[BitcoinQnA]

Summary

All 20 open Dependabot alerts appeared on 2026-09-10, when #80 committed package-lock.json and Dependabot could see the whole dependency tree for the first time. This PR clears the 18 development alerts in code. It also removes the reason for the two alerts that affect shipped code, so they can be dismissed once this is merged.

Development tooling (18 alerts, never in the downloaded file)

• The old dev server (fastify 3, fastify-static, ws, nodemon) is replaced by src/server.js, which uses only Node's standard library:
  • serves src/www and reloads open pages over Server-Sent Events
  • listens on 127.0.0.1 only
  • takes PORT from the environment, and npm run dev is now node --watch
  • removes 99 packages: fastify (3 alerts), find-my-way, send, cookie, fast-uri (6 alerts) and ws
• A scoped npm update of only the alerted packages: shell-quote 1.10.0 (2 alerts), qs 6.16.0, brace-expansion 1.1.18 and esbuild 0.28.2. No bundled crypto library changed. A plain npm update would have moved @noble/curves to 2.x and the @bcts Shamir betas, which would stop the lockfile matching the committed bundles.
• build.js strips the new reload script and fails the build if it's still there. The README drops the port 8080 workaround.

valibot (#22, runtime)

• The copies under bitcoinjs-lib, bip32 and descriptors are now 1.5.0. The Miniscript, PSBT and Silent Payments bundles are rebuilt on it.
• The one copy left is valibot 0.37.0, pinned by silent-payments' git dependency on ecpair. That code only calls validators like v.parse and v.object, never the vulnerable flatten(). It can be dismissed as "vulnerable code not used".

elliptic (#9, no fixed release)

• The advisory (GHSA-848j-6mx2-7j84) describes ECDSA signatures that can expose the private key. The Sign & Verify tool signed through elliptic: bitcoinjs-message calls the secp256k1 package, which falls back to elliptic in a browser build.
• message.js is now built by a new build_message.js (esbuild) from the existing _message_entry.js. The secp256k1 and elliptic packages are replaced by small shims over @noble/secp256k1. The build fails if either package ends up in the bundle anyway. message.js goes from 592 KB to 528 KB and can now be rebuilt from the repo.
• elliptic is still inside the older browserify bundles (bitcoin.js, bip32.js, bip47.js, bip85.js, bip86.js). Those use it only for key derivation, and nothing on the page signs with them. Once this is merged, the alert can be dismissed as "vulnerable code not used".
• I couldn't reproduce the flaw with the old bundle: 7,320 signatures, including hashes and keys with leading zero bytes, all matched a correct RFC 6979 signer. I'm treating it as a real risk anyway, because the advisory says every version is affected and no fix exists.

Test plan

• npm test: all 3 suites pass.
• message.js, old against new:
  • BIP-137: 400 of 400 signatures byte-identical across p2pkh (compressed and uncompressed), p2wpkh and p2sh-p2wpkh.
  • BIP-322: 150 of 150 identical for p2pkh, p2sh-p2wpkh and p2wpkh. The 50 taproot signatures verify across versions in both directions.
  • Tampered messages are rejected.
• miniscript.js and psbt.js, old against new: 203 comparisons with 0 mismatches. They cover sample descriptors, address derivation, policy compilation, analysis, spend paths and 62 PSBTs.
• sp.js, old against new: 850 comparisons, 0 mismatches.
• Browser:
  • Signing works on the dev server and on the built page under its Content Security Policy, with 0 violations and 0 console errors.
  • The dev server returns the right content types, refuses path escapes and reloads the page when a file changes.
• dist/index.html rebuilt: 10.74 MB, down from 10.78 MB.

After merging

• Dismiss Apple is classist and shit #22 and Develop #9 as "vulnerable code not used", with the reasons above.
• No release. This goes into the next release batch.

🤖 Generated with Claude Code