f6af024..master · bridge

git.iko.soy/bridge

on master help sign in

.gitignore+2

since splitsnapshots

unifiedsplit

@@ -11,6 +11,7 @@

12# misc

13.DS_Store

14+.env

14.env.local

15.env.local

15.env.development.local

16.env.development.local

16.env.test.local

17.env.test.local

@@ -28,3 +29,4 @@ bridge*.tar.gz

28checksums.txt

29checksums.txt

30*.pem

31*.pem

32+localhost+2*

DEVELOPMENT.md+36−10

@@ -80,19 +80,41 @@ of having to re-authenticate whenever you make a change or refresh the page):

81## HTTPS

83−For development, you can enable HTTPS on localhost without a certificate for

83+For development, Bridge will not run unless you access localhost via HTTPS. To do this, you will want to set up a self-signed cert using `mkcert`:

84−Chrome by pasting the following into the URL bar:

85+1. Install `mkcert`:

86```

87−chrome://flags/#allow-insecure-localhost

87+# on MacOS using homebrew

88+brew install mkcert

89+

90+# on Linux using apt # TODO Confirm functionality

91+sudo apt install libnss3-tools

92+wget -O mkcert https://github.com/FiloSottile/mkcert/releases/latest/download/mkcert-v*-linux-amd64

93+chmod +x mkcert

94+sudo mv mkcert /usr/local/bin/

88```

95```

90−In Firefox, you may need to allow connecting to the unsecured local node

97+2. Create certificate authority:

91−websocket. Do this by going to `about:config` and setting the

98+```

92−`network.websocket.allowInsecureFromHTTPS` flag to `true`.

99+# install local cert authority

100+mkcert -install

101+```

102+

103+3. Generate localhost Cert:

104+```

105+# Navigate to your bridge project directory

106+cd /path/to/urbit/bridge

107+

108+# Generate certificate for localhost

109+mkcert localhost 127.0.0.1 ::1

110+```

111

94−Additionally you need to run with the `HTTPS` environment variable set to

112+This creates two files:

95−`true`. Note that `npm run pilot` will handle this automatically.

113+- `localhost+2.pem` (certificate)

114+- `localhost+2-key.pem` (private key)

115+

116+

117+Note: as of 3.3.0, Bridge is deprecating explicit support for Firefox. Privacy focused users are recommended to use Brave Browser.

118

97## WalletConnect

119## WalletConnect

120

@@ -178,14 +200,18 @@ Start a local fake ship from the master branch in the [urbit repo](https://githu

178:: Run these in the dojo:

200:: Run these in the dojo:

179::

201::

180> |mount /=base=

202> |mount /=base=

181−> :azimuth %resub

203+> |nuke %azimuth

204+> |rein %base [%.y %azimuth]

182> :azimuth|watch 'http://0.0.0.0:8545' %local

205> :azimuth|watch 'http://0.0.0.0:8545' %local

206+> :azimuth %resub

183> :azimuth &azimuth-poke [%kick ~]

207> :azimuth &azimuth-poke [%kick ~]

184> |rein %base [& %roller] [& %roller-rpc] [& %azimuth-rpc]

208> |rein %base [& %roller] [& %roller-rpc] [& %azimuth-rpc]

185> :roller|local

209> :roller|local

186> :roller|setkey '58d62eb79797502bc0f66cd3e7a49d00287bff53a2734b799ef09cb746340ed0'

210> :roller|setkey '58d62eb79797502bc0f66cd3e7a49d00287bff53a2734b799ef09cb746340ed0'

187> :roller|quota 9.999

211> :roller|quota 9.999

212+:: If you run into issues, also add 'https://localhost:3000' the the eyre CORS approvals

188−> |cors-approve 'https://127.0.0.1:3000'

213+> |eyre/cors/approve 'https://127.0.0.1:3000'

214+::

189:: Once L2 txs have been sent via Bridge, this will manually commit and batch them, avoiding waiting for the timer

215:: Once L2 txs have been sent via Bridge, this will manually commit and batch them, avoiding waiting for the timer

190::

216::

191> :roller|commit

217> :roller|commit

bridge-npm-audit.txtnew file+697

@@ -0,0 +1,697 @@

1+# npm audit report

3+@babel/helpers <7.26.10

4+Severity: moderate

5+Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8

6+fix available via `npm audit fix`

7+node_modules/@babel/helpers

9+@babel/runtime-corejs3 <7.26.10

10+Severity: moderate

11+Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8

12+fix available via `npm audit fix`

13+node_modules/@babel/runtime-corejs3

14+

15+@babel/traverse <7.23.2

16+Severity: critical

17+Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92

18+fix available via `npm audit fix`

19+node_modules/@babel/traverse

20+

21+ajv <6.12.3

22+Severity: moderate

23+Prototype Pollution in Ajv - https://github.com/advisories/GHSA-v88g-cgmw-v5xw

24+fix available via `npm audit fix --force`

25+Will install serve@14.2.5, which is a breaking change

26+node_modules/serve/node_modules/ajv

27+ serve 5.0.4 - 14.2.4

28+ Depends on vulnerable versions of ajv

29+ Depends on vulnerable versions of boxen

30+ Depends on vulnerable versions of clipboardy

31+ Depends on vulnerable versions of compression

32+ Depends on vulnerable versions of serve-handler

33+ node_modules/serve

34+

35+ansi-regex 3.0.0

36+Severity: high

37+Inefficient Regular Expression Complexity in chalk/ansi-regex - https://github.com/advisories/GHSA-93q8-gq69-wqmw

38+fix available via `npm audit fix`

39+node_modules/ansi-align/node_modules/ansi-regex

40+node_modules/boxen/node_modules/ansi-regex

41+node_modules/widest-line/node_modules/ansi-regex

42+

43+axios 1.0.0 - 1.11.0

44+Severity: high

45+Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx

46+Server-Side Request Forgery in axios - https://github.com/advisories/GHSA-8hc4-vh64-cxmj

47+axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - https://github.com/advisories/GHSA-jr5f-v2jv-69x6

48+Axios is vulnerable to DoS attack through lack of data size check - https://github.com/advisories/GHSA-4hjh-wcwx-xvwj

49+fix available via `npm audit fix --force`

50+Will install truffle@5.5.7, which is a breaking change

51+node_modules/axios

52+ @truffle/dashboard-message-bus-client >=0.1.10

53+ Depends on vulnerable versions of axios

54+ node_modules/@truffle/dashboard-message-bus-client

55+ @truffle/events >=0.1.21

56+ Depends on vulnerable versions of @truffle/dashboard-message-bus-client

57+ node_modules/@truffle/events

58+ @truffle/config *

59+ Depends on vulnerable versions of @truffle/events

60+ Depends on vulnerable versions of @truffle/provider

61+ node_modules/@truffle/config

62+ @truffle/db >=2.0.13

63+ Depends on vulnerable versions of @truffle/config

64+ node_modules/@truffle/db

65+ @truffle/db-loader >=0.2.13

66+ Depends on vulnerable versions of @truffle/db

67+ node_modules/@truffle/db-loader

68+ truffle 5.1.9-nodeLTS.0 || 5.1.14-alphaTez.0 - 5.1.14-truffleLogger.0 || >=5.1.66

69+ Depends on vulnerable versions of @truffle/db

70+ Depends on vulnerable versions of @truffle/db-loader

71+ Depends on vulnerable versions of @truffle/debugger

72+ Depends on vulnerable versions of ganache

73+ Depends on vulnerable versions of mocha

74+ node_modules/truffle

75+

76+babel-traverse *

77+Severity: critical

78+Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92

79+fix available via `npm audit fix --force`

80+Will install azimuth-js@0.15.0, which is a breaking change

81+node_modules/babel-traverse

82+ babel-core 5.8.20 - 7.0.0-beta.3

83+ Depends on vulnerable versions of babel-helpers

84+ Depends on vulnerable versions of babel-register

85+ Depends on vulnerable versions of babel-template

86+ Depends on vulnerable versions of babel-traverse

87+ Depends on vulnerable versions of json5

88+ node_modules/babel-core

89+ babel-register *

90+ Depends on vulnerable versions of babel-core

91+ node_modules/babel-register

92+ azimuth-solidity *

93+ Depends on vulnerable versions of babel-register

94+ node_modules/azimuth-solidity

95+ azimuth-js *

96+ Depends on vulnerable versions of azimuth-solidity

97+ Depends on vulnerable versions of web3

98+ node_modules/azimuth-js

99+ babel-template *

100+ Depends on vulnerable versions of babel-traverse

101+ node_modules/babel-template

102+ babel-helpers *

103+ Depends on vulnerable versions of babel-template

104+ node_modules/babel-helpers

105+

106+base-x <=3.0.10

107+Severity: high

108+Homograph attack allows Unicode lookalike characters to bypass validation. - https://github.com/advisories/GHSA-xq7p-g2vc-g82p

109+fix available via `npm audit fix`

110+node_modules/base-x

111+

112+brace-expansion 1.0.0 - 1.1.11

113+brace-expansion Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw

114+fix available via `npm audit fix`

115+node_modules/brace-expansion

116+node_modules/ganache/node_modules/brace-expansion

117+node_modules/truffle/node_modules/ganache/node_modules/brace-expansion

118+

119+braces <3.0.3

120+Severity: high

121+Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg

122+fix available via `npm audit fix`

123+node_modules/braces

124+node_modules/ganache/node_modules/braces

125+node_modules/truffle/node_modules/ganache/node_modules/braces

126+

127+browserify-sign 2.6.0 - 4.2.1

128+Severity: high

129+browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack - https://github.com/advisories/GHSA-x9w5-v3q2-3rhw

130+fix available via `npm audit fix`

131+node_modules/browserify-sign

132+node_modules/ganache/node_modules/browserify-sign

133+node_modules/truffle/node_modules/ganache/node_modules/browserify-sign

134+

135+cipher-base <=1.0.4

136+Severity: critical

137+cipher-base is missing type checks, leading to hash rewind and passing on crafted data - https://github.com/advisories/GHSA-cpq7-6gpm-g9rc

138+fix available via `npm audit fix`

139+node_modules/cipher-base

140+node_modules/ganache/node_modules/cipher-base

141+node_modules/truffle/node_modules/ganache/node_modules/cipher-base

142+

143+cross-spawn <6.0.6 || >=7.0.0 <7.0.5

144+Severity: high

145+Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275

146+Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275

147+fix available via `npm audit fix --force`

148+Will install serve@14.2.5, which is a breaking change

149+node_modules/clipboardy/node_modules/cross-spawn

150+node_modules/cross-spawn

151+node_modules/eslint/node_modules/cross-spawn

152+node_modules/ganache/node_modules/cross-spawn

153+node_modules/term-size/node_modules/cross-spawn

154+node_modules/truffle/node_modules/ganache/node_modules/cross-spawn

155+ execa 0.5.0 - 0.9.0

156+ Depends on vulnerable versions of cross-spawn

157+ node_modules/clipboardy/node_modules/execa

158+ node_modules/term-size/node_modules/execa

159+ clipboardy <=1.2.3

160+ Depends on vulnerable versions of execa

161+ node_modules/clipboardy

162+ term-size 1.0.0 - 1.2.0

163+ Depends on vulnerable versions of execa

164+ node_modules/term-size

165+ boxen 1.2.0 - 3.2.0

166+ Depends on vulnerable versions of term-size

167+ node_modules/boxen

168+

169+crypto-js <4.2.0

170+Severity: critical

171+crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard - https://github.com/advisories/GHSA-xwcq-pm8m-c4vf

172+fix available via `npm audit fix --force`

173+Will install secure-ls@2.0.0, which is a breaking change

174+node_modules/crypto-js

175+ secure-ls <=1.2.6

176+ Depends on vulnerable versions of crypto-js

177+ node_modules/secure-ls

178+

179+ejs <=3.1.9

180+Severity: critical

181+ejs template injection vulnerability - https://github.com/advisories/GHSA-phwq-j96m-2c2q

182+ejs lacks certain pollution protection - https://github.com/advisories/GHSA-ghr5-ch3p-vcr6

183+fix available via `npm audit fix`

184+node_modules/source-map-explorer/node_modules/ejs

185+

186+elliptic <=6.6.0

187+Severity: critical

188+Elliptic's verify function omits uniqueness validation - https://github.com/advisories/GHSA-434g-2637-qmqr

189+Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) - https://github.com/advisories/GHSA-vjh7-7g9h-fjfh

190+Valid ECDSA signatures erroneously rejected in Elliptic - https://github.com/advisories/GHSA-fc9h-whq2-v747

191+Elliptic's EDDSA missing signature length check - https://github.com/advisories/GHSA-f7q4-pwc6-w24p

192+Elliptic's ECDSA missing check for whether leading bit of r and s is zero - https://github.com/advisories/GHSA-977x-g7h5-7qgw

193+Elliptic allows BER-encoded signatures - https://github.com/advisories/GHSA-49q7-c7j4-3p7m

194+fix available via `npm audit fix --force`

195+Will install truffle@5.5.7, which is a breaking change

196+node_modules/elliptic

197+node_modules/ganache/node_modules/elliptic

198+node_modules/truffle/node_modules/ganache/node_modules/elliptic

199+ ethers 3.0.0 - 4.0.49

200+ Depends on vulnerable versions of elliptic

201+ node_modules/@truffle/interface-adapter/node_modules/ethers

202+ @truffle/interface-adapter *

203+ Depends on vulnerable versions of ethers

204+ Depends on vulnerable versions of web3

205+ node_modules/@truffle/interface-adapter

206+ @truffle/provider *

207+ Depends on vulnerable versions of @truffle/interface-adapter

208+ Depends on vulnerable versions of web3

209+ node_modules/@truffle/provider

210+

211+esbuild <=0.24.2

212+Severity: moderate

213+esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99

214+fix available via `npm audit fix --force`

215+Will install vite@3.2.11, which is outside the stated dependency range

216+node_modules/esbuild

217+ vite <=6.1.6

218+ Depends on vulnerable versions of esbuild

219+ Depends on vulnerable versions of rollup

220+ node_modules/vite

221+

222+fast-redact *

223+fast-redact vulnerable to prototype pollution - https://github.com/advisories/GHSA-ffrw-9mx8-89p8

224+fix available via `npm audit fix`

225+node_modules/fast-redact

226+ pino 5.0.0-rc.1 - 9.11.0

227+ Depends on vulnerable versions of fast-redact

228+ node_modules/pino

229+ @walletconnect/logger <=2.1.3

230+ Depends on vulnerable versions of pino

231+ node_modules/@walletconnect/logger

232+ @walletconnect/core 2.0.0-2.0.0-beta.102 - 2.22.2

233+ Depends on vulnerable versions of @walletconnect/logger

234+ Depends on vulnerable versions of @walletconnect/types

235+ Depends on vulnerable versions of @walletconnect/utils

236+ node_modules/@walletconnect/sign-client/node_modules/@walletconnect/core

237+ @walletconnect/sign-client <=2.22.2

238+ Depends on vulnerable versions of @walletconnect/core

239+ Depends on vulnerable versions of @walletconnect/logger

240+ Depends on vulnerable versions of @walletconnect/types

241+ Depends on vulnerable versions of @walletconnect/utils

242+ node_modules/@walletconnect/sign-client

243+ @walletconnect/types 2.1.2-eaa4818c - 2.22.2

244+ Depends on vulnerable versions of @walletconnect/logger

245+ node_modules/@walletconnect/types

246+ @walletconnect/utils 2.1.2-eaa4818c - 2.22.2

247+ Depends on vulnerable versions of @walletconnect/types

248+ node_modules/@walletconnect/sign-client/node_modules/@walletconnect/utils

249+

250+form-data <2.5.4

251+Severity: critical

252+form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4

253+fix available via `npm audit fix`

254+node_modules/form-data

255+ request *

256+ Depends on vulnerable versions of form-data

257+ Depends on vulnerable versions of tough-cookie

258+ node_modules/request

259+ jsdom 0.1.20 || 0.2.0 - 16.5.3

260+ Depends on vulnerable versions of request

261+ Depends on vulnerable versions of tough-cookie

262+ node_modules/jsdom

263+ servify *

264+ Depends on vulnerable versions of request

265+ node_modules/servify

266+ eth-lib <=0.1.29

267+ Depends on vulnerable versions of servify

268+ Depends on vulnerable versions of ws

269+ node_modules/eth-lib

270+ swarm-js >=0.1.36

271+ Depends on vulnerable versions of eth-lib

272+ Depends on vulnerable versions of tar

273+ node_modules/swarm-js

274+ web3-bzz *

275+ Depends on vulnerable versions of swarm-js

276+ node_modules/@truffle/debugger/node_modules/web3-bzz

277+ node_modules/@truffle/interface-adapter/node_modules/web3-bzz

278+ node_modules/@truffle/provider/node_modules/web3-bzz

279+ node_modules/web3-bzz

280+

281+get-func-name <2.0.1

282+Severity: high

283+Chaijs/get-func-name vulnerable to ReDoS - https://github.com/advisories/GHSA-4q6p-r6v2-jvc5

284+fix available via `npm audit fix`

285+node_modules/get-func-name

286+

287+js-yaml <3.14.2 || >=4.0.0 <4.1.1

288+Severity: moderate

289+js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m

290+js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m

291+fix available via `npm audit fix --force`

292+Will install truffle@5.5.7, which is a breaking change

293+node_modules/@eslint/eslintrc/node_modules/js-yaml

294+node_modules/eslint/node_modules/js-yaml

295+node_modules/ganache/node_modules/js-yaml

296+node_modules/js-yaml

297+node_modules/mocha/node_modules/js-yaml

298+node_modules/truffle/node_modules/ganache/node_modules/js-yaml

299+ mocha 5.1.0 - 10.5.2

300+ Depends on vulnerable versions of js-yaml

301+ Depends on vulnerable versions of minimatch

302+ Depends on vulnerable versions of nanoid

303+ Depends on vulnerable versions of serialize-javascript

304+ node_modules/ganache/node_modules/mocha

305+ node_modules/mocha

306+ node_modules/truffle/node_modules/ganache/node_modules/mocha

307+

308+json-schema <0.4.0

309+Severity: critical

310+json-schema is vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-896r-f27r-55mw

311+fix available via `npm audit fix`

312+node_modules/json-schema

313+ jsprim 0.3.0 - 1.4.1 || 2.0.0 - 2.0.1

314+ Depends on vulnerable versions of json-schema

315+ node_modules/jsprim

316+

317+json5 <1.0.2 || >=2.0.0 <2.2.2

318+Severity: high

319+Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h

320+Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h

321+fix available via `npm audit fix --force`

322+Will install azimuth-js@0.15.0, which is a breaking change

323+node_modules/@babel/core/node_modules/json5

324+node_modules/ganache/node_modules/json5

325+node_modules/json5

326+node_modules/truffle/node_modules/ganache/node_modules/json5

327+node_modules/vite-plugin-comlink/node_modules/json5

328+ vite-plugin-comlink 3.0.3 - 3.0.5

329+ Depends on vulnerable versions of json5

330+ node_modules/vite-plugin-comlink

331+

332+jszip <3.8.0

333+Severity: moderate

334+JSZip contains Path Traversal via loadAsync - https://github.com/advisories/GHSA-36fh-84j7-cv5h

335+fix available via `npm audit fix`

336+node_modules/jszip

337+

338+markdown-to-jsx <7.4.0

339+Severity: moderate

340+Cross site scripting in markdown-to-jsx - https://github.com/advisories/GHSA-4wx3-54gh-9fr9

341+fix available via `npm audit fix`

342+node_modules/markdown-to-jsx

343+

344+micromatch <4.0.8

345+Severity: moderate

346+Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv

347+fix available via `npm audit fix`

348+node_modules/ganache/node_modules/micromatch

349+node_modules/micromatch

350+node_modules/truffle/node_modules/ganache/node_modules/micromatch

351+

352+minimatch <3.0.5

353+Severity: high

354+minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3

355+fix available via `npm audit fix --force`

356+Will install truffle@5.5.7, which is a breaking change

357+node_modules/ganache/node_modules/minimatch

358+node_modules/minimatch

359+node_modules/truffle/node_modules/ganache/node_modules/minimatch

360+ serve-handler <=6.1.5

361+ Depends on vulnerable versions of minimatch

362+ Depends on vulnerable versions of path-to-regexp

363+ node_modules/serve-handler

364+

365+nanoid <=3.3.7

366+Severity: moderate

367+Predictable results in nanoid generation when given non-integer values - https://github.com/advisories/GHSA-mwcw-c2x4-8c55

368+Exposure of Sensitive Information to an Unauthorized Actor in nanoid - https://github.com/advisories/GHSA-qrpm-p2h7-hrv2

369+fix available via `npm audit fix --force`

370+Will install truffle@5.5.7, which is a breaking change

371+node_modules/ganache/node_modules/nanoid

372+node_modules/nanoid

373+node_modules/truffle/node_modules/ganache/node_modules/nanoid

374+node_modules/vite/node_modules/nanoid

375+

376+on-headers <1.1.0

377+on-headers is vulnerable to http response header manipulation - https://github.com/advisories/GHSA-76c9-3jph-rj3q

378+fix available via `npm audit fix --force`

379+Will install serve@14.2.5, which is a breaking change

380+node_modules/on-headers

381+ compression 1.0.3 - 1.8.0

382+ Depends on vulnerable versions of on-headers

383+ node_modules/serve/node_modules/compression

384+

385+path-to-regexp 2.0.0 - 3.2.0

386+Severity: high

387+path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j

388+fix available via `npm audit fix --force`

389+Will install serve@14.2.5, which is a breaking change

390+node_modules/serve-handler/node_modules/path-to-regexp

391+

392+pbkdf2 <=3.1.2

393+Severity: critical

394+pbkdf2 silently disregards Uint8Array input, returning static keys - https://github.com/advisories/GHSA-v62p-rq8g-8h59

395+pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos - https://github.com/advisories/GHSA-h7cp-r72f-jxh6

396+fix available via `npm audit fix`

397+node_modules/ganache/node_modules/pbkdf2

398+node_modules/pbkdf2

399+node_modules/truffle/node_modules/ganache/node_modules/pbkdf2

400+

401+postcss <8.4.31

402+Severity: moderate

403+PostCSS line return parsing error - https://github.com/advisories/GHSA-7fh5-64p2-3v2j

404+fix available via `npm audit fix`

405+node_modules/vite/node_modules/postcss

406+

407+qs 6.5.0 - 6.5.2

408+Severity: high

409+qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp

410+fix available via `npm audit fix`

411+node_modules/request/node_modules/qs

412+

413+

414+rollup <2.79.2

415+Severity: high

416+DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - https://github.com/advisories/GHSA-gcx4-mw62-g8wm

417+fix available via `npm audit fix --force`

418+Will install vite@3.2.11, which is outside the stated dependency range

419+node_modules/vite/node_modules/rollup

420+

421+secp256k1 <=3.8.0 || 4.0.0 - 4.0.3

422+Severity: high

423+secp256k1-node allows private key extraction over ECDH - https://github.com/advisories/GHSA-584q-6j8j-r5pm

424+secp256k1-node allows private key extraction over ECDH - https://github.com/advisories/GHSA-584q-6j8j-r5pm

425+fix available via `npm audit fix --force`

426+Will install ganache@6.4.5, which is a breaking change

427+node_modules/ganache/node_modules/secp256k1

428+node_modules/secp256k1

429+node_modules/truffle/node_modules/ganache/node_modules/secp256k1

430+node_modules/urbit-key-generation/node_modules/secp256k1

431+ ganache <=3.0.0-internal.16 || >=7.0.0-alpha.0

432+ Depends on vulnerable versions of @trufflesuite/uws-js-unofficial

433+ Depends on vulnerable versions of secp256k1

434+ node_modules/ganache

435+ node_modules/truffle/node_modules/ganache

436+ keythereum 1.2.0

437+ Depends on vulnerable versions of secp256k1

438+ node_modules/keythereum

439+

440+semver <=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1

441+Severity: high

442+semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

443+semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

444+semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

445+fix available via `npm audit fix`

446+node_modules/@babel/core/node_modules/semver

447+node_modules/cross-spawn/node_modules/semver

448+node_modules/ganache/node_modules/semver

449+node_modules/normalize-package-data/node_modules/semver

450+node_modules/truffle/node_modules/ganache/node_modules/semver

451+ @microsoft/api-extractor 7.9.1 - 7.36.2

452+ Depends on vulnerable versions of @microsoft/api-extractor-model

453+ Depends on vulnerable versions of @rushstack/node-core-library

454+ Depends on vulnerable versions of semver

455+ node_modules/ganache/node_modules/@microsoft/api-extractor

456+ node_modules/truffle/node_modules/ganache/node_modules/@microsoft/api-extractor

457+ @rushstack/node-core-library 3.25.0 - 3.59.5

458+ Depends on vulnerable versions of semver

459+ node_modules/ganache/node_modules/@rushstack/node-core-library

460+ node_modules/truffle/node_modules/ganache/node_modules/@rushstack/node-core-library

461+ @microsoft/api-extractor-model 7.8.12 - 7.27.4

462+ Depends on vulnerable versions of @rushstack/node-core-library

463+ node_modules/ganache/node_modules/@microsoft/api-extractor-model

464+ node_modules/truffle/node_modules/ganache/node_modules/@microsoft/api-extractor-model

465+

466+serialize-javascript 6.0.0 - 6.0.1

467+Severity: moderate

468+Cross-site Scripting (XSS) in serialize-javascript - https://github.com/advisories/GHSA-76p7-773f-r4q5

469+fix available via `npm audit fix --force`

470+Will install truffle@5.5.7, which is a breaking change

471+node_modules/ganache/node_modules/serialize-javascript

472+node_modules/serialize-javascript

473+node_modules/truffle/node_modules/ganache/node_modules/serialize-javascript

474+

475+sha.js <=2.4.11

476+Severity: critical

477+sha.js is missing type checks leading to hash rewind and passing on crafted data - https://github.com/advisories/GHSA-95m3-7q98-8xr5

478+fix available via `npm audit fix`

479+node_modules/ganache/node_modules/sha.js

480+node_modules/sha.js

481+node_modules/truffle/node_modules/ganache/node_modules/sha.js

482+

483+shell-quote 1.6.3 - 1.7.2

484+Severity: critical

485+Improper Neutralization of Special Elements used in a Command in Shell-quote - https://github.com/advisories/GHSA-g4rg-993r-mgx7

486+fix available via `npm audit fix`

487+node_modules/shell-quote

488+

489+tar <6.2.1

490+Severity: moderate

491+Denial of service while parsing a tar file due to lack of folders count validation - https://github.com/advisories/GHSA-f5x3-32g6-xq36

492+fix available via `npm audit fix`

493+node_modules/tar

494+

495+tiny-secp256k1 <=1.1.6

496+Severity: high

497+tiny-secp256k1 allows for verify() bypass when running in bundled environment - https://github.com/advisories/GHSA-5vhg-9xg4-cv9m

498+tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment - https://github.com/advisories/GHSA-7mc2-6phr-23xc

499+fix available via `npm audit fix`

500+node_modules/tiny-secp256k1

501+

502+tough-cookie <4.1.3

503+Severity: moderate

504+tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3

505+fix available via `npm audit fix`

506+node_modules/tough-cookie

507+

508+validator <13.15.20

509+Severity: moderate

510+validator.js has a URL validation bypass vulnerability in its isURL function - https://github.com/advisories/GHSA-9965-vmph-33xx

511+fix available via `npm audit fix`

512+node_modules/ganache/node_modules/validator

513+node_modules/truffle/node_modules/ganache/node_modules/validator

514+

515+

516+web3-core-method <=2.0.0-alpha.1

517+web3-core-method is vulnerable to prototype pollution - https://github.com/advisories/GHSA-2j4c-9qqq-896r

518+Depends on vulnerable versions of web3-core-subscriptions

519+fix available via `npm audit fix --force`

520+Will install web3-core@4.7.1, which is a breaking change

521+node_modules/@truffle/debugger/node_modules/web3-core-method

522+node_modules/@truffle/interface-adapter/node_modules/web3-core-method

523+node_modules/@truffle/provider/node_modules/web3-core-method

524+node_modules/web3-core-method

525+ web3-core <=2.0.0-alpha.1

526+ Depends on vulnerable versions of web3-core-method

527+ Depends on vulnerable versions of web3-core-method

528+ node_modules/@truffle/debugger/node_modules/web3-core

529+ node_modules/@truffle/interface-adapter/node_modules/web3-core

530+ node_modules/@truffle/provider/node_modules/web3-core

531+ node_modules/web3-core

532+ web3-eth-ens <=2.0.0-alpha.1

533+ Depends on vulnerable versions of web3-core

534+ Depends on vulnerable versions of web3-core

535+ Depends on vulnerable versions of web3-eth-contract

536+ Depends on vulnerable versions of web3-eth-contract

537+ node_modules/@truffle/debugger/node_modules/web3-eth-ens

538+ node_modules/@truffle/interface-adapter/node_modules/web3-eth-ens

539+ node_modules/@truffle/provider/node_modules/web3-eth-ens

540+ node_modules/web3-eth-ens

541+ web3-eth-personal <=2.0.0-alpha.1 || 4.0.9-dev.408125.0

542+ Depends on vulnerable versions of web3-core

543+ Depends on vulnerable versions of web3-core

544+ Depends on vulnerable versions of web3-core-method

545+ Depends on vulnerable versions of web3-core-method

546+ Depends on vulnerable versions of web3-net

547+ Depends on vulnerable versions of web3-net

548+ node_modules/@truffle/debugger/node_modules/web3-eth-personal

549+ node_modules/@truffle/interface-adapter/node_modules/web3-eth-personal

550+ node_modules/@truffle/provider/node_modules/web3-eth-personal

551+ node_modules/web3-eth-personal

552+ web3-net 1.2.0 - 2.0.0-alpha.1 || 4.0.8-dev.408125.0

553+ Depends on vulnerable versions of web3-core

554+ Depends on vulnerable versions of web3-core

555+ Depends on vulnerable versions of web3-core-method

556+ Depends on vulnerable versions of web3-core-method

557+ node_modules/@truffle/debugger/node_modules/web3-net

558+ node_modules/@truffle/interface-adapter/node_modules/web3-net

559+ node_modules/@truffle/provider/node_modules/web3-net

560+ node_modules/web3-net

561+ web3 1.0.0-beta.1 - 3.0.0-rc.0

562+ Depends on vulnerable versions of web3-bzz

563+ Depends on vulnerable versions of web3-core

564+ Depends on vulnerable versions of web3-core

565+ Depends on vulnerable versions of web3-eth

566+ Depends on vulnerable versions of web3-eth

567+ Depends on vulnerable versions of web3-eth-personal

568+ Depends on vulnerable versions of web3-eth-personal

569+ Depends on vulnerable versions of web3-net

570+ Depends on vulnerable versions of web3-net

571+ Depends on vulnerable versions of web3-shh

572+ Depends on vulnerable versions of web3-shh

573+ node_modules/@truffle/debugger/node_modules/web3

574+ node_modules/@truffle/interface-adapter/node_modules/web3

575+ node_modules/@truffle/provider/node_modules/web3

576+ node_modules/web3

577+ @truffle/debugger *

578+ Depends on vulnerable versions of @ensdomains/ensjs

579+ Depends on vulnerable versions of web3

580+ node_modules/@truffle/debugger

581+ web3-eth <=2.0.0-alpha.1

582+ Depends on vulnerable versions of web3-core

583+ Depends on vulnerable versions of web3-core

584+ Depends on vulnerable versions of web3-core-method

585+ Depends on vulnerable versions of web3-core-method

586+ Depends on vulnerable versions of web3-core-subscriptions

587+ Depends on vulnerable versions of web3-eth-accounts

588+ Depends on vulnerable versions of web3-eth-accounts

589+ Depends on vulnerable versions of web3-eth-contract

590+ Depends on vulnerable versions of web3-eth-contract

591+ Depends on vulnerable versions of web3-eth-ens

592+ Depends on vulnerable versions of web3-eth-ens

593+ Depends on vulnerable versions of web3-eth-personal

594+ Depends on vulnerable versions of web3-eth-personal

595+ Depends on vulnerable versions of web3-net

596+ Depends on vulnerable versions of web3-net

597+ node_modules/@truffle/debugger/node_modules/web3-eth

598+ node_modules/@truffle/interface-adapter/node_modules/web3-eth

599+ node_modules/@truffle/provider/node_modules/web3-eth

600+ node_modules/web3-eth

601+ web3-shh *

602+ Depends on vulnerable versions of web3-core

603+ Depends on vulnerable versions of web3-core

604+ Depends on vulnerable versions of web3-core-method

605+ Depends on vulnerable versions of web3-core-method

606+ Depends on vulnerable versions of web3-core-subscriptions

607+ Depends on vulnerable versions of web3-net

608+ Depends on vulnerable versions of web3-net

609+ node_modules/@truffle/debugger/node_modules/web3-shh

610+ node_modules/@truffle/interface-adapter/node_modules/web3-shh

611+ node_modules/@truffle/provider/node_modules/web3-shh

612+ node_modules/web3-shh

613+ web3-eth-accounts <=2.0.0-alpha.1

614+ Depends on vulnerable versions of web3-core

615+ Depends on vulnerable versions of web3-core

616+ Depends on vulnerable versions of web3-core-method

617+ Depends on vulnerable versions of web3-core-method

618+ node_modules/@truffle/debugger/node_modules/web3-eth-accounts

619+ node_modules/@truffle/interface-adapter/node_modules/web3-eth-accounts

620+ node_modules/@truffle/provider/node_modules/web3-eth-accounts

621+ node_modules/web3-eth-accounts

622+ web3-eth-contract <=2.0.0-alpha.1

623+ Depends on vulnerable versions of web3-core

624+ Depends on vulnerable versions of web3-core

625+ Depends on vulnerable versions of web3-core-method

626+ Depends on vulnerable versions of web3-core-method

627+ Depends on vulnerable versions of web3-core-subscriptions

628+ node_modules/@truffle/debugger/node_modules/web3-eth-contract

629+ node_modules/@truffle/interface-adapter/node_modules/web3-eth-contract

630+ node_modules/@truffle/provider/node_modules/web3-eth-contract

631+ node_modules/web3-eth-contract

632+

633+web3-core-subscriptions <=2.0.0-alpha.1

634+web3-core-subscriptions has a Prototype Pollution vulnerability - https://github.com/advisories/GHSA-hhf6-3xpg-pggx

635+fix available via `npm audit fix --force`

636+Will install web3-core@4.7.1, which is a breaking change

637+node_modules/@truffle/debugger/node_modules/web3-core-subscriptions

638+node_modules/@truffle/interface-adapter/node_modules/web3-core-subscriptions

639+node_modules/@truffle/provider/node_modules/web3-core-subscriptions

640+node_modules/web3-core-subscriptions

641+

642+webpack 5.0.0-alpha.0 - 5.93.0

643+Severity: critical

644+Cross-realm object access in Webpack 5 - https://github.com/advisories/GHSA-hc6q-2mpp-qw7j

645+Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - https://github.com/advisories/GHSA-4vvj-4cpr-p986

646+fix available via `npm audit fix`

647+node_modules/ganache/node_modules/webpack

648+node_modules/truffle/node_modules/ganache/node_modules/webpack

649+

650+word-wrap <1.2.4

651+Severity: moderate

652+word-wrap vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-j8xg-fqg3-53r7

653+fix available via `npm audit fix`

654+node_modules/word-wrap

655+

656+ws 2.1.0 - 5.2.3 || 7.0.0 - 7.5.9 || 8.0.0 - 8.17.0

657+Severity: high

658+ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q

659+ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q

660+ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q

661+fix available via `npm audit fix --force`

662+Will install ganache@6.4.5, which is a breaking change

663+node_modules/eth-lib/node_modules/ws

664+node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/ws

665+node_modules/truffle/node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/ws

666+node_modules/ws

667+ @trufflesuite/uws-js-unofficial *

668+ Depends on vulnerable versions of ws

669+ node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial

670+ node_modules/truffle/node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial

671+

672+yargs-parser <=5.0.0

673+Severity: moderate

674+yargs-parser Vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-p9pc-299p-vxgp

675+fix available via `npm audit fix --force`

676+Will install truffle@5.5.7, which is a breaking change

677+node_modules/solc/node_modules/yargs-parser

678+ yargs 4.0.0-alpha1 - 7.0.0-alpha.3 || 7.1.1

679+ Depends on vulnerable versions of yargs-parser

680+ node_modules/solc/node_modules/yargs

681+ solc 0.3.6 - 0.4.26

682+ Depends on vulnerable versions of yargs

683+ node_modules/solc

684+ @ensdomains/ens *

685+ Depends on vulnerable versions of solc

686+ node_modules/@ensdomains/ens

687+ @ensdomains/ensjs <=2.1.0

688+ Depends on vulnerable versions of @ensdomains/ens

689+ node_modules/@ensdomains/ensjs

690+

691+108 vulnerabilities (23 low, 25 moderate, 42 high, 18 critical)

692+

693+To address issues that do not require attention, run:

694+ npm audit fix

695+

696+To address all issues (including breaking changes), run:

697+ npm audit fix --force

legal/privacy policy.md+11−11

@@ -1,7 +1,7 @@

2−Effective date: June 01, 2018

2+Effective date: December 11, 2025

4−Tlon Corporation ("us", "we", or "our") operates the website and the Urbit mobile application (the "Service").

4+The Urbit Foundation in cooperation with Tlon Corporation, ("us", "we", or "our") operate the bridge.urbit.org website (the "Service").

6This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

@@ -11,7 +11,7 @@ We use your data to provide and improve the Service. By using the Service, you a

12**Service**

14−Service means the website and the Urbit mobile application operated by Tlon Corporation

14+Service means the bridge.urbit.org website.

16**Personal Data**

@@ -81,7 +81,7 @@ Security Cookies. We use Security Cookies for security purposes.

82**Use of Data**

84−Tlon Corporation uses the collected data for various purposes:

84+We use the collected data for various purposes:

86- To provide and maintain our Service

@@ -99,13 +99,13 @@ Tlon Corporation uses the collected data for various purposes:

100- Legal Basis for Processing Personal Data Under General Data Protection Regulation (GDPR)

101

102−If you are from the European Economic Area (EEA), Tlon Corporation legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it.

102+If you are from the European Economic Area (EEA), our legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it.

103

104−**Tlon Corporation may process your Personal Data because:**

104+**Tlon Corporation and The Urbit Foundation may process your Personal Data because:**

105

106- We need to perform a contract with you

107

108−- You have given us permission to do so

108+- You have given us permission to do so as a part of using The Service,

109

110- The processing is in our legitimate interests and it's not overridden by your rights

111

@@ -113,9 +113,9 @@ If you are from the European Economic Area (EEA), Tlon Corporation legal basis f

113

114- Retention of Data

115

116−Tlon Corporation will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

116+We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

117

118−Tlon Corporation will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.

118+We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.

119

120**Transfer of Data**

121

@@ -131,7 +131,7 @@ Tlon Corporation will take all steps reasonably necessary to ensure that your da

131

132Legal Requirements

133

134−Tlon Corporation may disclose your Personal Data in the good faith belief that such action is necessary to:

134+We may disclose your Personal Data in the good faith belief that such action is necessary to:

135

136- To comply with a legal obligation

137

@@ -207,4 +207,4 @@ You are advised to review this Privacy Policy periodically for any changes. Chan

207

208If you have any questions about this Privacy Policy, please contact us:

209

210−By email: support@urbit.org

210+By email: support@urbit.org & support@tlon.io

notes.mdnew file+1

@@ -0,0 +1 @@

1+WIP notes

package-lock.json+36869−12688