fix(security): isolate unused deps, patch runtime CVEs, drop Slither - #267
Merged
Conversation
Remove ocf from the pnpm workspace (keep the submodule for JSON schemas), drop unused solc/date-fns, and upgrade mongoose 9.9.3, uuid 14, and Next 16.3.2 for both app and docs (Nextra 4 App Router). Pin patched transitives via pnpm.overrides. Replace Slither with Aderyn plus Foundry invariants, scan npm once weekly from the root lockfile, and run Foundry tests in CI.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Clear the GitHub security tab so we can deploy the API + Mongo stack. This PR does the approved work in one change so Dependabot sees a single cleaned lockfile.
ocf/is no longer a pnpm workspace (submodule stays for JSON schemas). Drop unusedsolcanddate-fns. Delete Slither (config, CI SARIF job,make slither, docs).mongoose9.9.3 (Mongo 8 compatible),uuid14.0.2 (moved to production deps),next16.3.2 on both app and docs. Docs migrate Nextra 3 Pages Router → Nextra 4 App Router. Express stays on 4.x.pnpm.overrides(ws, nanoid, fast-uri, brace-expansion, ajv, qs, etc.). Previous overrides that pinned known-bad@xmldom/xmldom@0.9.9andsocket.io-parser@4.2.6are gone./(the/appextra scan was a no-op). Ignore Express majors. Parallel Foundry job in CI. GitHub Actions were already on latest (checkout/setup-nodev6,cachev5,pnpm/action-setupv6)..github/folders are not added — GitHub only reads the root. Package-specific notes live inSECURITY.md/WARP.md.Why?
Security tab had ~147 Dependabot alerts (3 critical / 56 high) plus 3 low Slither SARIF findings. Most criticals (
parse-url,handlebars,websocket-driver) came from OCF's unused docs/jest tree. Remaining highs were real: mongoose 7, uuid 9, Next 15/16.2.10, plus transitives on the server/app path.Local
pnpm auditafter this lockfile: 0 critical, 0 high. Leftover: moderateuuid@8/uuid@9pulled by ethers/wagmi (forcing 11+ would break CJS require), plus low@babel/core.Testing
pnpm install— workspace is 4 packages (root, app, docs,@tap/units); ocf is not installed.mongo:latest/ 8.2.x): 8 issuers, 1 factory;Issuer.findOne()returned TAP issuere151551c-….uuidv4 ESM import works on Node 24.pnpm test:units— 10/10.pnpm --filter tap-app test:nav— 33/33.pnpm --filter tap-app build— Next 16.3.2, all/app/*routes.pnpm --filter tap-docs build— 37 static pages + Pagefind index.:3001:/,/development,/security,/protocol,/api-reference,/features,/tests,/development/setup,/protocol/tap-ocfall 200; unknown path 404. Security page no longer mentions Slither.pnpm --filter tap-app lintandpnpm --filter tap-docs lintclean.After merge (manual):
main; remaining uuid 8/9 moderates can be ignored as transitive wallet-stack CJS.