diff --git a/osv-scanner.toml b/osv-scanner.toml index ff416fceef..6ef432f02a 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -1,23 +1,9 @@ -[[IgnoredVulns]] -id = "GHSA-8qq5-rm4j-mr97" -reason = "tar extraction CVE (symlink/hardlink); lerna requires tar v6 but fix only in v7.5.3+ — forcing v7.5.3 breaks lerna's packDirectory API; our usage is archive PACKING only, not extraction" - -[[IgnoredVulns]] -id = "GHSA-r6q2-hw4h-h46w" -reason = "tar extraction CVE; transitive via lerna and yeoman-generator pinning tar <7.5.4; we only use tar for archive PACKING, not extraction" -[[IgnoredVulns]] -id = "GHSA-34x7-hfp2-rc4v" -reason = "tar extraction CVE (specially crafted archives); transitive via lerna and yeoman-generator requiring tar <7.5.4; our usage is limited to archive PACKING only" [[IgnoredVulns]] id = "GHSA-3ppc-4f35-3m26" reason = "minimatch ReDoS (<10.2.1) via repeated wildcards; transitive via lerna/depcheck/glob/mocha/yeoman-generator; dev-time tooling only with controlled (non-user-supplied) inputs; minimatch 10.x breaks lerna v9 API" -[[IgnoredVulns]] -id = "GHSA-83g3-92jg-28cx" -reason = "tar extraction CVE (specially crafted archives); transitive via lerna and yeoman-generator requiring tar <7.5.4; our usage is limited to archive PACKING only" - [[IgnoredVulns]] id = "GHSA-7r86-cg39-jmmj" reason = "minimatch ReDoS via crafted glob patterns (same class as GHSA-3ppc-4f35-3m26); transitive via lerna/depcheck/nyc/eslint/yeoman-generator/glob/shelljs; dev-time tooling only" @@ -26,14 +12,6 @@ reason = "minimatch ReDoS via crafted glob patterns (same class as GHSA-3ppc-4f3 id = "GHSA-23c5-xmqv-rm74" reason = "minimatch ReDoS via crafted glob patterns (same class as GHSA-3ppc-4f35-3m26); transitive via lerna/depcheck/nyc/eslint/yeoman-generator/glob/shelljs; dev-time tooling with controlled inputs only" -[[IgnoredVulns]] -id = "GHSA-qffp-2rhf-9h96" -reason = "tar hardlink path traversal (crafted archives); transitive via lerna/yeoman-generator requiring tar <7.5.7; our usage is archive PACKING only; forcing tar v7.5.7+ breaks lerna (same constraint as GHSA-8qq5-rm4j-mr97)" - -[[IgnoredVulns]] -id = "GHSA-9ppj-qmqm-q256" -reason = "tar extraction CVE (same risk profile as other tar exclusions); we only use tar for packing; security exception approved" - [[IgnoredVulns]] id = "GHSA-2w8x-224x-785m" reason = "sjcl.ecc invalid-curve attack (ECDH); transitive via @bitgo/abstract-lightning > macaroon > sjcl; macaroon uses only HMAC/hash — no ECC; @bitgo/sjcl fork excludes sjcl.ecc entirely; resolved via root resolutions sjcl->@bitgo/sjcl@1.0.1; no upstream fix (first_patched_version: null)" @@ -54,14 +32,3 @@ reason = "protobufjs DoS via unbounded Any expansion (parseAny recursion); trans id = "GHSA-7c78-jf6q-g5cm" reason = "tmp path traversal via type-confusion in _assertPath (non-string args); transitive via cypress/karma/lerna/nx (dev-time only, never in production); all prefix/postfix/template args are hard-coded string constants — type-confusion vector does not apply" -[[IgnoredVulns]] -id = "GHSA-23hp-3jrh-7fpw" -reason = "tar decompression/parse DoS via unlimited input; transitive via lerna/yeoman-generator/swarm-js requiring tar <7.5.19; fix only in tar 7.5.19+ which breaks lerna packDirectory (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only, not extraction of untrusted archives" - -[[IgnoredVulns]] -id = "GHSA-8x88-c5mf-7j5w" -reason = "tar infinite loop via negative entry size; transitive via lerna/yeoman-generator/swarm-js requiring tar <7.5.18; fix only in tar 7.5.18+ which breaks lerna packDirectory (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only, not extraction" - -[[IgnoredVulns]] -id = "GHSA-v2hh-gcrm-f6hx" -reason = "fast-uri host confusion via literal backslash authority (CVE-2026-16221); fixed in 3.1.4 but that release is held for SafeChain. Pinning 3.1.3 clears GHSA-4c8g-83qw-93j6 / CVE-2026-13676. Re-evaluate on 2026-07-26: bump to 3.1.4 and remove this temporary exclusion (security team guidance, WCI-1125)" diff --git a/package.json b/package.json index 62dc0e5bd3..ea553a03f3 100644 --- a/package.json +++ b/package.json @@ -113,7 +113,10 @@ "**/avalanche/**/ws": "8.18.3", "**/ethers/**/ws": "7.5.10", "**/swarm-js/**/ws": "5.2.4", - "**/swarm-js/**/tar": "6.2.1", + "**/swarm-js/**/tar": "7.5.22", + "**/yeoman-generator/**/tar": "7.5.22", + "**/pacote/**/tar": "7.5.22", + "tar": "7.5.22", "serialize-javascript": "7.0.5", "@grpc/grpc-js": "^1.14.4", "bigint-buffer": "npm:@trufflesuite/bigint-buffer@1.1.10", @@ -128,7 +131,7 @@ "flatted": "3.4.2", "sjcl": "npm:@bitgo/sjcl@1.0.1", "picomatch": ">=2.3.2", - "fast-uri": "3.1.3", + "fast-uri": "3.1.4", "postcss": "8.5.18", "@babel/plugin-transform-modules-systemjs": "7.29.4", "protobufjs": "7.6.4", @@ -200,7 +203,7 @@ "flatted": "3.4.2", "sjcl": "npm:@bitgo/sjcl@1.0.1", "picomatch": ">=2.3.2", - "fast-uri": "3.1.3", + "fast-uri": "3.1.4", "postcss": "8.5.18", "@babel/plugin-transform-modules-systemjs": "7.29.4", "protobufjs": "7.6.4", diff --git a/yarn.lock b/yarn.lock index 3008abfbcc..2febb5d643 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11602,10 +11602,10 @@ fast-text-encoding@^1.0.6: resolved "https://registry.npmjs.org/fast-text-encoding/-/fast-text-encoding-1.0.6.tgz" integrity sha512-VhXlQgj9ioXCqGstD37E/HBeqEGV/qOD/kmbVG8h5xKBYvM1L3lR1Zn4555cQ8GkYbJa8aJSipLPndE1k6zK2w== -fast-uri@3.1.3, fast-uri@^3.0.1: - version "3.1.3" - resolved "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz#f695a40f006aba505631573a0021ddb21194ad11" - integrity sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg== +fast-uri@3.1.4, fast-uri@^3.0.1: + version "3.1.4" + resolved "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz#3b3daf9ce68f41f956df0b505132c0cfce9ec7af" + integrity sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw== fastest-levenshtein@^1.0.12: version "1.0.16" @@ -11990,7 +11990,7 @@ fs-extra@^8.1.0: jsonfile "^4.0.0" universalify "^0.1.0" -fs-minipass@^2.0.0, fs-minipass@^2.1.0: +fs-minipass@^2.1.0: version "2.1.0" resolved "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz" integrity sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg== @@ -15335,7 +15335,7 @@ minipass@^7.0.2, minipass@^7.0.3, minipass@^7.0.4, minipass@^7.1.2: resolved "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz" integrity sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw== -minizlib@^2.1.1, minizlib@^2.1.2: +minizlib@^2.1.2: version "2.1.2" resolved "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz" integrity sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg== @@ -15362,7 +15362,7 @@ mkdirp@^0.5.5: dependencies: minimist "^1.2.6" -mkdirp@^1.0.3, mkdirp@^1.0.4: +mkdirp@^1.0.4: version "1.0.4" resolved "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz" integrity sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw== @@ -19820,22 +19820,10 @@ tar-stream@~2.2.0: inherits "^2.0.3" readable-stream "^3.1.1" -tar@6.2.1, tar@^6.1.11, tar@^6.1.2: - version "6.2.1" - resolved "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz" - integrity sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A== - dependencies: - chownr "^2.0.0" - fs-minipass "^2.0.0" - minipass "^5.0.0" - minizlib "^2.1.1" - mkdirp "^1.0.3" - yallist "^4.0.0" - -tar@^7.4.3: - version "7.5.1" - resolved "https://registry.npmjs.org/tar/-/tar-7.5.1.tgz" - integrity sha512-nlGpxf+hv0v7GkWBK2V9spgactGOp0qvfWRxUMjqHyzrt3SgwE48DIv/FhqPHJYLHpgW1opq3nERbz5Anq7n1g== +tar@6.2.1, tar@7.5.22, tar@^6.1.11, tar@^6.1.2, tar@^7.4.3: + version "7.5.22" + resolved "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz#a696f998136e71487dc3f869a85bba2c67971ba9" + integrity sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA== dependencies: "@isaacs/fs-minipass" "^4.0.0" chownr "^3.0.0"