[Snyk] Fix for 1 vulnerabilities

[bkawk]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	828/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.7	Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-8187303	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: eth-crypto

The new version differs by 161 commits.

• 30742d0 2.2.0
• 5a3f6d8 Merge pull request #548 from yhuard/master
• a2458d1 Pin dependencies version
• f2d6079 Update dependency karma to v6.3.13
• 5eb1f54 Improve built code
• a6e4463 Update example
• 86d3199 Update @ ethereumjs/tx and ethereumjs-util
• 5c5ff9c Remove eth-lib dependency
• 612c219 Update dependency ethers to v5.5.4
• db3d19e Update dependency karma to v6.3.12
• c28de12 Update dependency webpack-cli to v4.9.2
• 87b9076 Update dependency mocha to v9.2.0
• b15161d Update dependency @ babel/core to v7.16.12
• 922caff Update dependency typescript to v4.5.5
• d5f450e Update dependency @ babel/preset-env to v7.16.11
• 55c327a Update babel monorepo to v7.16.10
• d42c97a Update dependency web3 to v1.7.0
• efdbe09 Update dependency mocha to v9.1.4
• 08d8858 Update dependency karma to v6.3.11
• e85f627 Update babel monorepo to v7.16.8
• 6a81785 Update dependency secp256k1 to v4.0.3
• d73e7f5 Update dependency karma to v6.3.10
• 7ec662e Update dependency ethers to v5.5.3
• ecc2aa7 Update dependency concurrently to v7

See the full diff

Package name: ethereumjs-tx

The new version differs by 250 commits.

• a8da65a Merge pull request #190 from ethereumjs/update-common-and-new-release
• 6f8f14a Bumped version to v2.1.2, added CHANGELOG entry, updated README
• 3da414e Updated ethereumjs-common to v1.5.0 (MuirGlacier support)
• ba4ef9a Merge pull request #188 from ryanio/fixTests
• 0b0606e fix test runner by putting tx rlp toBuffer call in try catch block to catch malformed data error
• 2df0cf3 Merge pull request #187 from ethereumjs/runActionsOnPR
• 5642c73 run gh actions on pr
• 0892118 Merge pull request #186 from ethereumjs/github-actions
• 8bf127f use firefox headless
• 3363b72 Merge branch 'master' into github-actions
• 5ffc8ad Merge pull request #185 from ryanio/fixTestUtil
• 3c1dd20 fix lint
• 3f22980 fix failing test
• 8264d53 add github actions
• f4cd11f Merge pull request #173 from ethereumjs/new-release-v211
• 8880d6b Bumped version to v2.1.1, added CHANGELOG and README entry
• ad75b65 Merge pull request #171 from ethereumjs/istanbul/eip-2028
• acce166 Merge branch 'master' into istanbul/eip-2028
• b7c782a Merge pull request #172 from ethereumjs/travis-xvfb
• 0b43165 Fix travis xvfb service
• e0fe03d Add support for EIP-2028 for Istanbul
• 9a6324f Merge pull request #168 from ethereumjs/new-release-2.1.0
• c33ff1f Add pacakge-lock.json to .gitignore
• 1f61d33 Remove package-lock.json

See the full diff

Package name: ipfs

The new version differs by 250 commits.

• bf1bc8b chore: release master (#4364)
• 7b79c1b fix: add deprecation notice to readmes (#4362)
• 410725b chore: disable dependabot.yml (#4363)
• b64d4af docs: update README.md (#4307)
• 3bcabe3 chore: fix link to ci results (#4299)
• ab02e8f docs: update readmes to fix ci badges (#4296)
• c5e76b7 update-ipfs-http-client (#4293)
• 6eeb1be deps(dev): update interop, ipfsd-ctl and kubo-rpc-client (#4294)
• 6e94067 chore: release master (#4252)
• d1c3abb deps: update libp2p to 0.42.x (#4288)
• 0cfcaf6 fix: allow reading rawLeaves in MFS (#4282)
• fa578ba fix: disallow publishing pubsub messages to zero peers (#4286)
• 789ee58 deps: update dag-jose to 4.0.0 (#4289)
• 4b4c124 deps: update ipfs-utils for node 18 compatibility (#4287)
• 5f73eca chore: do not double-build interface tests
• 1916ca8 chore: interface tests should run after build
• 115a405 fix: fix publish step
• 6d90cbf fix: use aegir to publish RCs (#4284)
• 2a6fede fix: update lerna config for rc publishing (#4283)
• e85e5b6 deps: update @ chainsafe/libp2p-gossipsub to 6.0.0 (#4280)
• 563806f fix: restore lerna for preleases (#4281)
• 521c84a fix!: update multiformats to v11.x.x and related depenendcies (#4277)
• 6be5906 fix: mfs blob import for files larger than 262144b (#4251)
• b722041 docs: DisableNatPortMap should be true to disable port mapping (#4244)

See the full diff

Package name: keythereum

The new version differs by 64 commits.

• 50d5d54 Merge pull request #94 from ethereumjs/new-release
• 00dc88b Bumped version to v2.0.0, added CHANGELOG entry
• 9869955 Merge pull request #93 from paulmillr/master
• 36aed98 Update dependencies
• 3a80253 Merge pull request [Snyk] Security upgrade ipfs from 0.30.1 to 0.66.1 #82 from ethereumjs/add-changelog
• a9f51ab Added CHANGELOG file
• fd59e27 Bumped version
• 5c3ee93 Merge pull request [Snyk] Security upgrade web3 from 1.0.0-beta.29 to 4.13.0 #81 from ethereumjs/upgrade-crypto-deps
• 2f93a76 upgrade browserify, upgrade uglifyjs to terser
• d55dbd8 update node versions
• 337ade9 format to buffer for keccak
• 540e511 lint
• 6a1178c upgrade secp256k1 dependency
• 4866cca upgrade keccak dependency
• e5d632f use scrypt-js
• 6de4676 Merge pull request [Snyk] Security upgrade ipfs from 0.30.1 to 0.66.1 #72 from whymarrh/remove-lockfile
• f4a0ade Merge pull request [Snyk] Security upgrade ipfs from 0.30.1 to 0.51.0 #70 from whymarrh/travis-config
• 7819dfb Merge pull request [Snyk] Fix for 1 vulnerabilities #69 from whymarrh/fix-jsdoc
• bbc8149 Remove package-lock.json file
• 3767117 travis: Remove sudo: false config
• 16389a4 Add missing JSDoc params
• 428d501 Fix naming of incorrect JSDoc params
• 9e7f7c4 Fix casing of Buffer type in JSDoc
• 4fc9842 Merge pull request [Snyk] Fix for 2 vulnerabilities #65 from ethereumjs/tinybike/bump-dev-dependency-versions

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.