fix: [elliptic] Upgrade elliptic from 6.4.1 to 6.6.1 to resolve CVE-2024-48948

[hannahhuh-cog]

Summary

Fixes the ECDSA signature verification flaw in elliptic, reported by the scheduled Snyk MCP scan.

• Vulnerability: Improper Verification of Cryptographic Signature — SNYK-JS-ELLIPTIC-8187303
• CVE: CVE-2024-48948
• Severity: Critical, CVSS 9.3
• Affected: elliptic@6.4.1 (transitive)
• Fixed in: >=6.6.0; pinned to 6.6.1, which also covers the information-exposure finding fixed in 6.6.1
• Risk: verify() can accept invalid ECDSA signatures for certain message hash lengths, so signature-based authentication/integrity checks can be bypassed.

elliptic is transitive, so the fix is an npm overrides entry:

+  "overrides": {
+    "elliptic": "6.6.1"
+  }

package-lock.json regenerated with npm install --package-lock-only; resolved node_modules/elliptic is now 6.6.1.

Snyk scan reference: snyk test --all-projects --dev / snyk_sca_scan (unmanaged: true), Snyk org 9e26acce-22c7-4efc-b470-21d9587f49fe.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/fc1965e7d98f4966bea1c7aa64a929b0
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🟡 Lockfile omits overrides, can break npm ci

package.json declares an overrides block, but the root package in package-lock.json records no matching overrides key. npm normally persists overrides in the lockfile, so its absence leaves the two files out of sync and can make npm ci fail with an EUSAGE error.

Prompt for agents

package.json adds an overrides block pinning elliptic to 6.6.1, but package-lock.json's root package (packages[""]) does not contain a matching overrides field (searching for 'overrides' in package-lock.json yields no results). When npm regenerates a lockfile with overrides declared, it stores them under packages[""].overrides; the missing field indicates the lockfile was not fully regenerated by npm. This can cause 'npm ci' to fail with an out-of-sync error. Regenerate the lockfile with a recent npm (e.g. npm install --package-lock-only) so the overrides metadata is written into package-lock.json, and verify npm ci succeeds.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Verified locally — npm ci is not broken by this.

I regenerated the lockfile with npm install --package-lock-only on npm 10.8.2. This repo's lockfile is lockfileVersion: 2 (hybrid v1/v2), and npm did not write an overrides key into packages[""] — but it did resolve the overridden version in the tree, and npm only enforces the overrides-sync check when the lockfile records one.

Evidence, from a clean checkout of just package.json + package-lock.json on this branch:

$ npm ci --ignore-scripts
added 947 packages in 5s
$ node -e "console.log(require('elliptic/package.json').version)"
6.6.1

No EUSAGE error. Leaving the lockfile as npm generated it.

[devin-ai-integration]

📝 Info: elliptic is a dev-only transitive dependency

elliptic is marked "dev": true in the lockfile and pulled in transitively through the browserify build chain. The override correctly pins it to 6.6.1, but the CVE scope here is dev/build tooling rather than the production runtime.

---

Was this helpful? React with 👍 or 👎 to provide feedback.