Fix vulnerabilities, updated dependencies

.github/workflows/shai-hulud-security-scan.yml

@@ -0,0 +1,72 @@
+name: Shai-Hulud Security Scan
+
+on:
+  push:
+    branches:
+      - '*'              # every branch
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write   # needed for commenting
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Shai-Hulud 2.0 Detector
+        id: shai
+        uses: gensecaihq/Shai-Hulud-2.0-Detector@v1
+        with:
+          scan-lockfiles: true
+          fail-on-critical: true
+          fail-on-high: true
+
+      - name: Comment PR if vulnerable
+        if: failure() && github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: [
+                '## :warning: Shai-Hulud Supply Chain Blocked',
+                '',
+                'This PR introduces compromised npm dependencies.',
+                '',
+                '**Remove or update affected packages before merging.**'
+              ].join('\n')
+            })
+
+      - name: Notify Slack Channel on Failure
+        if: failure()
+        uses: slackapi/slack-github-action@v2.1.1
+        with:
+          errors: true
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          method: chat.postMessage
+          payload: |
+            "channel": "#github-security-scan-issue",
+            "text": "${{ github.repository }} had a change!",
+            "blocks": [
+              {
+                "type": "section",
+                "text": {
+                  "type": "mrkdwn",
+                  "text": ":siren1: Shai Hulud security scan issue found in <https://github.com/${{ github.repository }}|*${{ github.repository }}*>:siren1:"
+                }
+              },
+              {
+                "type": "section",
+                "text": {
+                  "type": "mrkdwn",
+                  "text": "Please check urgently."
+                }
+              }
+            ]

package.json

@@ -15,16 +15,16 @@
   "dependencies": {
     "@openzeppelin/contracts": "4.6.0",
     "@openzeppelin/contracts-upgradeable": "4.6.0",
-    "@truffle/hdwallet-provider": "^1.2.6",
+    "@truffle/hdwallet-provider": "^2.1.15",
     "bignumber.js": "^9.0.2",
     "eth-gas-reporter": "^0.2.24",
     "ethereumjs-util": "^7.1.3",
     "rlp": "^2.2.6",
-    "solidity-coverage": "^0.7.18",
-    "truffle": "^5.4.32",
+    "solidity-coverage": "^0.8.0",
+    "truffle": "^5.6.0",
     "web3": "^4.0.3",
-    "web3-eth-abi": "^1.7.1",
-    "web3-utils": "^1.7.0"
+    "web3-eth-abi": "^1.10.1",
+    "web3-utils": "^1.10.1"
   },
   "devDependencies": {
     "eth-sig-util": "^3.0.1",