Security/dependency audit fixes - #87
Open
SanadAlrowaili wants to merge 25 commits into
Open
Conversation
This workflow generates SLSA provenance files for projects, satisfying level 3 requirements. It includes steps for building artifacts and generating subjects for provenance.
chore: use common version across all packages
Revert "chore: use common version across all packages"
Add TestTrader contract for token swapping
# Vade Implementation Report ## Summary Implemented Vercel Web Analytics documentation as requested. Created a comprehensive guide for integrating Vercel Web Analytics across multiple frontend frameworks. ## Changes Made ### Created Files - `docs/vercel-web-analytics.md` - Complete documentation guide for Vercel Web Analytics integration ## Implementation Details The documentation file includes: 1. **Prerequisites section** - Requirements for setting up Vercel Web Analytics including account creation, project setup, and CLI installation 2. **Framework-specific integration guides** for: - Next.js (Pages Directory) - Next.js (App Router) - Remix - Nuxt - SvelteKit - Astro - HTML (Plain HTML sites) - Create React App - Vue - Other frameworks (generic integration) 3. **Step-by-step instructions** including: - Enabling Web Analytics in Vercel dashboard - Installing the `@vercel/analytics` package - Adding the Analytics component/function to each framework - Deployment instructions - Viewing analytics data in the dashboard 4. **Next steps section** with links to: - Package documentation - Custom events - Data filtering - Privacy and compliance - Pricing - Troubleshooting ## Code Quality - Build completed successfully with no new errors - Pre-existing linting errors are unrelated to the documentation changes - No new dependencies were added - Lock files remain unchanged as no package.json modifications were made ## Notes The documentation file is placed in a new `docs/` directory at the repository root, following common documentation organization patterns. The content provides comprehensive framework-specific instructions for integrating Vercel Web Analytics into various types of web applications. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
# Vade Implementation Report ## Summary Implemented Vercel Web Analytics documentation as requested. Created a comprehensive guide for integrating Vercel Web Analytics across multiple frontend frameworks. ## Changes Made ### Created Files - `docs/vercel-web-analytics.md` - Complete documentation guide for Vercel Web Analytics integration ## Implementation Details The documentation file includes: 1. **Prerequisites section** - Requirements for setting up Vercel Web Analytics including account creation, project setup, and CLI installation 2. **Framework-specific integration guides** for: - Next.js (Pages Directory) - Next.js (App Router) - Remix - Nuxt - SvelteKit - Astro - HTML (Plain HTML sites) - Create React App - Vue - Other frameworks (generic integration) 3. **Step-by-step instructions** including: - Enabling Web Analytics in Vercel dashboard - Installing the `@vercel/analytics` package - Adding the Analytics component/function to each framework - Deployment instructions - Viewing analytics data in the dashboard 4. **Next steps section** with links to: - Package documentation - Custom events - Data filtering - Privacy and compliance - Pricing - Troubleshooting ## Code Quality - Build completed successfully with no new errors - Pre-existing linting errors are unrelated to the documentation changes - No new dependencies were added - Lock files remain unchanged as no package.json modifications were made ## Notes The documentation file is placed in a new `docs/` directory at the repository root, following common documentation organization patterns. The content provides comprehensive framework-specific instructions for integrating Vercel Web Analytics into various types of web applications. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Dmitry Chepurovskiy <d.chepurovskiy@1inch.io>
…n permissions (#9) Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Added a security policy document outlining supported versions and vulnerability reporting.
…dates (#10) Bumps the npm_and_yarn group with 1 update in the / directory: [bn.js](https://github.com/indutny/bn.js). Updates `bn.js` from 4.12.2 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v4.12.2...v4.12.3) Updates `immutable` from 4.3.7 to 4.3.8 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.3.7...v4.3.8) Updates `qs` from 6.14.0 to 6.15.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.15.0) --- updated-dependencies: - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 4.3.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Local `pnpm audit` reported 174 advisories on master (2 critical, 85 high). This applies `pnpm audit --fix` overrides, then bounds every one of them to its current major line. Total advisories: 174 -> 26. Critical: 2 -> 0. Production dependencies: `pnpm audit --prod` now reports no known vulnerabilities. The only prod-reaching issue was `ws` (via viem in typescript/aqua), now resolved to 8.21.1 / 7.5.13: - GHSA-96hv-2xvq-fx4p (high) ws memory-exhaustion DoS - GHSA-58qx-3vcg-4xpx (moderate) ws uninitialized memory disclosure `pnpm audit --fix` emits unbounded `>=x.y.z` replacements, which silently override the `^` intent in package.json and pull in new majors. Left as generated they resolved nx to 23.x, vitest to 4.x, vite to 8.x, ajv to 8.x and minimatch to 10.x - breaking peer ranges and every eslint run (ajv removed the `missingRefs` option in 7.x; minimatch dropped its default export). All 89 replacements are therefore pinned with `^`, with comments on the four that caused real breakage. The 26 remaining advisories are all dev-only, reached through @1inch/aqua -> @1inch/solidity-utils (hardhat/jest toolchain) and ts-node. They need a patched range that only exists in a newer major, so they cannot be fixed here without a breaking upgrade upstream. `elliptic` has no patched version published at all. Also adds .github/dependabot.yml - the repo had no Dependabot config, so nothing was keeping these current. Security updates are grouped separately from routine bumps so they can be merged quickly. Verified: build, type-check and test all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 'should extract last 10 bytes' test could never pass. Its address literal was 'l0xC65F...' - a stray leading `l` - so the Address constructor threw before the assertion was ever reached. Removing the typo exposed a second fault: the expected value '0x9d4a2e9eb0ce3606eb48' does not correspond to this address. Because the constructor always threw, that expectation had never been evaluated. AddressHalf documents itself as the last 10 bytes (80 bits) of an Ethereum address, and Address.lastHalf() implements exactly that - add0x(val.slice(-20)). For 0xC65F20579D3Eb3757281cddA51883C17F6c07715 the last 20 hex characters are cdda51883c17f6c07715, so the expected value is corrected to match the documented behaviour rather than the reverse. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was the unmodified GitHub starter template: it only hashed placeholder files (artifact1/artifact2) and never referenced the actual SDK build output, so it provided no real provenance. It was also the sole cause of the failing SonarCloud quality gate (MAJOR: "Use full commit SHA hash for this dependency" on the generator_generic_slsa3.yml reference). That finding cannot be fixed by pinning, because slsa-github-generator requires being referenced by a @vX.Y.Z tag so slsa-verifier can verify the builder ref.
Resolves the pnpm-workspace.yaml merge conflict with 1inch/sdks:master. Master has since added its own overrides block covering the same advisories (axios, brace-expansion, cookie, follow-redirects, serialize-javascript, tmp, undici, yaml), so this branch's ~100 line block was redundant and contained many overlapping/contradictory ranges. Taking master's version verbatim.
Resolves the pnpm-lock.yaml merge conflict with 1inch/sdks:master. This branch changes no package.json files, so master's lockfile is already in sync with the workspace manifests now that pnpm-workspace.yaml matches master. Taking it verbatim keeps the lockfile internally consistent instead of hand-merging 284 conflict hunks.
|
atze1210
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change Summary
What does this PR change?
Related Issue/Ticket:
Testing & Verification
How was this tested?
Risk Assessment
Risk Level:
Risks & Impact