build: update javascript elliptic lib to 6.6.1 #2573
Conversation
WalkthroughThe changes update the version of the "elliptic" package from 6.5.7 to 6.6.1 across the project configuration files. This includes updating the version in the package resolution settings, runtime dependency state, and removing "elliptic" from the npm audit exclusion list. No other dependencies or configurations were modified, and there were no changes to exported or public entities. Changes
Possibly related PRs
Suggested reviewers
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
lklimek
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
package.json (1)
1-106: Suggest documenting the upgrade in the CHANGELOGAdd a CHANGELOG entry under a security or dependencies section to record the update of
ellipticto 6.6.1, referencing the relevant advisory or CVE. This will improve traceability of the security fix.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (3)
.yarn/cache/elliptic-npm-6.6.1-87bb857cbc-dc678c9feb.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/fsevents-patch-19706e7e35-10.zipis excluded by!**/.yarn/**,!**/*.zipyarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (3)
.pnp.cjs(4 hunks).yarnrc.yml(0 hunks)package.json(1 hunks)
💤 Files with no reviewable changes (1)
- .yarnrc.yml
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Build Docker images (Dashmate helper, dashmate-helper, dashmate-helper) / Build Dashmate helper image
- GitHub Check: Build Docker images (DAPI, dapi, dapi) / Build DAPI image
🔇 Additional comments (2)
package.json (1)
74-74:✅ Verification successful
Approve the dependency resolution update
The
ellipticpackage resolution has been bumped to 6.6.1 to address the security issue in earlier versions. Please verify that this version is published and free of known vulnerabilities.Run this script to confirm:
🏁 Script executed:
#!/usr/bin/env bash # Check that [email protected] exists on npm npm view [email protected] version # Audit for any remaining vulnerabilities in elliptic npm audit --json | jq '.advisories | with_entries(select(.value.module_name=="elliptic"))'Length of output: 531
🏁 Script executed:
#!/usr/bin/env bash set -e # Create a temporary project to generate a lockfile for audit temp_dir=$(mktemp -d) cd "$temp_dir" npm init -y > /dev/null # Add [email protected] and generate package-lock.json npm install [email protected] --package-lock-only > /dev/null # Run audit and filter only elliptic advisories npm audit --json | jq '.advisories | with_entries(select(.value.module_name=="elliptic"))'Length of output: 284
Approve the dependency resolution update
- Confirmed
[email protected]is published on npm.npm auditreports no advisories for this version..pnp.cjs (1)
2614-2620:✅ Verification successful
Approve Yarn PnP manifest updates for elliptic version bump
Theellipticdependency has been correctly upgraded to6.6.1in all PnP sections of the manifest. Since this file is auto-generated by Yarn, no manual adjustments are needed beyond runningyarn install.
To be extra cautious, please verify that no references to the old version remain by running:Also applies to: 6818-6824, 8279-8283, 9246-9252
🏁 Script executed:
#!/bin/bash # Search for any remaining references to the old elliptic version rg -n "npm:6\\.5\\.7"Length of output: 21
Approve Yarn PnP manifest updates for elliptic version bump
I ranrg -n 'npm:6\.5\.7'across the entire.pnp.cjsand found no occurrences of the old version. Since this file is auto-generated by Yarn, no manual edits are required beyond runningyarn install.Applies to these sections as well:
- Lines 6818–6824
- Lines 8279–8283
- Lines 9246–9252
2 participants
Issue being fixed or feature implemented
Elliptic older than 6.6.0 was affected by a security issue.
What was done?
Updated Elliptic to 6.6.1 and un-ignored it.
Ran
yarn installto update caches.How Has This Been Tested?
GHA
Breaking Changes
None
Checklist:
For repository code-owners and collaborators only
Summary by CodeRabbit