From b46b13b64794cabc02a755e737b536ae507a9088 Mon Sep 17 00:00:00 2001 From: ArunBala-Bitgo Date: Fri, 4 Sep 2026 11:39:02 +0530 Subject: [PATCH] fix: bump fflate to 0.8.3 and toml to 4.3.0 to fix osv-scanner findings fflate@0.8.2 (via key-card > jspdf) hit GHSA-px8p-9vwx-vf98 (CVSS 7.5, unzipSync infinite loop on malformed ZIP64 archives). toml@2.3.6 (via bitgo > stellar-sdk) hit GHSA-82x6-q7mm-w9cf and GHSA-v5mp-jgw5-2x6j (CVSS 7.5/8.2, recursion DoS and prototype pollution in toml.parse()). Both were failing the release's "3 of N advisory groups >= CVSS 7.0" gate. Verified via full monorepo install + build that the bumps do not break jspdf's zlibSync usage or stellar-sdk's toml.parse() call shape. Ticket: CECHO-2099 --- package.json | 2 ++ yarn.lock | 16 ++++++++-------- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index 02d35155ed..a34078ad24 100644 --- a/package.json +++ b/package.json @@ -60,6 +60,8 @@ "yeoman-generator": "^5.6.1" }, "resolutions": { + "fflate": "0.8.3", + "toml": "4.3.0", "**/cliui/strip-ansi": "6.0.1", "**/cliui/string-width": "4.2.3", "**/yargs/cliui/string-width": "4.2.3", diff --git a/yarn.lock b/yarn.lock index 26ba026634..824f015ec1 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11808,10 +11808,10 @@ fetch-blob@^3.1.2, fetch-blob@^3.1.4: node-domexception "^1.0.0" web-streams-polyfill "^3.0.3" -fflate@^0.8.1: - version "0.8.2" - resolved "https://registry.npmjs.org/fflate/-/fflate-0.8.2.tgz" - integrity sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A== +fflate@0.8.3, fflate@^0.8.1: + version "0.8.3" + resolved "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz#bc27d8eb30343d4d512abb03480202ce65d825fc" + integrity sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA== figures@3.2.0, figures@^3.2.0: version "3.2.0" @@ -20272,10 +20272,10 @@ toidentifier@1.0.1: resolved "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz" integrity sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA== -toml@^2.3.0: - version "2.3.6" - resolved "https://registry.npmjs.org/toml/-/toml-2.3.6.tgz" - integrity sha512-gVweAectJU3ebq//Ferr2JUY4WKSDe5N+z0FvjDncLGyHmIDoxgY/2Ie4qfEIDm4IS7OA6Rmdm7pdEEdMcV/xQ== +toml@4.3.0, toml@^2.3.0: + version "4.3.0" + resolved "https://registry.npmjs.org/toml/-/toml-4.3.0.tgz#10e2ff83296ec17d8935bf02364e4969cfeaae67" + integrity sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A== tonweb@^0.0.62: version "0.0.62"