[Wave 10] Clear critical runtime advisories from SDK examples and workspaces #239

Activity

1. truthixify

   added

   Stellar WaveIssues in the Stellar wave programIssues in the Stellar wave program

   on Oct 12, 2026
2. playmaker410 commented on Oct 15, 2026

   

   playmaker410

   on Oct 15, 2026 – with Drips Wave

   More actions

   @playmaker410 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   I would love to take this on. I have hands on experience with Rust, Soroban, Cairo, and TypeScript, and I’m confident I can deliver a solid solution within 24 hours.

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @playmaker410 to this issue.
3. carelessdept commented on Oct 17, 2026

   

   carelessdept

   on Oct 17, 2026 – with Drips Wave

   Contributor

   More actions

   @carelessdept has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   I just resolved #238 (merged in PR #252) and have the full pnpm@10.34.4 workspace set up locally. To resolve #239, I will:

   1. Audit and upgrade vulnerable dependency paths across the root SDK, workspace packages, and the Next.js, Solid, and React Native examples (pnpm-lock.yaml overrides and direct dependency bumps where patched releases exist).
   2. Separate published SDK production audit checks from example-only workspace audits in package.json scripts.
   3. Add a blocking CI audit policy in .github/workflows that fails on unapproved critical advisories while verifying all workspace builds and test suites pass.

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @carelessdept to this issue.
4. beulah7717108-eng commented on Oct 17, 2026

   

   beulah7717108-eng

   on Oct 17, 2026 – with Drips Wave

   Contributor

   More actions

   @beulah7717108-eng has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   Hello maintainer,

   I am a professional full-stack developer, I would like to work on issue #239 [Wave 10] Clear critical runtime advisories from SDK examples and workspaces for wraith-protocol/sdk.

   Proposed Plan
   Dependency Audit & Remediation: Review the production audit report, identifying vulnerable dependency paths across the Next.js, Solid, and React Native examples as well as core workspaces, and upgrade or replace them with patched versions where available.

   Advisory Separation: Isolate example-only vulnerabilities from the core published SDK report to maintain accurate security posture visibility for production consumers.

   CI Policy Enforcement: Implement a strict CI policy gate (using tools like npm audit, pnpm audit, or automated security scanning) that automatically fails builds on unapproved critical security findings.

   Verification & Testing: Run full workspace dependency checks and test suites to ensure no breaking changes were introduced during dependency upgrades.

   Please kindly assign

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @beulah7717108-eng to this issue.
5. truthixify

   assigned

   beulah7717108-eng

   on Oct 17, 2026
6. drips-wave commented on Oct 17, 2026

   

   drips-waveBot

   on Oct 17, 2026 – with Drips Wave

   More actions

   Congratulations, @beulah7717108-eng! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

   🧑‍💻 @beulah7717108-eng: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

   Warning

   When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

   🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

   🌊 Happy Wave 🌊
7. truthixify

   added a commit that references this issue on Oct 19, 2026

   fix: clear critical vitest advisory and add security audit gate (#264)

   ...

   This issue will close once commit 7de4740 is merged into the 'develop' branch.

   7de4740
8. truthixify

   closed this as completedin #264on Oct 19, 2026
9. drips-wave commented on Oct 19, 2026

   

   drips-waveBot

   on Oct 19, 2026 – with Drips Wave

   More actions

   This issue has been completed by @beulah7717108-eng as part of the Stellar Wave Program's 10th Wave 🥳

   😎 @beulah7717108-eng: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

   🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.