[Snyk] Fix for 10 vulnerabilities

[SCOTT-GROUP-PRO]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • static/node/package.json
  • static/node/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	589/1000 Why? Has a fix available, CVSS 7.5	Improper Verification of Cryptographic Signature SNYK-JS-BROWSERIFYSIGN-6037026	No	No Known Exploit
	601/1000 Why? Recently disclosed, Has a fix available, CVSS 6.3	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-COOKIEJAR-3149984	No	Proof of Concept
	776/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.1	Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-7577916	No	Proof of Concept
	776/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.1	Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-7577917	No	Proof of Concept
	776/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.1	Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-7577918	No	Proof of Concept
	701/1000 Why? Recently disclosed, Has a fix available, CVSS 8.3	Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-8172694	Yes	No Known Exploit
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-WEB3UTILS-6229337	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @truffle/config

The new version differs by 250 commits.

• 033fc64 Publish
• 8c81e30 Merge pull request #6187 from trufflesuite/decapitate
• 7591024 Remove gitHead field that snuck its way in
• 4c80841 Merge pull request #6180 from legobeat/node-version
• 25f02d2 Merge pull request #6185 from legobeat/devdeps-dedupe-babel
• d235365 Merge pull request #6186 from legobeat/ci-node-20.5
• 48a2052 chore: yarn dedupe @ babel/ packages
• d355b79 chore(ci): pin node 20 to 20.5 due to regression in 20.6
• d0d0c89 Merge pull request #6178 from legobeat/achrinza-node-ipc
• a9d543f Merge pull request #6177 from legobeat/deps-semver
• 1c79efe chore(deps): unpin semver
• 5ae76e9 deps(codec-components): bump @ microsoft/api-extractor to fix semver CVE
• cb8bf8b yarn dedupe browserslist@^4.x
• a830ff5 deps: dedupe core-js-compat to remove [email protected]
• c31707c update yarn.lock
• b349c1c deps: semver@^7.5.2->^7.5.4
• 53fcef0 update yarn.lock
• 005ebb9 deps: [email protected]>7.5.4
• 4ff7c58 update yarn.lock
• cfde067 devDeps(spinners): remove unused @ types/semver
• 6af2e11 devDeps: @ types/semver->7.5.1
• b1810cc deps: [email protected]>7.5.4
• b7bc4c1 deps(core): [email protected]>7.5.4
• 9c581ec compile-solidity: type-assertion due to incompletely typed @ types/semver

See the full diff

Package name: @truffle/decoder

The new version differs by 250 commits.

• a26df1f Publish
• 4df99df Merge pull request #6193 from legobeat/ci-yarn-deduplicate
• 39ffb36 apply lint:fix:dependencies
• d37ed52 ci: enforce deduped lockfile when linting dependencies
• b999099 chore: add yarn lockfile deduplication package scripts using yarn-deduplicate
• 6b2a081 Merge pull request #6194 from legobeat/yarn-dedupe-full-fewer
• 0f3d963 yarn refresh lockfile
• 17536c4 yarn deduplicate fewer
• 6accdbf devDeps: yarn deduplicate readable-stream
• f322892 devDeps: yarn deduplicate object.assign
• 4fac8f1 devDeps: yarn deduplicate http-cache-semantics
• 7b2d2ff devDeps: yarn deduplicate acorn,ajv
• 6a0c3bd deps: yarn deduplicate bn.js@^5
• a82c4ad devDeps: yarn deduplicate @ types/
• f28ce63 deps: yarn dedupe strip-ansi,ansi-regex
• 9b23a59 devDeps: webpack@^5.73.0->^5.88.2
• 09ebe21 deps: yarn dedupe,lockbump apollo-server packages
• a267cab yarn dedupe graphql,tslib
• 16e723d devDeps(db,db-kit): madge@^5.0.1->6.1.0
• 3344b45 Merge pull request #6192 from legobeat/deps-bump-eth-libs
• 4372ee3 update yarn.lock after rebase
• 0625db5 Merge pull request #6191 from legobeat/deps-dedupe-libs
• 0500ff7 deps: bump/dedupe web3, ethereumjs-util packages
• 4d64055 yarn dedupe ethers

See the full diff

Package name: web3-eth-abi

The new version differs by 250 commits.

• a34afae v1.6.0
• 5bc08f8 v1.6.0-rc.0
• 8cd7c04 Build for 1.6.0-rc.0
• cf868f5 Update CHANGELOG for 1.6.0
• ff78232 Partially replace the use of eth-lib (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4390)
• c82db7a npm i and build for v1.5.3
• 7f525d8 v1.5.3
• 7fcb2ff v1.5.3-rc.0
• ac9aafd Build for 1.5.3-rc.0
• a58173b Update CHANGELOG for 1.5.3 release
• 3f5cb38 signTransaction fix (System Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4295)
• c70722b EIP-1559 Fix Issue Decoding Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4258 (System Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4277)
• 1547b18 Bump maxPriorityFeePerGas to 2.5 Gwei - Closes System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4283 (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4284)
• 8e8785e Junaid/1xlibsfix (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4231)
• 44b72f8 Release 1.5.2 (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4242)
• e1556ff Don't default type = 0x0 for eth_sendTransaction and eth_sendRawTransaction (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4241)
• b383a8e v1.5.1 (Decoding Error when running Ganache 2.5.4 on linux trufflesuite/ganache-ui#4219)
• 29febb8 Add block tag support for eth_feeHistory (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4224)
• c474f8f EIP-1559 support for web3.eth.sendTransaction (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4220)
• d0d82b4 Closes System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4210, 4211 - allow non-hex values for eip1559 gas params (EIP-2: Invalid Signature when S component of Signature greater than secp256k1n/2 check is not present is ganache 7.0.3 trufflesuite/ganache-ui#4217)
• 458a47a v1.5.0 (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4187)
• dabe994 Update CHANGELOG (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4193)
• 436e77a eth_feeHistory (EIP 1559) (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4191)
• 7d03412 Update docs 2 (System Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4188)

See the full diff

Package name: web3-providers-http

The new version differs by 250 commits.

• a34afae v1.6.0
• 5bc08f8 v1.6.0-rc.0
• 8cd7c04 Build for 1.6.0-rc.0
• cf868f5 Update CHANGELOG for 1.6.0
• ff78232 Partially replace the use of eth-lib (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4390)
• c82db7a npm i and build for v1.5.3
• 7f525d8 v1.5.3
• 7fcb2ff v1.5.3-rc.0
• ac9aafd Build for 1.5.3-rc.0
• a58173b Update CHANGELOG for 1.5.3 release
• 3f5cb38 signTransaction fix (System Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4295)
• c70722b EIP-1559 Fix Issue Decoding Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4258 (System Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4277)
• 1547b18 Bump maxPriorityFeePerGas to 2.5 Gwei - Closes System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4283 (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4284)
• 8e8785e Junaid/1xlibsfix (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4231)
• 44b72f8 Release 1.5.2 (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4242)
• e1556ff Don't default type = 0x0 for eth_sendTransaction and eth_sendRawTransaction (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4241)
• b383a8e v1.5.1 (Decoding Error when running Ganache 2.5.4 on linux trufflesuite/ganache-ui#4219)
• 29febb8 Add block tag support for eth_feeHistory (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4224)
• c474f8f EIP-1559 support for web3.eth.sendTransaction (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4220)
• d0d82b4 Closes System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4210, 4211 - allow non-hex values for eip1559 gas params (EIP-2: Invalid Signature when S component of Signature greater than secp256k1n/2 check is not present is ganache 7.0.3 trufflesuite/ganache-ui#4217)
• 458a47a v1.5.0 (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4187)
• dabe994 Update CHANGELOG (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4193)
• 436e77a eth_feeHistory (EIP 1559) (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4191)
• 7d03412 Update docs 2 (System Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4188)

See the full diff

Package name: web3-providers-ws

The new version differs by 250 commits.

• a34afae v1.6.0
• 5bc08f8 v1.6.0-rc.0
• 8cd7c04 Build for 1.6.0-rc.0
• cf868f5 Update CHANGELOG for 1.6.0
• ff78232 Partially replace the use of eth-lib (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4390)
• c82db7a npm i and build for v1.5.3
• 7f525d8 v1.5.3
• 7fcb2ff v1.5.3-rc.0
• ac9aafd Build for 1.5.3-rc.0
• a58173b Update CHANGELOG for 1.5.3 release
• 3f5cb38 signTransaction fix (System Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4295)
• c70722b EIP-1559 Fix Issue Decoding Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4258 (System Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4277)
• 1547b18 Bump maxPriorityFeePerGas to 2.5 Gwei - Closes System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4283 (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4284)
• 8e8785e Junaid/1xlibsfix (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4231)
• 44b72f8 Release 1.5.2 (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4242)
• e1556ff Don't default type = 0x0 for eth_sendTransaction and eth_sendRawTransaction (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4241)
• b383a8e v1.5.1 (Decoding Error when running Ganache 2.5.4 on linux trufflesuite/ganache-ui#4219)
• 29febb8 Add block tag support for eth_feeHistory (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4224)
• c474f8f EIP-1559 support for web3.eth.sendTransaction (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4220)
• d0d82b4 Closes System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4210, 4211 - allow non-hex values for eip1559 gas params (EIP-2: Invalid Signature when S component of Signature greater than secp256k1n/2 check is not present is ganache 7.0.3 trufflesuite/ganache-ui#4217)
• 458a47a v1.5.0 (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4187)
• dabe994 Update CHANGELOG (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4193)
• 436e77a eth_feeHistory (EIP 1559) (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4191)
• 7d03412 Update docs 2 (System Error when running Ganache 2.5.4 on darwin trufflesuite/ganache-ui#4188)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 More lessons are available in Snyk Learn