Repository navigation
Remaining dependency vulnerabilities (9 after remediation) #827
Description
After commit 3ac9db5, bun audit reports 9 (3 high, 4 moderate, 2 low). None has a drop-in fix.
| Package | Severity | Via | Why not fixed |
|---|---|---|---|
| extract-zip 2.0.1 | high ×2 (symlink path traversal / arbitrary write) | docs → @lhci/cli → puppeteer |
No patched release |
| braces 3.0.3 | high (stack-exhaustion DoS) | ui → shadcn |
No patched release |
| stream-json 1.9.1 | moderate ×3 (prototype pollution, DoS) | web → @creit.tech/stellar-wallets-kit → @hot-wallet/sdk → @solana/web3.js → jayson |
Fix is in 3.6+, which is ESM-only with new import paths and would break jayson |
| sprintf-js 1.0.3 | moderate (DoS) | eslint, lhci, shadcn, subql | No patched release |
| elliptic 6.6.1 | low (risky crypto primitive) | wallets-kit, @subql/cli |
No patched release |
| cookie 0.4.2 | low | @lhci/cli → lighthouse → @sentry/node |
A global override would break msw/express, which need 1.x/0.7 |
Runtime exposure: only stream-json and elliptic sit under the shipped web bundle (via the wallet kit), and only if the Hot Wallet / Solana path is loaded. Everything else is dev or CI tooling.
Acceptance criteria
- Re-audit monthly; bump when upstream fixes ship
- Evaluate whether the Hot Wallet module (which pulls in
@solana/web3.js) can be excluded fromstellar-wallets-kit - Consider replacing
@lhci/clior running it in an isolated CI job (source of most leftovers) - Add
bun audit --audit-level=highto CI once clean
Found during the repository security audit. Related branch: fix/security-audit-remediation (commit 3ac9db5). Contributors: see AGENTS.md / CONTRIBUTING.md; the full commit gate must pass, with no eslint-disable, .skip, or lowered thresholds.
Activity
Mikey-222 commentedon Oct 16, 2026
@Mikey-222 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Mikey-222 to this issue.
drips-wave commentedon Oct 16, 2026
Congratulations, @Mikey-222! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @Mikey-222: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
grantfox-oss commentedon Oct 17, 2026
🎉 This issue has been marked as completed on GrantFox!
@Mikey-222's PR #989 was approved and merged by @IbrahimIjai.
🏆 @Mikey-222: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,139 total points). Track your full progress on GrantFox.
👏 Great work, @Mikey-222! Keep contributing to SO4-Markets.
drips-wave commentedon Oct 17, 2026
This issue has been completed by @Mikey-222 as part of the Stellar Wave Program's 10th Wave 🥳
😎 @Mikey-222: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.