git.iko.soy/bridge
on master help sign in
https environment setup changes
039fe33~sarlev-sarsen
.gitignore+1
compare with master
unifiedsplit
@@ -28,3 +28,4 @@ bridge*.tar.gz
28checksums.txt
28checksums.txt
29
29
30*.pem
30*.pem
31+localhost+2*
DEVELOPMENT.md+30−8
@@ -80,19 +80,41 @@ of having to re-authenticate whenever you make a change or refresh the page):
80
80
81## HTTPS
81## HTTPS
82
82
83−For development, you can enable HTTPS on localhost without a certificate for
83+For development, Bridge will not run unless you access localhost via HTTPS. To do this, you will want to set up a self-signed cert using `mkcert`:
84−Chrome by pasting the following into the URL bar:
85
84
85+1. Install `mkcert`:
86```
86```
87−chrome://flags/#allow-insecure-localhost
87+# on MacOS using homebrew
88+brew install mkcert
89+
90+# on Linux using apt # TODO Confirm functionality
91+sudo apt install libnss3-tools
92+wget -O mkcert https://github.com/FiloSottile/mkcert/releases/latest/download/mkcert-v*-linux-amd64
93+chmod +x mkcert
94+sudo mv mkcert /usr/local/bin/
88```
95```
89
96
90−In Firefox, you may need to allow connecting to the unsecured local node
97+2. Create certificate authority:
91−websocket. Do this by going to `about:config` and setting the
98+```
92−`network.websocket.allowInsecureFromHTTPS` flag to `true`.
99+# install local cert authority
100+mkcert -install
101+```
102+
103+3. Generate localhost Cert:
104+```
105+# Navigate to your bridge project directory
106+cd /path/to/urbit/bridge
107+
108+# Generate certificate for localhost
109+mkcert localhost 127.0.0.1 ::1
110+```
111+
112+This creates two files:
113+- `localhost+2.pem` (certificate)
114+- `localhost+2-key.pem` (private key)
115+
93
116
94−Additionally you need to run with the `HTTPS` environment variable set to
117+Note: as of 3.3.0, Bridge is deprecating explicit support for Firefox. Privacy focused users are recommended to use Brave Browser.
95−`true`. Note that `npm run pilot` will handle this automatically.
96
118
97## WalletConnect
119## WalletConnect
98
120
bridge-npm-audit.txtnew file+697
@@ -0,0 +1,697 @@
1+# npm audit report
2+
3+@babel/helpers <7.26.10
4+Severity: moderate
5+Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
6+fix available via `npm audit fix`
7+node_modules/@babel/helpers
8+
9+@babel/runtime-corejs3 <7.26.10
10+Severity: moderate
11+Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
12+fix available via `npm audit fix`
13+node_modules/@babel/runtime-corejs3
14+
15+@babel/traverse <7.23.2
16+Severity: critical
17+Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92
18+fix available via `npm audit fix`
19+node_modules/@babel/traverse
20+
21+ajv <6.12.3
22+Severity: moderate
23+Prototype Pollution in Ajv - https://github.com/advisories/GHSA-v88g-cgmw-v5xw
24+fix available via `npm audit fix --force`
25+Will install serve@14.2.5, which is a breaking change
26+node_modules/serve/node_modules/ajv
27+ serve 5.0.4 - 14.2.4
28+ Depends on vulnerable versions of ajv
29+ Depends on vulnerable versions of boxen
30+ Depends on vulnerable versions of clipboardy
31+ Depends on vulnerable versions of compression
32+ Depends on vulnerable versions of serve-handler
33+ node_modules/serve
34+
35+ansi-regex 3.0.0
36+Severity: high
37+Inefficient Regular Expression Complexity in chalk/ansi-regex - https://github.com/advisories/GHSA-93q8-gq69-wqmw
38+fix available via `npm audit fix`
39+node_modules/ansi-align/node_modules/ansi-regex
40+node_modules/boxen/node_modules/ansi-regex
41+node_modules/widest-line/node_modules/ansi-regex
42+
43+axios 1.0.0 - 1.11.0
44+Severity: high
45+Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
46+Server-Side Request Forgery in axios - https://github.com/advisories/GHSA-8hc4-vh64-cxmj
47+axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - https://github.com/advisories/GHSA-jr5f-v2jv-69x6
48+Axios is vulnerable to DoS attack through lack of data size check - https://github.com/advisories/GHSA-4hjh-wcwx-xvwj
49+fix available via `npm audit fix --force`
50+Will install truffle@5.5.7, which is a breaking change
51+node_modules/axios
52+ @truffle/dashboard-message-bus-client >=0.1.10
53+ Depends on vulnerable versions of axios
54+ node_modules/@truffle/dashboard-message-bus-client
55+ @truffle/events >=0.1.21
56+ Depends on vulnerable versions of @truffle/dashboard-message-bus-client
57+ node_modules/@truffle/events
58+ @truffle/config *
59+ Depends on vulnerable versions of @truffle/events
60+ Depends on vulnerable versions of @truffle/provider
61+ node_modules/@truffle/config
62+ @truffle/db >=2.0.13
63+ Depends on vulnerable versions of @truffle/config
64+ node_modules/@truffle/db
65+ @truffle/db-loader >=0.2.13
66+ Depends on vulnerable versions of @truffle/db
67+ node_modules/@truffle/db-loader
68+ truffle 5.1.9-nodeLTS.0 || 5.1.14-alphaTez.0 - 5.1.14-truffleLogger.0 || >=5.1.66
69+ Depends on vulnerable versions of @truffle/db
70+ Depends on vulnerable versions of @truffle/db-loader
71+ Depends on vulnerable versions of @truffle/debugger
72+ Depends on vulnerable versions of ganache
73+ Depends on vulnerable versions of mocha
74+ node_modules/truffle
75+
76+babel-traverse *
77+Severity: critical
78+Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92
79+fix available via `npm audit fix --force`
80+Will install azimuth-js@0.15.0, which is a breaking change
81+node_modules/babel-traverse
82+ babel-core 5.8.20 - 7.0.0-beta.3
83+ Depends on vulnerable versions of babel-helpers
84+ Depends on vulnerable versions of babel-register
85+ Depends on vulnerable versions of babel-template
86+ Depends on vulnerable versions of babel-traverse
87+ Depends on vulnerable versions of json5
88+ node_modules/babel-core
89+ babel-register *
90+ Depends on vulnerable versions of babel-core
91+ node_modules/babel-register
92+ azimuth-solidity *
93+ Depends on vulnerable versions of babel-register
94+ node_modules/azimuth-solidity
95+ azimuth-js *
96+ Depends on vulnerable versions of azimuth-solidity
97+ Depends on vulnerable versions of web3
98+ node_modules/azimuth-js
99+ babel-template *
100+ Depends on vulnerable versions of babel-traverse
101+ node_modules/babel-template
102+ babel-helpers *
103+ Depends on vulnerable versions of babel-template
104+ node_modules/babel-helpers
105+
106+base-x <=3.0.10
107+Severity: high
108+Homograph attack allows Unicode lookalike characters to bypass validation. - https://github.com/advisories/GHSA-xq7p-g2vc-g82p
109+fix available via `npm audit fix`
110+node_modules/base-x
111+
112+brace-expansion 1.0.0 - 1.1.11
113+brace-expansion Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
114+fix available via `npm audit fix`
115+node_modules/brace-expansion
116+node_modules/ganache/node_modules/brace-expansion
117+node_modules/truffle/node_modules/ganache/node_modules/brace-expansion
118+
119+braces <3.0.3
120+Severity: high
121+Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
122+fix available via `npm audit fix`
123+node_modules/braces
124+node_modules/ganache/node_modules/braces
125+node_modules/truffle/node_modules/ganache/node_modules/braces
126+
127+browserify-sign 2.6.0 - 4.2.1
128+Severity: high
129+browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack - https://github.com/advisories/GHSA-x9w5-v3q2-3rhw
130+fix available via `npm audit fix`
131+node_modules/browserify-sign
132+node_modules/ganache/node_modules/browserify-sign
133+node_modules/truffle/node_modules/ganache/node_modules/browserify-sign
134+
135+cipher-base <=1.0.4
136+Severity: critical
137+cipher-base is missing type checks, leading to hash rewind and passing on crafted data - https://github.com/advisories/GHSA-cpq7-6gpm-g9rc
138+fix available via `npm audit fix`
139+node_modules/cipher-base
140+node_modules/ganache/node_modules/cipher-base
141+node_modules/truffle/node_modules/ganache/node_modules/cipher-base
142+
143+cross-spawn <6.0.6 || >=7.0.0 <7.0.5
144+Severity: high
145+Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
146+Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
147+fix available via `npm audit fix --force`
148+Will install serve@14.2.5, which is a breaking change
149+node_modules/clipboardy/node_modules/cross-spawn
150+node_modules/cross-spawn
151+node_modules/eslint/node_modules/cross-spawn
152+node_modules/ganache/node_modules/cross-spawn
153+node_modules/term-size/node_modules/cross-spawn
154+node_modules/truffle/node_modules/ganache/node_modules/cross-spawn
155+ execa 0.5.0 - 0.9.0
156+ Depends on vulnerable versions of cross-spawn
157+ node_modules/clipboardy/node_modules/execa
158+ node_modules/term-size/node_modules/execa
159+ clipboardy <=1.2.3
160+ Depends on vulnerable versions of execa
161+ node_modules/clipboardy
162+ term-size 1.0.0 - 1.2.0
163+ Depends on vulnerable versions of execa
164+ node_modules/term-size
165+ boxen 1.2.0 - 3.2.0
166+ Depends on vulnerable versions of term-size
167+ node_modules/boxen
168+
169+crypto-js <4.2.0
170+Severity: critical
171+crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard - https://github.com/advisories/GHSA-xwcq-pm8m-c4vf
172+fix available via `npm audit fix --force`
173+Will install secure-ls@2.0.0, which is a breaking change
174+node_modules/crypto-js
175+ secure-ls <=1.2.6
176+ Depends on vulnerable versions of crypto-js
177+ node_modules/secure-ls
178+
179+ejs <=3.1.9
180+Severity: critical
181+ejs template injection vulnerability - https://github.com/advisories/GHSA-phwq-j96m-2c2q
182+ejs lacks certain pollution protection - https://github.com/advisories/GHSA-ghr5-ch3p-vcr6
183+fix available via `npm audit fix`
184+node_modules/source-map-explorer/node_modules/ejs
185+
186+elliptic <=6.6.0
187+Severity: critical
188+Elliptic's verify function omits uniqueness validation - https://github.com/advisories/GHSA-434g-2637-qmqr
189+Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) - https://github.com/advisories/GHSA-vjh7-7g9h-fjfh
190+Valid ECDSA signatures erroneously rejected in Elliptic - https://github.com/advisories/GHSA-fc9h-whq2-v747
191+Elliptic's EDDSA missing signature length check - https://github.com/advisories/GHSA-f7q4-pwc6-w24p
192+Elliptic's ECDSA missing check for whether leading bit of r and s is zero - https://github.com/advisories/GHSA-977x-g7h5-7qgw
193+Elliptic allows BER-encoded signatures - https://github.com/advisories/GHSA-49q7-c7j4-3p7m
194+fix available via `npm audit fix --force`
195+Will install truffle@5.5.7, which is a breaking change
196+node_modules/elliptic
197+node_modules/ganache/node_modules/elliptic
198+node_modules/truffle/node_modules/ganache/node_modules/elliptic
199+ ethers 3.0.0 - 4.0.49
200+ Depends on vulnerable versions of elliptic
201+ node_modules/@truffle/interface-adapter/node_modules/ethers
202+ @truffle/interface-adapter *
203+ Depends on vulnerable versions of ethers
204+ Depends on vulnerable versions of web3
205+ node_modules/@truffle/interface-adapter
206+ @truffle/provider *
207+ Depends on vulnerable versions of @truffle/interface-adapter
208+ Depends on vulnerable versions of web3
209+ node_modules/@truffle/provider
210+
211+esbuild <=0.24.2
212+Severity: moderate
213+esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
214+fix available via `npm audit fix --force`
215+Will install vite@3.2.11, which is outside the stated dependency range
216+node_modules/esbuild
217+ vite <=6.1.6
218+ Depends on vulnerable versions of esbuild
219+ Depends on vulnerable versions of rollup
220+ node_modules/vite
221+
222+fast-redact *
223+fast-redact vulnerable to prototype pollution - https://github.com/advisories/GHSA-ffrw-9mx8-89p8
224+fix available via `npm audit fix`
225+node_modules/fast-redact
226+ pino 5.0.0-rc.1 - 9.11.0
227+ Depends on vulnerable versions of fast-redact
228+ node_modules/pino
229+ @walletconnect/logger <=2.1.3
230+ Depends on vulnerable versions of pino
231+ node_modules/@walletconnect/logger
232+ @walletconnect/core 2.0.0-2.0.0-beta.102 - 2.22.2
233+ Depends on vulnerable versions of @walletconnect/logger
234+ Depends on vulnerable versions of @walletconnect/types
235+ Depends on vulnerable versions of @walletconnect/utils
236+ node_modules/@walletconnect/sign-client/node_modules/@walletconnect/core
237+ @walletconnect/sign-client <=2.22.2
238+ Depends on vulnerable versions of @walletconnect/core
239+ Depends on vulnerable versions of @walletconnect/logger
240+ Depends on vulnerable versions of @walletconnect/types
241+ Depends on vulnerable versions of @walletconnect/utils
242+ node_modules/@walletconnect/sign-client
243+ @walletconnect/types 2.1.2-eaa4818c - 2.22.2
244+ Depends on vulnerable versions of @walletconnect/logger
245+ node_modules/@walletconnect/types
246+ @walletconnect/utils 2.1.2-eaa4818c - 2.22.2
247+ Depends on vulnerable versions of @walletconnect/types
248+ node_modules/@walletconnect/sign-client/node_modules/@walletconnect/utils
249+
250+form-data <2.5.4
251+Severity: critical
252+form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
253+fix available via `npm audit fix`
254+node_modules/form-data
255+ request *
256+ Depends on vulnerable versions of form-data
257+ Depends on vulnerable versions of tough-cookie
258+ node_modules/request
259+ jsdom 0.1.20 || 0.2.0 - 16.5.3
260+ Depends on vulnerable versions of request
261+ Depends on vulnerable versions of tough-cookie
262+ node_modules/jsdom
263+ servify *
264+ Depends on vulnerable versions of request
265+ node_modules/servify
266+ eth-lib <=0.1.29
267+ Depends on vulnerable versions of servify
268+ Depends on vulnerable versions of ws
269+ node_modules/eth-lib
270+ swarm-js >=0.1.36
271+ Depends on vulnerable versions of eth-lib
272+ Depends on vulnerable versions of tar
273+ node_modules/swarm-js
274+ web3-bzz *
275+ Depends on vulnerable versions of swarm-js
276+ node_modules/@truffle/debugger/node_modules/web3-bzz
277+ node_modules/@truffle/interface-adapter/node_modules/web3-bzz
278+ node_modules/@truffle/provider/node_modules/web3-bzz
279+ node_modules/web3-bzz
280+
281+get-func-name <2.0.1
282+Severity: high
283+Chaijs/get-func-name vulnerable to ReDoS - https://github.com/advisories/GHSA-4q6p-r6v2-jvc5
284+fix available via `npm audit fix`
285+node_modules/get-func-name
286+
287+js-yaml <3.14.2 || >=4.0.0 <4.1.1
288+Severity: moderate
289+js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m
290+js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m
291+fix available via `npm audit fix --force`
292+Will install truffle@5.5.7, which is a breaking change
293+node_modules/@eslint/eslintrc/node_modules/js-yaml
294+node_modules/eslint/node_modules/js-yaml
295+node_modules/ganache/node_modules/js-yaml
296+node_modules/js-yaml
297+node_modules/mocha/node_modules/js-yaml
298+node_modules/truffle/node_modules/ganache/node_modules/js-yaml
299+ mocha 5.1.0 - 10.5.2
300+ Depends on vulnerable versions of js-yaml
301+ Depends on vulnerable versions of minimatch
302+ Depends on vulnerable versions of nanoid
303+ Depends on vulnerable versions of serialize-javascript
304+ node_modules/ganache/node_modules/mocha
305+ node_modules/mocha
306+ node_modules/truffle/node_modules/ganache/node_modules/mocha
307+
308+json-schema <0.4.0
309+Severity: critical
310+json-schema is vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-896r-f27r-55mw
311+fix available via `npm audit fix`
312+node_modules/json-schema
313+ jsprim 0.3.0 - 1.4.1 || 2.0.0 - 2.0.1
314+ Depends on vulnerable versions of json-schema
315+ node_modules/jsprim
316+
317+json5 <1.0.2 || >=2.0.0 <2.2.2
318+Severity: high
319+Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
320+Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
321+fix available via `npm audit fix --force`
322+Will install azimuth-js@0.15.0, which is a breaking change
323+node_modules/@babel/core/node_modules/json5
324+node_modules/ganache/node_modules/json5
325+node_modules/json5
326+node_modules/truffle/node_modules/ganache/node_modules/json5
327+node_modules/vite-plugin-comlink/node_modules/json5
328+ vite-plugin-comlink 3.0.3 - 3.0.5
329+ Depends on vulnerable versions of json5
330+ node_modules/vite-plugin-comlink
331+
332+jszip <3.8.0
333+Severity: moderate
334+JSZip contains Path Traversal via loadAsync - https://github.com/advisories/GHSA-36fh-84j7-cv5h
335+fix available via `npm audit fix`
336+node_modules/jszip
337+
338+markdown-to-jsx <7.4.0
339+Severity: moderate
340+Cross site scripting in markdown-to-jsx - https://github.com/advisories/GHSA-4wx3-54gh-9fr9
341+fix available via `npm audit fix`
342+node_modules/markdown-to-jsx
343+
344+micromatch <4.0.8
345+Severity: moderate
346+Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv
347+fix available via `npm audit fix`
348+node_modules/ganache/node_modules/micromatch
349+node_modules/micromatch
350+node_modules/truffle/node_modules/ganache/node_modules/micromatch
351+
352+minimatch <3.0.5
353+Severity: high
354+minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
355+fix available via `npm audit fix --force`
356+Will install truffle@5.5.7, which is a breaking change
357+node_modules/ganache/node_modules/minimatch
358+node_modules/minimatch
359+node_modules/truffle/node_modules/ganache/node_modules/minimatch
360+ serve-handler <=6.1.5
361+ Depends on vulnerable versions of minimatch
362+ Depends on vulnerable versions of path-to-regexp
363+ node_modules/serve-handler
364+
365+nanoid <=3.3.7
366+Severity: moderate
367+Predictable results in nanoid generation when given non-integer values - https://github.com/advisories/GHSA-mwcw-c2x4-8c55
368+Exposure of Sensitive Information to an Unauthorized Actor in nanoid - https://github.com/advisories/GHSA-qrpm-p2h7-hrv2
369+fix available via `npm audit fix --force`
370+Will install truffle@5.5.7, which is a breaking change
371+node_modules/ganache/node_modules/nanoid
372+node_modules/nanoid
373+node_modules/truffle/node_modules/ganache/node_modules/nanoid
374+node_modules/vite/node_modules/nanoid
375+
376+on-headers <1.1.0
377+on-headers is vulnerable to http response header manipulation - https://github.com/advisories/GHSA-76c9-3jph-rj3q
378+fix available via `npm audit fix --force`
379+Will install serve@14.2.5, which is a breaking change
380+node_modules/on-headers
381+ compression 1.0.3 - 1.8.0
382+ Depends on vulnerable versions of on-headers
383+ node_modules/serve/node_modules/compression
384+
385+path-to-regexp 2.0.0 - 3.2.0
386+Severity: high
387+path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j
388+fix available via `npm audit fix --force`
389+Will install serve@14.2.5, which is a breaking change
390+node_modules/serve-handler/node_modules/path-to-regexp
391+
392+pbkdf2 <=3.1.2
393+Severity: critical
394+pbkdf2 silently disregards Uint8Array input, returning static keys - https://github.com/advisories/GHSA-v62p-rq8g-8h59
395+pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos - https://github.com/advisories/GHSA-h7cp-r72f-jxh6
396+fix available via `npm audit fix`
397+node_modules/ganache/node_modules/pbkdf2
398+node_modules/pbkdf2
399+node_modules/truffle/node_modules/ganache/node_modules/pbkdf2
400+
401+postcss <8.4.31
402+Severity: moderate
403+PostCSS line return parsing error - https://github.com/advisories/GHSA-7fh5-64p2-3v2j
404+fix available via `npm audit fix`
405+node_modules/vite/node_modules/postcss
406+
407+qs 6.5.0 - 6.5.2
408+Severity: high
409+qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp
410+fix available via `npm audit fix`
411+node_modules/request/node_modules/qs
412+
413+
414+rollup <2.79.2
415+Severity: high
416+DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - https://github.com/advisories/GHSA-gcx4-mw62-g8wm
417+fix available via `npm audit fix --force`
418+Will install vite@3.2.11, which is outside the stated dependency range
419+node_modules/vite/node_modules/rollup
420+
421+secp256k1 <=3.8.0 || 4.0.0 - 4.0.3
422+Severity: high
423+secp256k1-node allows private key extraction over ECDH - https://github.com/advisories/GHSA-584q-6j8j-r5pm
424+secp256k1-node allows private key extraction over ECDH - https://github.com/advisories/GHSA-584q-6j8j-r5pm
425+fix available via `npm audit fix --force`
426+Will install ganache@6.4.5, which is a breaking change
427+node_modules/ganache/node_modules/secp256k1
428+node_modules/secp256k1
429+node_modules/truffle/node_modules/ganache/node_modules/secp256k1
430+node_modules/urbit-key-generation/node_modules/secp256k1
431+ ganache <=3.0.0-internal.16 || >=7.0.0-alpha.0
432+ Depends on vulnerable versions of @trufflesuite/uws-js-unofficial
433+ Depends on vulnerable versions of secp256k1
434+ node_modules/ganache
435+ node_modules/truffle/node_modules/ganache
436+ keythereum 1.2.0
437+ Depends on vulnerable versions of secp256k1
438+ node_modules/keythereum
439+
440+semver <=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1
441+Severity: high
442+semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
443+semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
444+semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
445+fix available via `npm audit fix`
446+node_modules/@babel/core/node_modules/semver
447+node_modules/cross-spawn/node_modules/semver
448+node_modules/ganache/node_modules/semver
449+node_modules/normalize-package-data/node_modules/semver
450+node_modules/truffle/node_modules/ganache/node_modules/semver
451+ @microsoft/api-extractor 7.9.1 - 7.36.2
452+ Depends on vulnerable versions of @microsoft/api-extractor-model
453+ Depends on vulnerable versions of @rushstack/node-core-library
454+ Depends on vulnerable versions of semver
455+ node_modules/ganache/node_modules/@microsoft/api-extractor
456+ node_modules/truffle/node_modules/ganache/node_modules/@microsoft/api-extractor
457+ @rushstack/node-core-library 3.25.0 - 3.59.5
458+ Depends on vulnerable versions of semver
459+ node_modules/ganache/node_modules/@rushstack/node-core-library
460+ node_modules/truffle/node_modules/ganache/node_modules/@rushstack/node-core-library
461+ @microsoft/api-extractor-model 7.8.12 - 7.27.4
462+ Depends on vulnerable versions of @rushstack/node-core-library
463+ node_modules/ganache/node_modules/@microsoft/api-extractor-model
464+ node_modules/truffle/node_modules/ganache/node_modules/@microsoft/api-extractor-model
465+
466+serialize-javascript 6.0.0 - 6.0.1
467+Severity: moderate
468+Cross-site Scripting (XSS) in serialize-javascript - https://github.com/advisories/GHSA-76p7-773f-r4q5
469+fix available via `npm audit fix --force`
470+Will install truffle@5.5.7, which is a breaking change
471+node_modules/ganache/node_modules/serialize-javascript
472+node_modules/serialize-javascript
473+node_modules/truffle/node_modules/ganache/node_modules/serialize-javascript
474+
475+sha.js <=2.4.11
476+Severity: critical
477+sha.js is missing type checks leading to hash rewind and passing on crafted data - https://github.com/advisories/GHSA-95m3-7q98-8xr5
478+fix available via `npm audit fix`
479+node_modules/ganache/node_modules/sha.js
480+node_modules/sha.js
481+node_modules/truffle/node_modules/ganache/node_modules/sha.js
482+
483+shell-quote 1.6.3 - 1.7.2
484+Severity: critical
485+Improper Neutralization of Special Elements used in a Command in Shell-quote - https://github.com/advisories/GHSA-g4rg-993r-mgx7
486+fix available via `npm audit fix`
487+node_modules/shell-quote
488+
489+tar <6.2.1
490+Severity: moderate
491+Denial of service while parsing a tar file due to lack of folders count validation - https://github.com/advisories/GHSA-f5x3-32g6-xq36
492+fix available via `npm audit fix`
493+node_modules/tar
494+
495+tiny-secp256k1 <=1.1.6
496+Severity: high
497+tiny-secp256k1 allows for verify() bypass when running in bundled environment - https://github.com/advisories/GHSA-5vhg-9xg4-cv9m
498+tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment - https://github.com/advisories/GHSA-7mc2-6phr-23xc
499+fix available via `npm audit fix`
500+node_modules/tiny-secp256k1
501+
502+tough-cookie <4.1.3
503+Severity: moderate
504+tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
505+fix available via `npm audit fix`
506+node_modules/tough-cookie
507+
508+validator <13.15.20
509+Severity: moderate
510+validator.js has a URL validation bypass vulnerability in its isURL function - https://github.com/advisories/GHSA-9965-vmph-33xx
511+fix available via `npm audit fix`
512+node_modules/ganache/node_modules/validator
513+node_modules/truffle/node_modules/ganache/node_modules/validator
514+
515+
516+web3-core-method <=2.0.0-alpha.1
517+web3-core-method is vulnerable to prototype pollution - https://github.com/advisories/GHSA-2j4c-9qqq-896r
518+Depends on vulnerable versions of web3-core-subscriptions
519+fix available via `npm audit fix --force`
520+Will install web3-core@4.7.1, which is a breaking change
521+node_modules/@truffle/debugger/node_modules/web3-core-method
522+node_modules/@truffle/interface-adapter/node_modules/web3-core-method
523+node_modules/@truffle/provider/node_modules/web3-core-method
524+node_modules/web3-core-method
525+ web3-core <=2.0.0-alpha.1
526+ Depends on vulnerable versions of web3-core-method
527+ Depends on vulnerable versions of web3-core-method
528+ node_modules/@truffle/debugger/node_modules/web3-core
529+ node_modules/@truffle/interface-adapter/node_modules/web3-core
530+ node_modules/@truffle/provider/node_modules/web3-core
531+ node_modules/web3-core
532+ web3-eth-ens <=2.0.0-alpha.1
533+ Depends on vulnerable versions of web3-core
534+ Depends on vulnerable versions of web3-core
535+ Depends on vulnerable versions of web3-eth-contract
536+ Depends on vulnerable versions of web3-eth-contract
537+ node_modules/@truffle/debugger/node_modules/web3-eth-ens
538+ node_modules/@truffle/interface-adapter/node_modules/web3-eth-ens
539+ node_modules/@truffle/provider/node_modules/web3-eth-ens
540+ node_modules/web3-eth-ens
541+ web3-eth-personal <=2.0.0-alpha.1 || 4.0.9-dev.408125.0
542+ Depends on vulnerable versions of web3-core
543+ Depends on vulnerable versions of web3-core
544+ Depends on vulnerable versions of web3-core-method
545+ Depends on vulnerable versions of web3-core-method
546+ Depends on vulnerable versions of web3-net
547+ Depends on vulnerable versions of web3-net
548+ node_modules/@truffle/debugger/node_modules/web3-eth-personal
549+ node_modules/@truffle/interface-adapter/node_modules/web3-eth-personal
550+ node_modules/@truffle/provider/node_modules/web3-eth-personal
551+ node_modules/web3-eth-personal
552+ web3-net 1.2.0 - 2.0.0-alpha.1 || 4.0.8-dev.408125.0
553+ Depends on vulnerable versions of web3-core
554+ Depends on vulnerable versions of web3-core
555+ Depends on vulnerable versions of web3-core-method
556+ Depends on vulnerable versions of web3-core-method
557+ node_modules/@truffle/debugger/node_modules/web3-net
558+ node_modules/@truffle/interface-adapter/node_modules/web3-net
559+ node_modules/@truffle/provider/node_modules/web3-net
560+ node_modules/web3-net
561+ web3 1.0.0-beta.1 - 3.0.0-rc.0
562+ Depends on vulnerable versions of web3-bzz
563+ Depends on vulnerable versions of web3-core
564+ Depends on vulnerable versions of web3-core
565+ Depends on vulnerable versions of web3-eth
566+ Depends on vulnerable versions of web3-eth
567+ Depends on vulnerable versions of web3-eth-personal
568+ Depends on vulnerable versions of web3-eth-personal
569+ Depends on vulnerable versions of web3-net
570+ Depends on vulnerable versions of web3-net
571+ Depends on vulnerable versions of web3-shh
572+ Depends on vulnerable versions of web3-shh
573+ node_modules/@truffle/debugger/node_modules/web3
574+ node_modules/@truffle/interface-adapter/node_modules/web3
575+ node_modules/@truffle/provider/node_modules/web3
576+ node_modules/web3
577+ @truffle/debugger *
578+ Depends on vulnerable versions of @ensdomains/ensjs
579+ Depends on vulnerable versions of web3
580+ node_modules/@truffle/debugger
581+ web3-eth <=2.0.0-alpha.1
582+ Depends on vulnerable versions of web3-core
583+ Depends on vulnerable versions of web3-core
584+ Depends on vulnerable versions of web3-core-method
585+ Depends on vulnerable versions of web3-core-method
586+ Depends on vulnerable versions of web3-core-subscriptions
587+ Depends on vulnerable versions of web3-eth-accounts
588+ Depends on vulnerable versions of web3-eth-accounts
589+ Depends on vulnerable versions of web3-eth-contract
590+ Depends on vulnerable versions of web3-eth-contract
591+ Depends on vulnerable versions of web3-eth-ens
592+ Depends on vulnerable versions of web3-eth-ens
593+ Depends on vulnerable versions of web3-eth-personal
594+ Depends on vulnerable versions of web3-eth-personal
595+ Depends on vulnerable versions of web3-net
596+ Depends on vulnerable versions of web3-net
597+ node_modules/@truffle/debugger/node_modules/web3-eth
598+ node_modules/@truffle/interface-adapter/node_modules/web3-eth
599+ node_modules/@truffle/provider/node_modules/web3-eth
600+ node_modules/web3-eth
601+ web3-shh *
602+ Depends on vulnerable versions of web3-core
603+ Depends on vulnerable versions of web3-core
604+ Depends on vulnerable versions of web3-core-method
605+ Depends on vulnerable versions of web3-core-method
606+ Depends on vulnerable versions of web3-core-subscriptions
607+ Depends on vulnerable versions of web3-net
608+ Depends on vulnerable versions of web3-net
609+ node_modules/@truffle/debugger/node_modules/web3-shh
610+ node_modules/@truffle/interface-adapter/node_modules/web3-shh
611+ node_modules/@truffle/provider/node_modules/web3-shh
612+ node_modules/web3-shh
613+ web3-eth-accounts <=2.0.0-alpha.1
614+ Depends on vulnerable versions of web3-core
615+ Depends on vulnerable versions of web3-core
616+ Depends on vulnerable versions of web3-core-method
617+ Depends on vulnerable versions of web3-core-method
618+ node_modules/@truffle/debugger/node_modules/web3-eth-accounts
619+ node_modules/@truffle/interface-adapter/node_modules/web3-eth-accounts
620+ node_modules/@truffle/provider/node_modules/web3-eth-accounts
621+ node_modules/web3-eth-accounts
622+ web3-eth-contract <=2.0.0-alpha.1
623+ Depends on vulnerable versions of web3-core
624+ Depends on vulnerable versions of web3-core
625+ Depends on vulnerable versions of web3-core-method
626+ Depends on vulnerable versions of web3-core-method
627+ Depends on vulnerable versions of web3-core-subscriptions
628+ node_modules/@truffle/debugger/node_modules/web3-eth-contract
629+ node_modules/@truffle/interface-adapter/node_modules/web3-eth-contract
630+ node_modules/@truffle/provider/node_modules/web3-eth-contract
631+ node_modules/web3-eth-contract
632+
633+web3-core-subscriptions <=2.0.0-alpha.1
634+web3-core-subscriptions has a Prototype Pollution vulnerability - https://github.com/advisories/GHSA-hhf6-3xpg-pggx
635+fix available via `npm audit fix --force`
636+Will install web3-core@4.7.1, which is a breaking change
637+node_modules/@truffle/debugger/node_modules/web3-core-subscriptions
638+node_modules/@truffle/interface-adapter/node_modules/web3-core-subscriptions
639+node_modules/@truffle/provider/node_modules/web3-core-subscriptions
640+node_modules/web3-core-subscriptions
641+
642+webpack 5.0.0-alpha.0 - 5.93.0
643+Severity: critical
644+Cross-realm object access in Webpack 5 - https://github.com/advisories/GHSA-hc6q-2mpp-qw7j
645+Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - https://github.com/advisories/GHSA-4vvj-4cpr-p986
646+fix available via `npm audit fix`
647+node_modules/ganache/node_modules/webpack
648+node_modules/truffle/node_modules/ganache/node_modules/webpack
649+
650+word-wrap <1.2.4
651+Severity: moderate
652+word-wrap vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-j8xg-fqg3-53r7
653+fix available via `npm audit fix`
654+node_modules/word-wrap
655+
656+ws 2.1.0 - 5.2.3 || 7.0.0 - 7.5.9 || 8.0.0 - 8.17.0
657+Severity: high
658+ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
659+ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
660+ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
661+fix available via `npm audit fix --force`
662+Will install ganache@6.4.5, which is a breaking change
663+node_modules/eth-lib/node_modules/ws
664+node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/ws
665+node_modules/truffle/node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/ws
666+node_modules/ws
667+ @trufflesuite/uws-js-unofficial *
668+ Depends on vulnerable versions of ws
669+ node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial
670+ node_modules/truffle/node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial
671+
672+yargs-parser <=5.0.0
673+Severity: moderate
674+yargs-parser Vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-p9pc-299p-vxgp
675+fix available via `npm audit fix --force`
676+Will install truffle@5.5.7, which is a breaking change
677+node_modules/solc/node_modules/yargs-parser
678+ yargs 4.0.0-alpha1 - 7.0.0-alpha.3 || 7.1.1
679+ Depends on vulnerable versions of yargs-parser
680+ node_modules/solc/node_modules/yargs
681+ solc 0.3.6 - 0.4.26
682+ Depends on vulnerable versions of yargs
683+ node_modules/solc
684+ @ensdomains/ens *
685+ Depends on vulnerable versions of solc
686+ node_modules/@ensdomains/ens
687+ @ensdomains/ensjs <=2.1.0
688+ Depends on vulnerable versions of @ensdomains/ens
689+ node_modules/@ensdomains/ensjs
690+
691+108 vulnerabilities (23 low, 25 moderate, 42 high, 18 critical)
692+
693+To address issues that do not require attention, run:
694+ npm audit fix
695+
696+To address all issues (including breaking changes), run:
697+ npm audit fix --force
package-lock.json+36869−12688

This diff is too big to show here.

vite.config.ts+42−16

This diff is too big to show here.