Skip to content

Commit 5d25b01

Browse files
authored
[Security] Resolve Vulnerabilities - Attempt 2 (#88)
Resolves security vulnerabilities: https://github.com/BitteProtocol/make-agent/security/dependabot The previous attempt #65 did nothing. I kept digging and found this solution works (at least locally) ## Test Plan ```sh pnpm i && pnpm audit ``` Before removing localtunnel, the audit report with just the overrides showed `axios` (`>=0.8.1 <0.28.0`). So then ``` $ pnpm why axios Legend: production dependency, optional only, dev only [email protected] /Users/bh2smith/Projects/mintbase/ai/make-agent dependencies: localtunnel 2.0.2 └── axios 0.21.4 ``` Removing local tunnel (no longer used) removed these issues!
1 parent 238de74 commit 5d25b01

File tree

2 files changed

+16
-135
lines changed

2 files changed

+16
-135
lines changed

package.json

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,15 +46,13 @@
4646
"inquirer": "^12.0.0",
4747
"is-port-reachable": "^4.0.0",
4848
"js-sha256": "^0.11.0",
49-
"localtunnel": "^2.0.2",
5049
"near-api-js": "^5.0.1",
5150
"open": "^10.1.0"
5251
},
5352
"devDependencies": {
5453
"@eslint/js": "^9.19.0",
5554
"@types/express": "^5.0.0",
5655
"@types/inquirer": "^9.0.7",
57-
"@types/localtunnel": "^2.0.4",
5856
"@types/node": "^22.7.2",
5957
"@typescript-eslint/eslint-plugin": "^8.15.0",
6058
"@typescript-eslint/parser": "^8.23.0",
@@ -67,8 +65,11 @@
6765
"typescript": "^5.7.3",
6866
"vitest": "^3.0.5"
6967
},
70-
"overrides": {
71-
"secp256k1": ">=5.0.1",
72-
"elliptic": ">=6.6.0"
68+
"pnpm": {
69+
"overrides": {
70+
"secp256k1": "^5.0.1",
71+
"elliptic": "^6.6.0",
72+
"crypto-js": "^4.2.0"
73+
}
7374
}
7475
}

pnpm-lock.yaml

Lines changed: 10 additions & 130 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)