diff --git a/.changeset/fix-global-wallet-axios-override.md b/.changeset/fix-global-wallet-axios-override.md new file mode 100644 index 00000000..e19b1c0d --- /dev/null +++ b/.changeset/fix-global-wallet-axios-override.md @@ -0,0 +1,18 @@ +--- +'@sei-js/sei-global-wallet': patch +--- + +Raise the documented `axios` override to `1.20.0` to clear the Axios advisories published on 2026-09-30. + +Twelve advisories published that day cover every Axios release below `1.20.0`, including the `1.18.0` the [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks pinned, so the nightly consumer run went red without any change in this repository. The wallet-only npm consumer, which is held to a strictly clean audit, reported nine findings: `axios` itself and the eight Dynamic packages above it in the dependency chain. + +Every one of them is patched in `1.20.0` and still open in `1.19.0`: + +- High: `GHSA-3pq3-5fj3-cg6v`, `GHSA-542g-h47m-68v8`, `GHSA-c29m-xwm3-cm6r`, `GHSA-m8m8-qj5v-23w3`, `GHSA-mghh-pgcx-3jjj`, `GHSA-r4gj-5m52-g5wh`, `GHSA-x97p-jq2g-jp4f`. +- Medium: `GHSA-44g4-m2mj-wpvx`, `GHSA-4hqw-qxg8-jxx2`, `GHSA-9fr6-4gfg-395g`, `GHSA-j8rh-479h-cp32`, `GHSA-vh66-26gq-q6x8`. + +Dynamic still pins `axios@1.16.0` exactly, so the correction stays a root override. All three blocks now carry `"axios": "1.20.0"`, the first release outside every advisory reported against that pin. It ships the same exports and dependencies as `1.18.0`, apart from raising the `form-data` floor to `^4.0.6`. + +The README's Axios note described only the Node HTTP adapter issue that `1.18.0` cleared. It now covers the current set: the high-severity issues are in Node-only transports or are prototype-pollution gadgets, and the `toFormData` and fetch-adapter gadgets also apply in browsers. + +No published dependency or peer range changes. diff --git a/bun.lock b/bun.lock index 68c9a6be..8776cfab 100644 --- a/bun.lock +++ b/bun.lock @@ -114,7 +114,7 @@ }, }, "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "uuid": "11.1.1", }, "packages": { @@ -528,7 +528,7 @@ "available-typed-arrays": ["available-typed-arrays@1.0.7", "", { "dependencies": { "possible-typed-array-names": "^1.0.0" } }, "sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ=="], - "axios": ["axios@1.18.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.5", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw=="], + "axios": ["axios@1.20.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg=="], "base-x": ["base-x@3.0.11", "", { "dependencies": { "safe-buffer": "^5.0.1" } }, "sha512-xz7wQ8xDhdyP7tQxwdteLYeFfS68tSMNCZ/Y37WJ4bhGfKPpqEIlmIyueQHqOyoPhE6xNUqjzRr8ra0eF9VRvA=="], diff --git a/package.json b/package.json index b44c0b48..44ff4233 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ "packages/*" ], "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "uuid": "11.1.1" }, "scripts": { diff --git a/packages/sei-global-wallet/README.md b/packages/sei-global-wallet/README.md index b03582c3..c689528b 100644 --- a/packages/sei-global-wallet/README.md +++ b/packages/sei-global-wallet/README.md @@ -25,7 +25,7 @@ Complete npm root overrides when the optional AA path is not enabled: ```json { "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "sharp": "0.35.4", "uuid": "11.1.1", "viem": { @@ -39,7 +39,7 @@ Complete Bun root overrides. The block is the same with or without the optional ```json { "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "sharp": "0.35.4", "uuid": "11.1.1" } @@ -48,7 +48,7 @@ Complete Bun root overrides. The block is the same with or without the optional The Axios, Sharp, and UUID overrides are temporary until Dynamic updates its exact transitive pins: -- The high-severity Axios issue is in the Node HTTP adapter and requires a prerequisite prototype-pollution/interceptor pattern. Browser wallet paths do not use that adapter, which reduces exploitability but does not make the vulnerable install acceptable. +- Dynamic pins `axios@1.16.0` exactly, and `1.20.0` is the first release outside every advisory reported against it. The high-severity Axios issues are in Node-only transports (the HTTP adapter, opt-in HTTP/2, and `NO_PROXY` handling) or are prototype-pollution gadgets that need a separate pollution primitive in the same process. Browser wallet paths do not use the Node transports, which reduces exploitability but does not make the vulnerable install acceptable; the `toFormData` and fetch-adapter gadgets apply in browsers too. - The high-severity Sharp issue is the bundled libheif heap overflow reported as `GHSA-rgj7-g3m4-5g8c`, reached through `@dynamic-labs/iconic`'s exact `sharp@0.35.0` pin. It is only triggered by decoding untrusted HEIF input, which no wallet path does, and `sharp` is a build-time image dependency that never reaches a browser bundle. The override is a patch-level move within `0.35.x`, so it carries no API change. - The UUID issue affects the v3, v5, and v6 buffer APIs. Dynamic's observed call sites use UUID v4, which reduces exploitability but does not clear the audit finding. @@ -56,7 +56,7 @@ Applications using the optional `./zerodev` / Dynamic account-abstraction path m ```json { "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "ethjs-unit": { "bn.js": "4.12.5" }, diff --git a/scripts/check-sei-global-wallet.ts b/scripts/check-sei-global-wallet.ts index 13d1cf7d..d2933bf2 100644 --- a/scripts/check-sei-global-wallet.ts +++ b/scripts/check-sei-global-wallet.ts @@ -166,7 +166,7 @@ const assertTestedPeersFitPublishedRanges = (testedPeerVersions: TestedPeerVersi // Flat by necessity: Bun cannot nest overrides, so every entry here has to be // safe to apply globally. const baseSafeOverrides = { - axios: '1.18.0', + axios: '1.20.0', sharp: '0.35.4', uuid: '11.1.1' };