hoisting fix for the security gate: the copies the gate flagged as new
are now at fixed versions: lodash 4.18.1 (was 4.17.21), tmp 0.2.7 (was
0.2.5), fast-xml-parser no longer resolves at all. Against main's lock
no (package, advisory) pair is added by this change.
Override added: "tronweb": { "axios": "1.20.0" }. tronweb 6.5.1 (the
latest release) pins axios to exactly 1.18.0, which is affected by
GHSA-r4gj-5m52-g5wh (range >=1.17.0 <1.20.0) while the root axios
resolves to 1.20.0. Overrides only apply to installs of this repository;
consumers of the package still get tronweb's own pin until tronweb
moves.
@ton/core is raised from ^0.62.1 to ^0.63.0 because @ton/ton 16 declares
a peer range of >=0.63.0 <1.0.0; bun warned "incorrect peer dependency"
with 0.62.1. The lock now has @ton/core 0.63.1 and @ton/ton 16.3.0.
jest.config.ts: transformIgnorePatterns now also transforms @noble and
@Scure copies nested under another package. xrpl 3.2.0 pulls its own
@xrplf/isomorphic with an ESM-only @noble/hashes, which made every suite
that imports the multichain barrel fail with "Unexpected token export".
Checks in a clean archive of this commit: bun install --frozen-lockfile,
bun run build, tsc --noEmit, all 38 export targets exist and 37 import
(the remaining one is the wasm wildcard), pqc.spec, txSignatureDomain.spec
and xrpl.spec pass; ton.spec and ibc.spec fail on network access exactly
as on main.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
… a whole
The messaging-export workflow installs with bun 1.2.19 and --frozen-lockfile.
The previous commit's lockfile was written by bun 1.4 as lockfileVersion 3
with a nested override ("tronweb": { "axios": ... }), which bun 1.2.19 does
not parse ("Unknown lockfile version", then a frozen-lockfile failure).
- bun.lock is back to lockfileVersion 1 with the same resolutions. It was
checked with bun 1.2.19 (bun install --frozen-lockfile) and with bun 1.4.
- The override is now flat: "axios": "1.20.0". Nested overrides are not
understood by 1.2.19. tronweb 6.5.1 (the latest release) pins axios to
exactly 1.18.0, which is affected by GHSA-r4gj-5m52-g5wh (range
>=1.17.0 <1.20.0), and the old 0.2x axios copies inside rubic-sdk and
its dependencies carry about 35 more advisories. One axios everywhere
removes the advisory the gate reported as new and the old ones. Overrides
apply to installs of this repository only; consumers resolve axios from
the dependency ranges as before. All axios users here use the plain
default-import request API, which is the same in 0.2x and 1.x.
bun audit on this lockfile: 223 findings on main -> 56 (3 critical,
28 high, 23 moderate, 2 low). Against main's lockfile no (package,
advisory) pair is added.
npm pack (used by the packed-consumer checks) rejects an override that differs from the direct dependency spec: "EOVERRIDE: Override for axios@^1.16.1 conflicts with direct dependency". Use the same range in both places: axios ^1.20.0 as the direct dependency and as the override. Raising the direct floor to 1.20.0 also helps consumers, since axios 1.17 to 1.19 are affected by GHSA-r4gj-5m52-g5wh and several older advisories; the resolved version in bun.lock stays 1.20.0, so nothing else changes. The lockfile stays at lockfileVersion 1 and installs with bun 1.2.19 and bun 1.4 under --frozen-lockfile.
|
hackobi
added
the
request-chef-review
|
Automated launch review: safe at An automated reviewer checked this PR for the Demos mainnet launch, using public research on how established chains handle the same problem. Each finding cites the code at this head. If a finding is wrong, reply here with the reason.
|
First step of the dependency clean-up that the pre-launch audit asked for. Consumers of
@kynesyslabs/demosdk(wallet extension, incentives) inherit hundreds of advisories from this package's tree;bun auditon this repo reports 223 findings (8 critical), 187 of them in the production closure of 1777 packages (about 1.1 GB).This PR removes 16 direct dependencies with no import,
require, config, script, export or peer reference anywhere in the repository:@coral-xyz/anchor(Solana uses@project-serum/anchor),@metaplex-foundation/js,@roamhq/wrtc,simple-peerand its types,@simplewebauthn/serverand/browser,sigstore,falcon-js,mlkem,ntru,pqcrypto,sphincs(Falcon isfalcon-sign, ML-DSA/ML-KEM are@noble/post-quantum, SHA-3 is@noble/hashes),js-sha3,libsodium-wrappers-sumo,lodash. Production closure 1777 → 1583 packages, about 100 MB less per install; audit 223 → 209 (critical 8 → 7). No remaining package changes its resolved version; only hoisting moves inbun.lock.superdilithiumstays because the typedoc workflow patches it.Verified on a clean
bun install --frozen-lockfileof the commit: build OK,tsc --noEmitclean, all 41exportstargets present and the 37 non-wildcard ones importable under node,pqc.spec18/18 (ml-dsa, falcon, ml-kem, sha3),txSignatureDomain.spec8/8.test:package-esm(npm pack install) left to CI.Next steps, each needing a product decision (full audit in the review notes):
rubic-sdkis anoptionalDependency, installed by default by every consumer, used only by thebridge/rubicsubpath, and alone accounts for 935 packages, 516 MB, 49 findings and 4 of the 6 critical ones; moving it to an optional peer takes the closure to about 500 packages and 94 findings. A lockfile refresh within current ranges takes this repo's own audit from 223 to 96.@ton/coreshould move to ^0.63 to match@ton/ton16. cosmjs 0.32 → 0.39 drops the last critical (protobufjs6.11). The deadten.tsmodule is the only user ofweb3.Lockfile refresh (second part of this PR).
bun.lockis regenerated within the declared ranges (kept at lockfileVersion 1 so the bun 1.2.19 pinned in CI still reads it): lodash → 4.18.1, tmp → 0.2.7, fast-xml-parser no longer resolves, xrpl → 3.2.0, tronweb → 6.5.1,@ton/core→ ^0.63.0 (required by@ton/ton16).bun auditon this repo goes 223 → 56 findings (critical 8 → 3; the remaining ones areprotobufjs6.11 via cosmjs/ics23 and the rubic-sdk tree, which are the next plan items). Two consumer-facing notes: the directaxiosrange moves to ^1.20.0 and anoverridesentry pins axios to that range, because tronweb 6.5.1 pins axios 1.18.0 (GHSA-r4gj-5m52-g5wh); the override applies only to installs of this repository, so consumers keep tronweb's nested copy until tronweb moves.jest.config.tsnow transforms nested@noble/@scurecopies (xrpl 3.2.0 pulls an ESM-only@noble/hashes). Verified: frozen installs with bun 1.2.19 and 1.4, build, tsc, exports, pqc/txSignatureDomain/xrpl specs; the packed-ESM (Node 20 and 22) and messaging packed-consumer CI jobs pass.Supply-chain note on the refreshed lock.
bitcoinjs-lib6.1.9 andbip393.1.2 were published on 2026-10-13 by a new npm publisher without provenance attestations. Both tarballs were diffed against 6.1.7 / 3.1.0 before this PR: only hardening changes (bip39 entropy-hex validation and a wordlisthasOwnPropertyguard; bitcoinjs-lib Merkle mutation check, PSBT cache invalidation, UTXO consistency check ingetUtxoForInput), no install scripts, no network access, no new dependencies. A BTC PSBT sign smoke test is worth running before the next release.