@@ -15,149 +15,43 @@ nodeLinker: node-modules
1515npmAuditIgnoreAdvisories :
1616 # ## Advisories:
1717
18- # Issue: yargs-parser Vulnerable to Prototype Pollution
19- # URL - https://github.com/advisories/GHSA-p9pc-299p-vxgp
20- # The affected version (<5.0.0) is only included via @ensdomains/ens via
21- # 'solc' which is not used in the imports we use from this package.
22- - 1088783
23-
24- # Issue: protobufjs Prototype Pollution vulnerability
25- # URL - https://github.com/advisories/GHSA-h755-8qp9-cq85
26- # Not easily patched. Minimally effects the extension due to usage of
27- # LavaMoat lockdown. Additional id added that resolves to the same advisory
28- # but has a different entry due to it being a new dependency of
29- # @trezor/connect-web. Upgrading
30- - 1092429
31- - 1095136
32-
3318 # Issue: Regular Expression Denial of Service (ReDOS)
3419 # URL: https://github.com/advisories/GHSA-257v-vj4p-3w2h
3520 # color-string is listed as a dependency of 'color' which is brought in by
3621 # @metamask/jazzicon v2.0.0 but there is work done on that repository to
3722 # remove the color dependency. We should upgrade
3823 - 1089718
3924
40- # Issue: semver vulnerable to Regular Expression Denial of Service
41- # URL: https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
42- # semver is used in the solidity compiler portion of @truffle/codec that does
43- # not appear to be used.
44- - 1092461
45-
46- # Issue: Malware in @solana/web3.js
47- # URL: https://github.com/advisories/GHSA-2mhj-xmf4-pr8m
48- # we patched this to ensure the vulnerable versions are not included, but the advisory
49- # was mistakenly originally created to flag all versions as vulnerable
50- - 1101059
51-
52- # Issue: axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
53- # URL: https://github.com/advisories/GHSA-jr5f-v2jv-69x6
54- # We are ignoring this on March 11, 2025 to unblock CI, we will follow with a proper fix or confirmation this does not affect our users
55- - 1102472
56-
5725 # Issue: Issue: Babel has inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups
58- # We are ignoring this on March 12, 2025 and April 24, 2025 to unblock CI, we will follow with a proper fix or confirmation this does not affect our users
59- - 1103026
26+ # We are ignoring this on April 24, 2025 to unblock CI, we will follow with a proper fix or confirmation this does not affect our users
6027 - 1104001
6128
62- # Issue: ses's global contour bindings leak into Compartment lexical scope
63- # URL: https://github.com/advisories/GHSA-h9w6-f932-gq62
64- # We are ignoring this on April 24, 2025 as it does not affect the codebase.
65- - 1103932
66-
67- # Issue: React Router allows pre-render data spoofing on React-Router framework mode
68- # URL: https://github.com/MetaMask/metamask-extension/security/dependabot/228
69- # will be fixed in https://github.com/MetaMask/MetaMask-planning/issues/3261
70- - 1104031
71- - 1104032
72-
73- # Temp fix for https://github.com/MetaMask/metamask-extension/pull/16920 for the sake of 11.7.1 hotfix
74- # This will be removed in this ticket https://github.com/MetaMask/metamask-extension/issues/22299
75- - ' ts-custom-error (deprecation)'
76- - ' text-encoding (deprecation)'
29+ # Issue: `glob` vulnerability, already fixed in the version we're using (v10.5.0) but the
30+ # advisory range hasn't been updated yet.
31+ # URL: https://github.com/advisories/GHSA-5j98-mcp5-4vw2
32+ - 1109809
7733
7834 # ## Package Deprecations:
7935
8036 # React-tippy brings in popper.js and react-tippy has not been updated in
8137 # three years.
8238 - ' popper.js (deprecation)'
8339
84- # React-router is out of date and brings in the following deprecated package
85- - ' mini-create-react-context (deprecation)'
86-
87- # The affected version, which is less than 7.0.0, is brought in by
88- # ethereumjs-wallet version 0.6.5 used in the extension but only in a single
89- # file app/scripts/account-import-strategies/index.js, which may be easy to
90- # upgrade.
91- - ' uuid (deprecation)'
92-
93- # @npmcli/move-file is brought in via CopyWebpackPlugin used in the storybook
94- # main.js file, which can be upgraded to remove this dependency in favor of
95- # @npmcli/fs
96- - ' @npmcli/move-file (deprecation)'
97-
98- # Upgrading babel will result in the following deprecated packages being
99- # updated:
100- - ' core-js (deprecation)'
101-
10240 # Material UI dependencies are planned for removal
10341 - ' @material-ui/core (deprecation)'
10442 - ' @material-ui/styles (deprecation)'
105- - ' @material-ui/system (deprecation)'
106-
107- # @ensdomains/ens should be explored for upgrade. The following packages are
108- # deprecated and would be resolved by upgrading to newer versions of
109- # ensdomains packages:
110- - ' @ensdomains/ens (deprecation)'
111- - ' @ensdomains/resolver (deprecation)'
112- - ' testrpc (deprecation)'
11343
11444 # Dependencies brought in by @truffle/decoder that are deprecated:
11545 - ' cids (deprecation)' # via @ensdomains/content-hash
11646 - ' multibase (deprecation)' # via cids
11747 - ' multicodec (deprecation)' # via cids
11848
119- # MetaMask owned repositories brought in by other MetaMask dependencies that
120- # can be resolved by updating the versions throughout the dependency tree
121- - ' eth-sig-util (deprecation)' # via @metamask/eth-ledger-bridge-keyring
122- - ' @metamask/controller-utils (deprecation)' # via @metamask/phishing-controller
123- - ' safe-event-emitter (deprecation)' # via eth-block-tracker and others
124-
125- # @metamask-institutional relies upon crypto which is deprecated
126- - ' crypto (deprecation)'
127-
128- # @metamask/providers uses webextension-polyfill-ts which has been moved to
129- # @types/webextension-polyfill
130- - ' webextension-polyfill-ts (deprecation)'
131-
132- # Imported in @trezor/blockchain-link@npm:2.1.8, but not actually depended on
133- # by MetaMask
134- - ' ripple-lib (deprecation)'
135-
136- # Brought in by ethereumjs-utils, which is used in the extension and in many
137- # other dependencies. At the time of this exclusion, the extension has three
138- # old versions of ethereumjs-utils which should be upgraded to
139- # @ethereumjs/utils throughout our owned repositories. However even doing
140- # that may be insufficient due to dependencies we do not own still relying
141- # upon old versions of ethereumjs-utils.
142- - ' ethereum-cryptography (deprecation)'
143-
14449 # Currently in use for the network list drag and drop functionality.
14550 # Maintenance has stopped and the project will be archived in 2025.
14651 - ' react-beautiful-dnd (deprecation)'
14752 # New package name format for new versions: @ethereumjs/wallet.
14853 - ' ethereumjs-wallet (deprecation)'
14954
150- # The new trezor version breaks the webpack build due to issues with ESM and CommonJS
151- # Leading to this error on start: `Uncaught ReferenceError: exports is not defined`
152- # We temporarily ignore the audit failure until we can safely upgrade to the new version without breaking the webpack build
153- # Check Trezor 9.5.X Changelog for more info: https://github.com/trezor/trezor-suite/blob/develop/packages/connect/CHANGELOG.md
154- - ' @trezor/connect-web (deprecation)'
155-
156- # We temporarily ignore the deprecation notice to unblock ci
157- # Issue: @solana/web3.js version 2.0 is now @solana/kit! Remove @solana/web3.js@2 from your dependencies and replace it with @solana/kit.
158- # As needed, upgrade all of your @solana-program/* dependencies to the latest versions that use Kit.
159- - ' @solana/web3.js (deprecation)'
160-
16155plugins :
16256 - path : .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
16357 spec : ' https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js'
0 commit comments