[Snyk] Fix for 1 vulnerabilities by trajan0x · Pull Request #4134 · synapsecns/sanguine

trajan0x · 2026-09-21T14:20:23Z

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

packages/synapse-interface/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️

Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Uncontrolled Recursion SNYK-JS-BRACES-19963945

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled Recursion

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BRACES-19963945

trajan0x · 2026-09-21T14:20:24Z

This update includes major version upgrades for tailwindcss and @wagmi/connectors, both of which introduce significant breaking changes and require developer action to migrate.

Top 2 Most Impactful Upgrades

1. tailwindcss: 3.4.14 → 4.0.0 (HIGH RISK)

Tailwind CSS v4 is a complete rewrite with a new, faster engine written in Rust. It introduces a fundamental shift in how the framework is configured.

Breaking Changes:

CSS-First Configuration: The largest change is the move away from tailwind.config.js. Configuration is now primarily handled inside your main CSS file using the @theme directive. While the JavaScript config can be used temporarily with @config "./tailwind.config.js";, several options like corePlugins and safelist are not supported in this mode.
Build Tool Integration: The tailwindcss package is no longer a direct PostCSS plugin. You must use new integration packages like @tailwindcss/postcss or @tailwindcss/vite.
Modern Browser Target: v4 targets modern browsers (e.g., Chrome 111+, Safari 16.4+). Support for older browsers is not included by default.
Utility Renames: Some utility classes have been renamed, such as decoration-slice to box-decoration-clone.

Recommendation:

Create a dedicated branch for the upgrade.
Use the official automated upgrade tool by running npx @tailwindcss/upgrade.
Follow the official migration guide to update your PostCSS/Vite configuration and move your theme customizations from JavaScript to CSS.

2. @wagmi/connectors: 5.3.0 → 7.0.0 (HIGH RISK)

This upgrade spans several major versions of wagmi, which was rewritten to use viem instead of ethers.js. This is a fundamental architectural change that impacts the entire library, including connectors.

Breaking Changes:

Ethers.js to Viem: The underlying dependency has changed from ethers.js to viem. This affects data types, terminology, and function calls. For example, BigNumber is replaced by native BigInt, and terms like "Provider" and "Signer" are now "Public Client" and "Wallet Client".
Connector API: Connectors are no longer instantiated as classes (e.g., new InjectedConnector()). They are now functions (e.g., injected()).
Configuration: The setup process has changed from createClient to createConfig, which has a different API. The autoConnect parameter has been removed in favor of the useReconnect hook.
Entrypoints: Individual connector entrypoints (e.g., wagmi/connectors/injected) have been removed. All connectors should be imported from the unified 'wagmi/connectors' entrypoint.

Recommendation:

This upgrade requires a thorough migration. Review the official wagmi v1 and v2 migration guides, as the changes in @wagmi/connectors are driven by the core library's evolution.
Plan to refactor all wagmi-related code, including configuration, hook usage, and handling of data types like BigInt.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

cloudflare-workers-and-pages · 2026-09-21T14:20:25Z

Deploying sanguine-fe with Cloudflare Pages

Latest commit:	`17ee49d`
Status:	🚫 Build failed.

View logs

vercel · 2026-09-21T14:20:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sanguine	Error		Sep 21, 2026 2:32pm UTC

coderabbitai · 2026-09-21T14:20:30Z

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (2)

WIP
DO NOT MERGE

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: synapsecns/sanguine/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: f0c61feb-89e2-48fe-8045-0a4051db1723

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-09-21T14:27:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.65757%. Comparing base (3e98c89) to head (17ee49d).
⚠️ Report is 13 commits behind head on master.

Additional details and impacted files

@@              Coverage Diff              @@
##              master       #4134   +/-   ##
=============================================
  Coverage   55.65757%   55.65757%           
=============================================
  Files            144         144           
  Lines           4030        4030           
  Branches         752         752           
=============================================
  Hits            2243        2243           
  Misses          1697        1697           
  Partials          90          90

Flag	Coverage Δ
packages	`55.65757% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

codecov · 2026-09-21T14:28:47Z

Bundle Report

Changes will decrease total bundle size by 885.57kB (-2.61%) ⬇️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
synapse-interface-server-cjs	2.28MB	-11 bytes (-0.0%) ⬇️
synapse-interface-client-array-push	7.14MB	-885.55kB (-11.04%) ⬇️

Affected Assets, Files, and Routes:

view changes for bundle: synapse-interface-client-array-push

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
`static/chunks/pages/_app-*.js`	14.79kB	2.41MB	0.62%
`server/middleware-*.js`	-34 bytes	16.9kB	-0.2%
`build-*.json`	-41 bytes	19.74kB	-0.21%
`static/JLbv1FJRGsLXDITD2WUyO/_buildManifest.js` (New)	6.67kB	6.67kB	100.0% 🚀
`server/next-*.js`	-10 bytes	106 bytes	-8.62%
`server/next-*.json`	-10 bytes	77 bytes	-11.49%
`static/JLbv1FJRGsLXDITD2WUyO/_ssgManifest.js` (New)	77 bytes	77 bytes	100.0% 🚀
~~*`static/css/.css`*~~ (Deleted)*	-157.39kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.bf52a224.otf`*~~ (Deleted)*	-64.04kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.6315670a.otf`*~~ (Deleted)*	-63.87kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.cc7bc424.otf`*~~ (Deleted)*	-63.8kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.cf2af866.otf`*~~ (Deleted)*	-63.15kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.414e0c9a.otf`*~~ (Deleted)*	-62.31kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.469f82b6.otf`*~~ (Deleted)*	-62.14kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.ffaf688a.otf`*~~ (Deleted)*	-62.08kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.c195df6b.otf`*~~ (Deleted)*	-61.7kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.bb60ee94.otf`*~~ (Deleted)*	-61.33kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.16605ca2.otf`*~~ (Deleted)*	-61.18kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.cdee39e5.otf`*~~ (Deleted)*	-59.5kB	0 bytes	-100.0% 🗑️
~~*`static/media/Matter-.4d10a936.otf`*~~ (Deleted)*	-57.76kB	0 bytes	-100.0% 🗑️
~~`static/6e-jCvjh7iR7y8dfP3neu/_buildManifest.js`~~ (Deleted)	-6.67kB	0 bytes	-100.0% 🗑️
~~`static/6e-jCvjh7iR7y8dfP3neu/_ssgManifest.js`~~ (Deleted)	-77 bytes	0 bytes	-100.0% 🗑️

view changes for bundle: synapse-interface-server-cjs

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
`6814.js`	-11 bytes	475.55kB	-0.0%

github-actions · 2026-10-06T01:54:35Z

This PR is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 5 days.

fix: packages/synapse-interface/package.json to reduce vulnerabilities

17ee49d

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BRACES-19963945

trajan0x requested review from abtestingalpha and aureliusbtc as code owners September 21, 2026 14:20

github-actions Bot added M-synapse-interface size/xs labels Sep 21, 2026

vercel Bot had a problem deploying to Preview September 21, 2026 14:32 Failure

github-actions Bot added Stale and removed Stale labels Oct 6, 2026

Navigation Menu

Repository navigation

[Snyk] Fix for 1 vulnerabilities - #4134

[Snyk] Fix for 1 vulnerabilities#4134
trajan0x wants to merge 1 commit into
masterfrom
snyk-fix-42ff9c92b4c106a07b89cbec9901cc1f

trajan0x commented Sep 21, 2026

Uh oh!

trajan0x commented Sep 21, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 21, 2026

Review skipped

Uh oh!

codecov Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Sep 21, 2026 •

edited

Loading

Assets Changed:

Assets Changed:

Uh oh!

github-actions Bot commented Oct 6, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

trajan0x commented Sep 21, 2026

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

Note for zero-installs users

Vulnerabilities that will be fixed with an upgrade:

Breaking Change Risk

Uh oh!

trajan0x commented Sep 21, 2026

Top 2 Most Impactful Upgrades

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying sanguine-fe with Cloudflare Pages

Uh oh!

vercel Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 21, 2026

Review skipped

Uh oh!

codecov Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codecov Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Report

Affected Assets, Files, and Routes:

Assets Changed:

Assets Changed:

Uh oh!

github-actions Bot commented Oct 6, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cloudflare-workers-and-pages Bot commented Sep 21, 2026 •

edited

Loading

vercel Bot commented Sep 21, 2026 •

edited

Loading

codecov Bot commented Sep 21, 2026 •

edited

Loading

codecov Bot commented Sep 21, 2026 •

edited

Loading