Addressing identified security vulnerabilities (y18n, elliptic, node-notifier, ini, node-fetch)

.eslintrc

@@ -5,6 +5,9 @@
     "semi": ["error", "always"],
     "indent": ["error", 4]
   },
+  "parserOptions": {
+    "requireConfigFile": false
+  },
   "overrides": [
     {
       "files": ["**/*.ts", "**/*.tsx"],

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
         with:
           token: ${{ github.token }}
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@1c5c1375b3817ad821719597effe8e3d6f764930
+        uses: actions/setup-node@c6fd00ceb9747fb23ffdf72987450a2664414867
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: 'https://registry.npmjs.org'
@@ -55,7 +55,7 @@ jobs:
         run: |
           yarn build-web
       - name: Test Web
-        uses: cypress-io/github-action@8aac1d019734a107e4eaaefe2e26beb3149e5540
+        uses: cypress-io/github-action@6e9b583c9652e99b72b042a3957980fc6166efae
         with:
           spec: cypress/integration/index.spec.js
       - name: Get Protected Status

.github/workflows/publish-edge.yml

@@ -8,24 +8,17 @@ jobs:
   publish-edge:
     name: Publish Edge
     runs-on: ubuntu-18.04
+    strategy:
+      matrix:
+        node-version: [12.14.1]
     steps:
       - name: Checkout
         uses: actions/checkout@f90c7b395dac7c5a277c1a6d93d5057c1cddb74e
-      - name: Setup Node.js
-        uses: actions/setup-node@1c5c1375b3817ad821719597effe8e3d6f764930
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@c6fd00ceb9747fb23ffdf72987450a2664414867
         with:
-          node-version: '12.14.1'
+          node-version: ${{ matrix.node-version }}
           registry-url: 'https://registry.npmjs.org'
-      - name: Get yarn cache directory path
-        id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(yarn cache dir)"
-      - uses: actions/cache@70655ec8323daeeaa7ef06d7c56e1b9191396cbe
-        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-        with:
-          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
       - name: Install
         run: |
           yarn --frozen-lockfile
@@ -42,7 +35,7 @@ jobs:
         run: |
           yarn build-web
       - name: Test Web
-        uses: cypress-io/github-action@8aac1d019734a107e4eaaefe2e26beb3149e5540
+        uses: cypress-io/github-action@6e9b583c9652e99b72b042a3957980fc6166efae
         with:
           spec: cypress/integration/index.spec.js
       - name: Publish Edge

.github/workflows/publish-release.yml

@@ -8,24 +8,17 @@ jobs:
     if: "!github.event.release.prerelease"
     name: Publish Release
     runs-on: ubuntu-18.04
+    strategy:
+      matrix:
+        node-version: [12.14.1]
     steps:
       - name: Checkout
         uses: actions/checkout@f90c7b395dac7c5a277c1a6d93d5057c1cddb74e
-      - name: Setup Node.js
-        uses: actions/setup-node@1c5c1375b3817ad821719597effe8e3d6f764930
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@c6fd00ceb9747fb23ffdf72987450a2664414867
         with:
-          node-version: '12.14.1'
+          node-version: ${{ matrix.node-version }}
           registry-url: 'https://registry.npmjs.org'
-      - name: Get yarn cache directory path
-        id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(yarn cache dir)"
-      - uses: actions/cache@70655ec8323daeeaa7ef06d7c56e1b9191396cbe
-        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-        with:
-          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
       - name: Install
         run: |
           yarn --frozen-lockfile
@@ -42,7 +35,7 @@ jobs:
         run: |
           yarn build-web
       - name: Test Web
-        uses: cypress-io/github-action@8aac1d019734a107e4eaaefe2e26beb3149e5540
+        uses: cypress-io/github-action@6e9b583c9652e99b72b042a3957980fc6166efae
         with:
           spec: cypress/integration/index.spec.js
       - name: Publish Release
@@ -68,24 +61,17 @@ jobs:
     if: "github.event.release.prerelease"
     name: Publish RC
     runs-on: ubuntu-16.04
+    strategy:
+      matrix:
+        node-version: [12.14.1]
     steps:
       - name: Checkout
         uses: actions/checkout@f90c7b395dac7c5a277c1a6d93d5057c1cddb74e
-      - name: Setup Node.js
-        uses: actions/setup-node@1c5c1375b3817ad821719597effe8e3d6f764930
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@c6fd00ceb9747fb23ffdf72987450a2664414867
         with:
-          node-version: '12.14.1'
+          node-version: ${{ matrix.node-version }}
           registry-url: 'https://registry.npmjs.org'
-      - name: Get yarn cache directory path
-        id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(yarn cache dir)"
-      - uses: actions/cache@70655ec8323daeeaa7ef06d7c56e1b9191396cbe
-        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-        with:
-          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
       - name: Install
         run: |
           yarn --frozen-lockfile
@@ -102,7 +88,7 @@ jobs:
         run: |
           yarn build-web
       - name: Test Web
-        uses: cypress-io/github-action@8aac1d019734a107e4eaaefe2e26beb3149e5540
+        uses: cypress-io/github-action@6e9b583c9652e99b72b042a3957980fc6166efae
         with:
           spec: cypress/integration/index.spec.js
       - name: Publish RC

package.json

@@ -26,29 +26,29 @@
     "url": "https://github.com/EOSIO/eosjs.git"
   },
   "dependencies": {
-    "elliptic": "6.5.3",
+    "bn.js": "5.2.0",
+    "elliptic": "6.5.4",
     "hash.js": "1.1.7",
-    "pako": "1.0.11"
+    "pako": "2.0.3"
   },
   "devDependencies": {
-    "@blockone/eslint-config-blockone": "^3.0.0",
+    "@blockone/eslint-config-blockone": "^4.0.0",
     "@types/elliptic": "^6.4.12",
-    "@types/jest": "^26.0.9",
-    "@types/node": "^14.0.27",
+    "@types/jest": "^26.0.22",
+    "@types/node": "^14.14.37",
     "@types/pako": "^1.0.1",
-    "cypress": "^4.12.1",
+    "buffer": "^6.0.3",
+    "crypto-browserify": "^3.12.0",
+    "cypress": "^7.0.1",
     "eosjs-ecc": "^4.0.7",
-    "eslint": "^6.8.0",
-    "jest": "^26.3.0",
+    "eslint": "^7.23.0",
+    "jest": "^26.6.3",
     "jest-fetch-mock": "^3.0.3",
-    "ts-jest": "^26.2.0",
-    "ts-loader": "^7.0.5",
-    "typescript": "^3.9.7",
-    "webpack": "^4.44.1",
-    "webpack-cli": "^3.3.12"
-  },
-  "resolutions": {
-    "lodash": "4.17.19"
+    "ts-jest": "^26.5.4",
+    "ts-loader": "^8.1.0",
+    "typescript": "^4.2.4",
+    "webpack": "^5.31.0",
+    "webpack-cli": "^4.6.0"
   },
   "jest": {
     "automock": false,
@@ -65,7 +65,7 @@
     },
     "globals": {
       "ts-jest": {
-        "tsConfig": "tsconfig.json"
+        "tsconfig": "tsconfig.json"
       }
     },
     "testRegex": "(/src/.*(\\.|/)(test|spec))\\.(jsx?|tsx?)$",

webpack.debug.js

@@ -1,4 +1,5 @@
 const path = require('path');
+const webpack = require('webpack');
 
 module.exports = {
     entry: {
@@ -23,8 +24,17 @@ module.exports = {
             }
         ]
     },
+    plugins: [
+        new webpack.ProvidePlugin({
+            Buffer: ["buffer", "Buffer"],
+        })
+    ],
     resolve: {
-        extensions: ['.tsx', '.ts', '.js']
+        extensions: ['.tsx', '.ts', '.js'],
+        fallback: {
+            buffer: 'buffer',
+            crypto: 'crypto-browserify'
+        }
     },
     output: {
         filename: x => x.chunk.name.replace('_', '-') + '.js',

webpack.prod.js

@@ -1,4 +1,5 @@
 const path = require('path');
+const webpack = require('webpack');
 
 module.exports = {
     entry: {
@@ -22,8 +23,17 @@ module.exports = {
             }
         ]
     },
+    plugins: [
+        new webpack.ProvidePlugin({
+            Buffer: ["buffer", "Buffer"],
+        })
+    ],
     resolve: {
-        extensions: ['.tsx', '.ts', '.js']
+        extensions: ['.tsx', '.ts', '.js'],
+        fallback: {
+            buffer: 'buffer',
+            crypto: 'crypto-browserify'
+        }
     },
     output: {
         filename: x => x.chunk.name.replace('_', '-') + '.min.js',