Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: resolve audit vulnerabilities #322

Merged
merged 3 commits into from
Aug 17, 2023
Merged

chore: resolve audit vulnerabilities #322

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
88ab81f
fix audit
brtkx Aug 17, 2023
5c552f8
Update audit-ci.jsonc
brtkx Aug 17, 2023
5971c17
comments
brtkx Aug 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion audit-ci.jsonc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,10 @@
// Nodejs ‘undici’ Vulnerable to CRLF
// Used only in hardhat, so only in dev. Even then we dont use remote requests.
"GHSA-5r9g-qh6m-jxff",
// https://github.com/advisories/GHSA-j8xg-fqg3-53r7
// word-wrap vulnerable to Regular Expression Denial of Service
// Used only in eslint, so only in dev.
"GHSA-j8xg-fqg3-53r7",

// Open Zepplin
////////////
Expand Down Expand Up @@ -102,6 +106,13 @@
// from: @arbitrum/nitro-contracts>hardhat>semver
// from: arb-bridge-peripherals>arb-bridge-eth>hardhat>semver
// Used only in dev.
"GHSA-c2qf-rxjj-qqgw"
"GHSA-c2qf-rxjj-qqgw",
// https://github.com/advisories/GHSA-g4vp-m682-qqmp
// contracts using ERC2771Context along with a custom trusted forwarder may see
// _msgSender return address(0) in calls that originate from the forwarder with calldata shorter than 20 bytes
// from: @arbitrum/nitro-contracts>@openzeppelin/contracts-upgradeable
// from @arbitrum/nitro-contracts>@openzeppelin/contracts
//
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

need some brief explanation why it's safe to ignore

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we are not affected (not using that particular contract) and also it does not affect the sdk anyway

brtkx marked this conversation as resolved.
Show resolved Hide resolved
"GHSA-g4vp-m682-qqmp"
]
}