Skip to content

chore: update dependencies and remove unused config files #559

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jleni merged 1 commit into from
Jul 28, 2025
Merged

chore: update dependencies and remove unused config files #559

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions .eslintignore
View file
Open in desktop

This file was deleted.

1 change: 0 additions & 1 deletion .nvmrc
View file
Open in desktop

This file was deleted.

894 changes: 0 additions & 894 deletions .yarn/releases/yarn-4.3.1.cjs
View file
Open in desktop

This file was deleted.

8 changes: 4 additions & 4 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,8 @@
"dependencies": {
"@grpc/grpc-js": "^1.13.4",
"@grpc/proto-loader": "^0.7.15",
"@ledgerhq/hw-transport-http": "^6.30.7",
"axios": "^1.10.0",
"@ledgerhq/hw-transport-http": "^6.30.8",
"axios": "^1.11.0",
"axios-retry": "^4.5.0",
Comment on lines +44 to 46

@coderabbitai coderabbitai Bot Jul 28, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Double-check for breaking changes & security advisories in newly-bumped runtime deps

The bumps stay within the same major versions, so breaking-changes risk is low, but both @ledgerhq/hw-transport-http and axios have a history of shipping minor-version breaking changes and security patches.
Please run the full test-suite and scan the new versions for known CVEs before releasing.

Example commands:

🏁 Script executed:

# audit axios & ledger transport
pnpm audit --prod
# run tests to surface runtime regressions
pnpm test

Length of output: 1742

High-Severity Vulnerability in axios via @ledgerhq/hw-transport-http – Upgrade Required

Our pnpm audit --prod surfaced a critical issue (GHSA-jr5f-v2jv-69x6):
The version of axios pulled in by @ledgerhq/hw-transport-http (<1.8.2) is vulnerable to SSRF and credential leakage. Although your top-level axios (^1.11.0) is already patched, the indirect dependency remains at risk.

Please address this by:

  • Bumping @ledgerhq/hw-transport-http to a release that depends on axios ≥1.8.2 (e.g. upgrade to the latest 6.x patch), or adding a package resolution to force axios ≥1.8.2.
  • Running: 
    pnpm install
pnpm audit --prod   # should report 0 vulnerabilities
pnpm test            # ensure all specs pass locally
  • Confirming no breaking changes have been introduced by reviewing changelogs and executing your full test suite.

Lines to update in package.json (approx. 44–46):

- "@ledgerhq/hw-transport-http": "^6.30.8",
+ "@ledgerhq/hw-transport-http": "^6.31.0",  # or whichever 6.x+ release pins axios ≥1.8.2
🤖 Prompt for AI Agents 
In package.json around lines 44 to 46, the dependency
@ledgerhq/hw-transport-http uses a vulnerable axios version below 1.8.2. To fix
this, upgrade @ledgerhq/hw-transport-http to the latest 6.x patch version that
depends on axios 1.8.2 or higher. After updating, run pnpm install, then pnpm
audit --prod to verify no vulnerabilities remain, and finally run pnpm test to
ensure no breaking changes affect the codebase.

"dockerode": "^4.0.7",
"elfy": "^1.0.0",
Expand All @@ -53,10 +53,10 @@
},
"devDependencies": {
"@biomejs/biome": "^2.1.2",
"@ledgerhq/hw-transport": "^6.31.7",
"@ledgerhq/hw-transport": "^6.31.8",
"@types/dockerode": "^3.3.42",
"@types/fs-extra": "^11.0.4",
"@types/node": "^24.0.15",
"@types/node": "^24.1.0",
"@types/pngjs": "^6.0.5",
Comment on lines +56 to 60

@coderabbitai coderabbitai Bot Jul 28, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

@types/node@24.x does not match the declared Node >= 22 engine

@types/node follows Node’s even-number LTS cadence; 24.x targets an upcoming Node v24 release, while the project explicitly supports Node >= 22.
Mixing the two can provoke false typings or missing APIs at compile-time.

If you only intend to support Node 22, pin to @types/node@22.x instead:

-    "@types/node": "^24.1.0",
+    "@types/node": "^22.0.0",

Otherwise, update the "engines.node" field and CI matrix accordingly.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"@ledgerhq/hw-transport": "^6.31.8",
"@types/dockerode": "^3.3.42",
"@types/fs-extra": "^11.0.4",
"@types/node": "^24.0.15",
"@types/node": "^24.1.0",
"@types/pngjs": "^6.0.5",
"@ledgerhq/hw-transport": "^6.31.8",
"@types/dockerode": "^3.3.42",
"@types/fs-extra": "^11.0.4",
- "@types/node": "^24.1.0",
+ "@types/node": "^22.0.0",
"@types/pngjs": "^6.0.5",
🤖 Prompt for AI Agents 
In package.json around lines 56 to 60, the version of @types/node is set to
24.x, which does not align with the declared Node engine version >= 22. To fix
this, either change the @types/node version to 22.x to match the supported Node
version or update the "engines.node" field and the CI configuration to support
Node 24. Choose one approach to ensure consistency between the Node engine
version and the @types/node typings.

"@types/randomstring": "^1.3.0",
"@zondax/ledger-substrate": "^1.1.2",
Expand Down
125 changes: 64 additions & 61 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.