Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade @metamask/key-tree from 7.0.0 to 9.1.2 #3

Merged
merged 2 commits into from
Nov 18, 2024

Conversation

doperiddle
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade @metamask/key-tree from 7.0.0 to 9.1.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 7 versions ahead of your current version.

  • The recommended version was released on 4 months ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
696 Proof of Concept
Release notes
Package name: @metamask/key-tree
  • 9.1.2 - 2024-07-09

    Changed

    • Bump @ metamask/utils from ^8.3.0 to ^9.0.0 (#181)
  • 9.1.1 - 2024-05-21

    Fixed

    • Fix ESM imports (#177)
  • 9.1.0 - 2024-05-15

    Added

    • Add support for Cardano key derivation according to CIP3-Icarus (#158, #170, #171, #172)
    • Export getBIP44CoinTypeToAddressPathTuple function (#173)

    Changed

    • Replace @ noble/ed25519 and @ noble/secp256k1 with @ noble/curves (#154)
    • Bump several MetaMask dependencies (#151, #165, #167)
  • 9.0.0 - 2023-07-14

    Changed

    • BREAKING: Disallow importing from ./dist paths (#147)
    • Export mnemonicPhraseToBytes and createBip39KeyFromSeed (#149)

    Fixed

    • Add support for Node.js with ESM (#147)
    • Remove postinstall script (#146)
      • This caused installation to fail.
  • 8.0.0 - 2023-07-12

    Changed

    • BREAKING: Build the package as both CJS and ESM (#140)
      • Distribution files have been moved from dist to dist/cjs (and dist/esm). If you are explicitly importing from dist, you have to update the import.
    • Bump @ metamask/utils to 6.2.0 (#140)
  • 7.1.1 - 2023-06-20

    Fixed

    • Fix isValidBIP32PathSegment to correctly check if BIP-32 path segment is <= 2^31-1 (#134)
  • 7.1.0 - 2023-06-20

    Added

    • Add isValidBIP32PathSegment function (#131)

    Changed

    • Bump @ metamask/utils to 6.0.1 (#132)
  • 7.0.0 - 2023-03-10

    Added

    • BREAKING: Add SLIP-10 (slip10:) path type (#124)
      • bip32: can no longer be used to derive ed25519 keys

    Changed

    • Handle errors when resulting public or private key is invalid (#120)
      • Rather than throwing an error, a new key will be derived instead, as per the SLIP-10 or BIP-32 specification
    • Improve extended key validation (#121)
    • Validate that master private key and seed are within bounds (#118)
    • Allow zero private key for ed25519 (#122)
      • Previously a zero private key 0x000..000 would be rejected when using ed25519, but all private keys are valid for ed25519
from @metamask/key-tree GitHub release notes

Important

  • Warning: This PR contains a major version upgrade, and may be a breaking change.
  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

snyk-bot and others added 2 commits November 8, 2024 05:51
Copy link

snyk-io bot commented Nov 18, 2024

⚠️ Snyk checks are incomplete.

⚠️ security/snyk check encountered an error. (View Details)

⚠️ license/snyk check encountered an error. (View Details)

@doperiddle
Copy link
Owner Author

doperiddle commented Nov 18, 2024

⚠️ Snyk checks are incomplete.

⚠️ security/snyk check encountered an error. (View Details)

⚠️ license/snyk check encountered an error. (View Details)

@doperiddle doperiddle merged commit dbe5190 into master Nov 18, 2024
0 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants