diff --git a/.changeset/fix-create-sei-next-sharp-advisories.md b/.changeset/fix-create-sei-next-sharp-advisories.md deleted file mode 100644 index b19258816..000000000 --- a/.changeset/fix-create-sei-next-sharp-advisories.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@sei-js/create-sei': patch ---- - -Bump the Next template's `next` and `sharp` pins to clear three newly published advisories. - -The generated-app smoke audits every variant and fails on any high or critical finding. Three advisories landed against the pinned versions, so the check went red without any change to the template: - -- `GHSA-p293-qw3h-jr36` — critical, unauthenticated RCE on Windows-hosted Next.js servers, `>=13.4.0 <15.5.24`. -- `GHSA-2xp9-vwfh-vxw4` — critical, unauthenticated RCE in the Image Optimization API when AVIF files are used, `>=10.0.0 <15.5.24`. -- `GHSA-rgj7-g3m4-5g8c` — high, heap overflow in Sharp's bundled libheif decoder, `<0.35.4`. - -`next` moves `15.5.21` to `15.5.25` and the `sharp` override `0.35.3` to `0.35.4`, both inside their pinned minors. - -Next also widened its own Sharp declaration to `^0.34.3 || ^0.35.4`, so the pinned override now sits inside the range Next supports. The image notes in the template README and `next.config.mjs` said the opposite and are corrected: images stay unoptimized to avoid requiring a native Sharp build, which is a template choice rather than a security tradeoff. The `sharp` override itself still is one, and both notes now say so — the `0.34.x` half of Next's range remains inside the advisory, making `0.35.4` the floor rather than a free upgrade. - -The remaining `decode-uri-component` finding is moderate and does not block the smoke. diff --git a/.changeset/fix-global-wallet-dynamic-peer-drift.md b/.changeset/fix-global-wallet-dynamic-peer-drift.md deleted file mode 100644 index e2d1b422c..000000000 --- a/.changeset/fix-global-wallet-dynamic-peer-drift.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@sei-js/sei-global-wallet': patch ---- - -Document that `@dynamic-labs/ethereum-aa` has to match the `@dynamic-labs/global-wallet-client` version npm resolves, and keep the release checks on that resolved version instead of a constant. - -Dynamic declares `@dynamic-labs/ethereum-aa` as an exact peer of its client and pins its internal packages to the client's version, so the two move together on every patch. `@dynamic-labs/global-wallet-client` is a `^4.96.3` dependency here, which means a Dynamic patch inside that range changes the peer version consumers need. Pinning an older `@dynamic-labs/ethereum-aa` than the resolved client does not fail the install: npm cannot place the client's exact peer beside the older root copy, so it nests the client under this package and duplicates the whole Dynamic runtime. The [Optional peer versions](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#optional-peer-versions) table now states this and shows how to read the version the resolved client asks for. - -The consumer verifier resolved `4.96.3` regardless of what the range resolved to, so Dynamic publishing `@dynamic-labs/global-wallet-client@4.96.4` turned the nightly consumer run red on a duplicated Dynamic subtree rather than on any change in this repository. It now resolves the declared range against the registry, pins that client and the peer version it requests in each full consumer, and reports both, so a Dynamic patch is exercised the way an application receives it while a peer pin moving outside this package's published range still fails. A client that npm nests instead of hoisting is now reported as such, rather than as an unresolved dependency. - -No published dependency or peer range changes. diff --git a/.changeset/fix-global-wallet-sharp-override.md b/.changeset/fix-global-wallet-sharp-override.md deleted file mode 100644 index ebaf35646..000000000 --- a/.changeset/fix-global-wallet-sharp-override.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -'@sei-js/sei-global-wallet': patch ---- - -Override the newly advised `sharp` pin, and waive the one optional-AA advisory that no override can reach. - -Two advisories published against the existing dependency graph, so the nightly consumer run went red without any change in this repository. - -`GHSA-rgj7-g3m4-5g8c` covers `sharp` below `0.35.4`, and `@dynamic-labs/iconic` pins `sharp@0.35.0` exactly. That is the same shape as the existing Axios and UUID pins: the vulnerable copy is reachable from `@dynamic-labs/global-wallet-client`, overrides are root-only in both npm and Bun, and this package cannot propagate them to an application. A plain install reported nine high findings, one root advisory cascading up the Dynamic chain to `@sei-js/sei-global-wallet` itself. The [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks now carry `"sharp": "0.35.4"`, a patch-level move inside the pinned minor. The advisory is a heap overflow in the bundled libheif decoder, so it needs untrusted HEIF input to trigger and `sharp` is a build-time dependency of the icon package that never reaches a browser bundle, but it is high severity with a compatible fix available, so it is corrected rather than waived. - -`GHSA-528h-pc64-c93x` covers every `stream-json` up to `3.4.0`, which the Solana RPC client's `jayson` requires as CommonJS on the optional AA path. It cannot be overridden: `3.5.0` onward is ESM-only under a moved `src/` layout, so pointing `jayson` at a fixed version replaces the advisory with a `MODULE_NOT_FOUND` on its own require, and every CommonJS version is inside the advisory. It is now an accepted advisory for the full npm consumer, alongside the Bun waiver that already existed for advisories with no compatible fix. The finding is an `O(depth²)` slowdown in filters that no wallet path feeds, and the wallet-only npm consumer is still held to a strictly clean audit with no waiver, so a default install is unaffected. - -Several verifier gaps this exposed are closed as well. - -The npm audits ran without allowing a non-zero exit, so any finding surfaced as a raw spawn error carrying the whole audit JSON rather than the assertion naming the consumer; they now fail with the offending package and advisory URL. Allowing that exit means the body has to be validated, because `npm audit` fails the same way when it cannot reach the registry: an `ENOAUDIT` payload carries no counts, so an unvalidated report would read as zero findings and turn an audit that never ran into a pass on the gate this check exists to enforce. Every npm audit result is now rejected unless it carries a real vulnerability count. - -The "overrides still required" report and the Bun "overrides are taking effect" assertion are now derived from the override block instead of a hardcoded `axios`/`uuid` list, so a newly overridden package cannot be left out and let a partial upstream fix ask for the whole waiver to be dropped. The README override blocks are asserted against the sets the consumers install, so the three hand-maintained copies cannot document an override that is never tested. - -The audit and override-parsing helpers moved into `scripts/consumer-audit.ts` and `scripts/documented-overrides.ts` with unit tests, so these cases are pinned by `bun test --isolate scripts` rather than only by a full consumer run. - -No published dependency or peer range changes. diff --git a/bun.lock b/bun.lock index 68c9a6bec..6f3f61877 100644 --- a/bun.lock +++ b/bun.lock @@ -18,7 +18,7 @@ }, "packages/create-sei": { "name": "@sei-js/create-sei", - "version": "2.0.0", + "version": "2.0.1", "bin": "./dist/main.js", "dependencies": { "boxen": "^7.1.1", @@ -74,7 +74,7 @@ }, "packages/sei-global-wallet": { "name": "@sei-js/sei-global-wallet", - "version": "2.0.0", + "version": "2.0.1", "dependencies": { "@dynamic-labs/global-wallet-client": "^4.96.3", "@wallet-standard/wallet": "^1.1.0", diff --git a/packages/create-sei/CHANGELOG.md b/packages/create-sei/CHANGELOG.md index 3009e2375..78a7db0c0 100644 --- a/packages/create-sei/CHANGELOG.md +++ b/packages/create-sei/CHANGELOG.md @@ -1,5 +1,23 @@ # @sei-js/create-sei +## 2.0.1 + +### Patch Changes + +- cb882eb: Bump the Next template's `next` and `sharp` pins to clear three newly published advisories. + + The generated-app smoke audits every variant and fails on any high or critical finding. Three advisories landed against the pinned versions, so the check went red without any change to the template: + + - `GHSA-p293-qw3h-jr36` — critical, unauthenticated RCE on Windows-hosted Next.js servers, `>=13.4.0 <15.5.24`. + - `GHSA-2xp9-vwfh-vxw4` — critical, unauthenticated RCE in the Image Optimization API when AVIF files are used, `>=10.0.0 <15.5.24`. + - `GHSA-rgj7-g3m4-5g8c` — high, heap overflow in Sharp's bundled libheif decoder, `<0.35.4`. + + `next` moves `15.5.21` to `15.5.25` and the `sharp` override `0.35.3` to `0.35.4`, both inside their pinned minors. + + Next also widened its own Sharp declaration to `^0.34.3 || ^0.35.4`, so the pinned override now sits inside the range Next supports. The image notes in the template README and `next.config.mjs` said the opposite and are corrected: images stay unoptimized to avoid requiring a native Sharp build, which is a template choice rather than a security tradeoff. The `sharp` override itself still is one, and both notes now say so — the `0.34.x` half of Next's range remains inside the advisory, making `0.35.4` the floor rather than a free upgrade. + + The remaining `decode-uri-component` finding is moderate and does not block the smoke. + ## 2.0.0 ### Major Changes diff --git a/packages/create-sei/package.json b/packages/create-sei/package.json index bfa1c1923..eb5b91ebf 100644 --- a/packages/create-sei/package.json +++ b/packages/create-sei/package.json @@ -1,6 +1,6 @@ { "name": "@sei-js/create-sei", - "version": "2.0.0", + "version": "2.0.1", "description": "Scaffold new Sei applications with pre-configured templates and tooling", "homepage": "https://github.com/sei-protocol/sei-js/tree/main/packages/create-sei#readme", "repository": { diff --git a/packages/sei-global-wallet/CHANGELOG.md b/packages/sei-global-wallet/CHANGELOG.md index 77046733d..2f7afd481 100644 --- a/packages/sei-global-wallet/CHANGELOG.md +++ b/packages/sei-global-wallet/CHANGELOG.md @@ -1,5 +1,35 @@ # @sei-js/sei-global-wallet +## 2.0.1 + +### Patch Changes + +- 66deb15: Document that `@dynamic-labs/ethereum-aa` has to match the `@dynamic-labs/global-wallet-client` version npm resolves, and keep the release checks on that resolved version instead of a constant. + + Dynamic declares `@dynamic-labs/ethereum-aa` as an exact peer of its client and pins its internal packages to the client's version, so the two move together on every patch. `@dynamic-labs/global-wallet-client` is a `^4.96.3` dependency here, which means a Dynamic patch inside that range changes the peer version consumers need. Pinning an older `@dynamic-labs/ethereum-aa` than the resolved client does not fail the install: npm cannot place the client's exact peer beside the older root copy, so it nests the client under this package and duplicates the whole Dynamic runtime. The [Optional peer versions](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#optional-peer-versions) table now states this and shows how to read the version the resolved client asks for. + + The consumer verifier resolved `4.96.3` regardless of what the range resolved to, so Dynamic publishing `@dynamic-labs/global-wallet-client@4.96.4` turned the nightly consumer run red on a duplicated Dynamic subtree rather than on any change in this repository. It now resolves the declared range against the registry, pins that client and the peer version it requests in each full consumer, and reports both, so a Dynamic patch is exercised the way an application receives it while a peer pin moving outside this package's published range still fails. A client that npm nests instead of hoisting is now reported as such, rather than as an unresolved dependency. + + No published dependency or peer range changes. + +- cb882eb: Override the newly advised `sharp` pin, and waive the one optional-AA advisory that no override can reach. + + Two advisories published against the existing dependency graph, so the nightly consumer run went red without any change in this repository. + + `GHSA-rgj7-g3m4-5g8c` covers `sharp` below `0.35.4`, and `@dynamic-labs/iconic` pins `sharp@0.35.0` exactly. That is the same shape as the existing Axios and UUID pins: the vulnerable copy is reachable from `@dynamic-labs/global-wallet-client`, overrides are root-only in both npm and Bun, and this package cannot propagate them to an application. A plain install reported nine high findings, one root advisory cascading up the Dynamic chain to `@sei-js/sei-global-wallet` itself. The [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks now carry `"sharp": "0.35.4"`, a patch-level move inside the pinned minor. The advisory is a heap overflow in the bundled libheif decoder, so it needs untrusted HEIF input to trigger and `sharp` is a build-time dependency of the icon package that never reaches a browser bundle, but it is high severity with a compatible fix available, so it is corrected rather than waived. + + `GHSA-528h-pc64-c93x` covers every `stream-json` up to `3.4.0`, which the Solana RPC client's `jayson` requires as CommonJS on the optional AA path. It cannot be overridden: `3.5.0` onward is ESM-only under a moved `src/` layout, so pointing `jayson` at a fixed version replaces the advisory with a `MODULE_NOT_FOUND` on its own require, and every CommonJS version is inside the advisory. It is now an accepted advisory for the full npm consumer, alongside the Bun waiver that already existed for advisories with no compatible fix. The finding is an `O(depth²)` slowdown in filters that no wallet path feeds, and the wallet-only npm consumer is still held to a strictly clean audit with no waiver, so a default install is unaffected. + + Several verifier gaps this exposed are closed as well. + + The npm audits ran without allowing a non-zero exit, so any finding surfaced as a raw spawn error carrying the whole audit JSON rather than the assertion naming the consumer; they now fail with the offending package and advisory URL. Allowing that exit means the body has to be validated, because `npm audit` fails the same way when it cannot reach the registry: an `ENOAUDIT` payload carries no counts, so an unvalidated report would read as zero findings and turn an audit that never ran into a pass on the gate this check exists to enforce. Every npm audit result is now rejected unless it carries a real vulnerability count. + + The "overrides still required" report and the Bun "overrides are taking effect" assertion are now derived from the override block instead of a hardcoded `axios`/`uuid` list, so a newly overridden package cannot be left out and let a partial upstream fix ask for the whole waiver to be dropped. The README override blocks are asserted against the sets the consumers install, so the three hand-maintained copies cannot document an override that is never tested. + + The audit and override-parsing helpers moved into `scripts/consumer-audit.ts` and `scripts/documented-overrides.ts` with unit tests, so these cases are pinned by `bun test --isolate scripts` rather than only by a full consumer run. + + No published dependency or peer range changes. + ## 2.0.0 ### Major Changes diff --git a/packages/sei-global-wallet/package.json b/packages/sei-global-wallet/package.json index cb8a67aa2..4878671cd 100644 --- a/packages/sei-global-wallet/package.json +++ b/packages/sei-global-wallet/package.json @@ -1,7 +1,7 @@ { "name": "@sei-js/sei-global-wallet", "description": "Sei Global Wallet is a library to support Dynamic Global Wallets", - "version": "2.0.0", + "version": "2.0.1", "repository": { "type": "git", "url": "https://github.com/sei-protocol/sei-js.git",