fix(js-legacy): Removes transitive dependency on bigint-buffer

Replaces the use of @solana/buffer-layout-utils, which depends on the
unmaintained bigint-buffer package vulnerable to CVE-2025-3194, with
@solana/codecs backed Layout implementation.

Author: dhl

clients/js-legacy/README.md

@@ -72,9 +72,9 @@ cd clients/js-legacy
 pnpm install
 pnpm run build
 ```
-
-6. Run the tests:
+6. Run the tests (start the local test validator first):
 ```shell
+../../scripts/restart-test-validator.sh
 pnpm run test
 ```
 

clients/js-legacy/package.json

@@ -54,13 +54,15 @@
     },
     "dependencies": {
         "@solana/buffer-layout": "^4.0.0",
-        "@solana/buffer-layout-utils": "^0.3.0",
+        "@solana/codecs-core": "5.1.0",
+        "@solana/codecs-data-structures": "5.1.0",
+        "@solana/codecs-numbers": "5.1.0",
         "@solana/spl-token-group": "^0.0.7",
         "@solana/spl-token-metadata": "^0.1.6",
         "buffer": "^6.0.3"
     },
     "devDependencies": {
-        "@solana/codecs-strings": "5.0.0",
+        "@solana/codecs-strings": "5.1.0",
         "@solana/prettier-config-solana": "0.0.5",
         "@solana/spl-memo": "0.2.5",
         "@solana/web3.js": "^1.95.5",

clients/js-legacy/pnpm-lock.yaml

@@ -1,4 +1,4 @@
-import { u64 } from '@solana/buffer-layout-utils';
+import { u64 } from '../serialization.js';
 import type { Connection, PublicKey, Signer, TransactionError } from '@solana/web3.js';
 import { Transaction } from '@solana/web3.js';
 import { TOKEN_PROGRAM_ID } from '../constants.js';

clients/js-legacy/src/actions/uiAmountToAmount.ts

@@ -1,5 +1,5 @@
 import { struct } from '@solana/buffer-layout';
-import { bool } from '@solana/buffer-layout-utils';
+import { bool } from '../../serialization.js';
 import type { Account } from '../../state/account.js';
 import { ExtensionType, getExtensionData } from '../extensionType.js';
 

clients/js-legacy/src/extensions/cpiGuard/state.ts

@@ -1,5 +1,5 @@
 import { struct, u8 } from '@solana/buffer-layout';
-import { publicKey } from '@solana/buffer-layout-utils';
+import { publicKey } from '../../serialization.js';
 import type { Signer } from '@solana/web3.js';
 import { PublicKey, TransactionInstruction } from '@solana/web3.js';
 import { TOKEN_2022_PROGRAM_ID, programSupportsExtensions } from '../../constants.js';

clients/js-legacy/src/extensions/groupMemberPointer/instructions.ts

@@ -1,5 +1,5 @@
 import { struct } from '@solana/buffer-layout';
-import { publicKey } from '@solana/buffer-layout-utils';
+import { publicKey } from '../../serialization.js';
 import { PublicKey } from '@solana/web3.js';
 import type { Mint } from '../../state/mint.js';
 import { ExtensionType, getExtensionData } from '../extensionType.js';

clients/js-legacy/src/extensions/groupMemberPointer/state.ts

@@ -1,5 +1,5 @@
 import { struct, u8 } from '@solana/buffer-layout';
-import { publicKey } from '@solana/buffer-layout-utils';
+import { publicKey } from '../../serialization.js';
 import type { Signer } from '@solana/web3.js';
 import { PublicKey, TransactionInstruction } from '@solana/web3.js';
 import { TOKEN_2022_PROGRAM_ID, programSupportsExtensions } from '../../constants.js';

clients/js-legacy/src/extensions/groupPointer/instructions.ts

@@ -1,5 +1,5 @@
 import { struct } from '@solana/buffer-layout';
-import { publicKey } from '@solana/buffer-layout-utils';
+import { publicKey } from '../../serialization.js';
 import { PublicKey } from '@solana/web3.js';
 import type { Mint } from '../../state/mint.js';
 import { ExtensionType, getExtensionData } from '../extensionType.js';

clients/js-legacy/src/extensions/groupPointer/state.ts

@@ -1,5 +1,5 @@
 import { s16, struct, u8 } from '@solana/buffer-layout';
-import { publicKey } from '@solana/buffer-layout-utils';
+import { publicKey } from '../../serialization.js';
 import type { PublicKey, Signer } from '@solana/web3.js';
 import { TransactionInstruction } from '@solana/web3.js';
 import { TOKEN_2022_PROGRAM_ID } from '../../constants.js';