Merge pull request #28 from hippo-protocol/copilot/update-security-dependencies

Resolve high and moderate severity vulnerabilities in dependencies

Author: ChrisCho-H

lib/wallet/UniClient.ts

@@ -12,12 +12,12 @@ import {
 } from './Wallet';
 import { post } from '../utils/http';
 import { BroadcastMode, Transaction, TxResponse } from '../utils/type';
-import { wasmTypes } from '@cosmjs/cosmwasm-stargate/build/modules';
+import { wasmTypes } from '@cosmjs/cosmwasm';
 import {
     makeAuthInfoBytes,
     makeSignDoc,
     TxBodyEncodeObject,
-} from '@cosmjs/proto-signing/build';
+} from '@cosmjs/proto-signing';
 import { Any } from 'cosmjs-types/google/protobuf/any';
 
 export function isEthermint(chainId: string) {

lib/wallet/wallets/OKXWallet.ts

@@ -1,7 +1,7 @@
 import { fromBase64, fromHex } from '@cosmjs/encoding';
 import { makeAuthInfoBytes, makeSignBytes, makeSignDoc, Registry, TxBodyEncodeObject } from '@cosmjs/proto-signing';
 
-import { serializeSignDoc } from '@cosmjs/amino/build/signdoc';
+import { serializeSignDoc } from '@cosmjs/amino';
 
 import { AbstractWallet, Account, IChain, WalletArgument, WalletName } from '../Wallet';
 import { Transaction } from '../../utils/type';

lib/wallet/wallets/UnisatWallet.ts

@@ -12,7 +12,7 @@ import { makeSignDoc as makeSignDocAmino } from '@cosmjs/amino';
 import { createWasmAminoConverters } from '@cosmjs/cosmwasm-stargate';
 import { Buffer } from 'buffer';
 
-import { serializeSignDoc } from '@cosmjs/amino/build/signdoc';
+import { serializeSignDoc } from '@cosmjs/amino';
 
 export class UnisatWallet implements AbstractWallet {
   name: WalletName.Unisat = WalletName.Unisat;

package-lock.json

@@ -32,22 +32,22 @@
         "trypublish": "npm publish || true"
     },
     "dependencies": {
-        "@cosmjs/amino": "^0.36.0",
-        "@cosmjs/cosmwasm-stargate": "^0.36.0",
-        "@cosmjs/ledger-amino": "^0.36.0",
-        "@cosmjs/proto-signing": "^0.36.0",
-        "@cosmjs/stargate": "^0.36.0",
+        "@cosmjs/amino": "^0.38.1",
+        "@cosmjs/cosmwasm-stargate": "^0.38.1",
+        "@cosmjs/ledger-amino": "^0.38.1",
+        "@cosmjs/proto-signing": "^0.38.1",
+        "@cosmjs/stargate": "^0.38.1",
         "@ethersproject/hash": "5.8.0",
         "@ethersproject/signing-key": "5.8.0",
         "@leapwallet/cosmos-snap-provider": "^0.1.26",
         "@ledgerhq/hw-transport-web-ble": "^6.29.8",
         "@ledgerhq/hw-transport-webusb": "^6.29.8",
-        "@metamask/eth-sig-util": "^5.1.0",
+        "@metamask/eth-sig-util": "^8.2.0",
+        "@noble/curves": "^2.0.1",
         "@ping-pub/chain-registry-client": "^0.0.25",
         "@tharsis/eip712": "^0.2.4",
         "@tharsis/proto": "^0.1.20",
         "@tharsis/transactions": "^0.2.6",
-        "@types/bignumber.js": "^5.0.0",
         "@types/lodash": "^4.17.19",
         "buffer": "^6.0.3",
         "chain-registry": "^2.0.24",
@@ -57,7 +57,7 @@
         "dayjs": "^1.11.7",
         "fflate": "^0.8.0",
         "lodash": "^4.17.21",
-        "osmojs": "^15.5.0",
+        "osmojs": "^16.15.0",
         "vue": "^3.2.47",
         "vue3-webcomponent-wrapper": "^0.2.0"
     },
@@ -67,21 +67,36 @@
         "@noble/secp256k1": "^2.1.0",
         "@rollup/plugin-inject": "^5.0.3",
         "@types/elliptic": "^6.4.18",
-        "@vitejs/plugin-vue": "^4.1.0",
+        "@vitejs/plugin-vue": "^5.2.1",
         "assert-browserify": "^2.0.0",
         "autoprefixer": "^10.4.14",
         "crypto-browserify": "^3.12.1",
-        "elliptic": "^6.5.5",
+        "elliptic": "^6.6.1",
         "long": "^5.2.0",
         "path-browserify": "^1.0.1",
         "postcss": "^8.4.23",
         "rollup-plugin-polyfill-node": "^0.12.0",
         "stream-browserify": "^3.0.0",
         "tailwindcss": "^3.3.2",
         "typescript": "^5.0.2",
-        "vite": "^4.3.2",
+        "vite": "^5.4.16",
         "vite-plugin-css-injected-by-js": "^3.1.0",
-        "vue-tsc": "^1.4.2"
+        "vue-tsc": "^2.2.1"
+    },
+    "resolutions": {
+        "esbuild": "^0.27.3",
+        "minimatch": "^10.2.2",
+        "axios": "^1.13.5",
+        "bn.js": "^5.2.3",
+        "glob": "^11.0.0",
+        "elliptic": "^6.6.1"
+    },
+    "overrides": {
+        "esbuild": "^0.27.3",
+        "minimatch": "^10.2.2",
+        "axios": "^1.13.5",
+        "bn.js": "^5.2.3",
+        "elliptic": "^6.6.1"
     },
     "packageManager": "yarn@1.22.1"
 }

package.json

@@ -17,6 +17,7 @@ export default defineConfig({
             stream: 'stream-browserify',
             crypto: 'crypto-browserify',
             assert: 'assert-browserify',
+            '@noble/curves/secp256k1': '@noble/curves/secp256k1.js'
         },
     },
     optimizeDeps: {