chore: update tier 1 npm dependencies and fix vulnerabilities by TheLastCicada · Pull Request #1554 · Chia-Network/cadt

TheLastCicada · 2026-03-26T19:59:15Z

Summary

Update all semver-compatible npm dependencies to latest within their ^ range
Fix HIGH and MODERATE severity vulnerabilities via npm update, npm audit fix, and tar override update
All v1 (112 passing) and v2 (1364 passing) integration tests pass

Security Fixes

Package	Update	Severity	Vulnerability
express-rate-limit	8.2.1 → 8.3.1	HIGH	IPv4-mapped IPv6 rate-limit bypass
multer	2.0.2 → 2.1.1	HIGH	3 DoS vulnerabilities
sequelize	6.37.7 → 6.37.8	HIGH	SQL injection via JSON column cast
tar (override)	7.5.7 → 7.5.13	HIGH	3 path traversal vulnerabilities
dottie	transitive fix	MODERATE	Prototype pollution bypass
flatted	transitive fix	HIGH	Unbounded recursion DoS + prototype pollution
socket.io-parser	transitive fix	HIGH	Unbounded binary attachments
picomatch	transitive fix	HIGH	ReDoS + method injection

Non-Security Updates

dotenv, mysql2, log-update, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @eslint/eslintrc, @eslint/js, eslint (patch), globals, sinon, babel-plugin-module-resolver

Remaining Vulnerabilities (Tier 2/3 — separate PRs)

The following require major version bumps and are out of scope for this PR:

sqlite3 5→6 (deprecated package, binary build path changes)
uuid 10→13 (CJS support dropped, ~15 .cjs files need refactoring)
eslint 9→10 (new recommended rules, config lookup changes)
serialize-javascript (mocha transitive, no fix without mocha downgrade)

Test Plan

npm run test:v1 — 112 passing
npm run test:v2 — 1364 passing
CI passes on GitHub Actions

Dependabot PRs Superseded

This PR covers the changes from: #1503, #1508, #1509, #1518, #1522, #1524, #1528, #1530, #1540, #1545, #1552

Note

Medium Risk
Primarily dependency and CI workflow updates; moderate risk due to multiple runtime library bumps (e.g., multer, sequelize, express-rate-limit, tar) and changes to GitHub Actions artifact tooling that could affect builds/releases.

Overview
Updates tier-1 npm dependencies and lockfile to newer compatible versions, including security-related bumps (notably express-rate-limit, multer, sequelize) and a tar override to address reported vulnerabilities.

Refreshes CI workflows by upgrading actions/upload-artifact to v7 and actions/download-artifact to v8, and adjusts test Chia wallet config to add wallet.trusted_cidrs while disabling connections to unknown peers.

^{Written by Cursor Bugbot for commit 5ede4b9. This will update automatically on new commits. Configure here.}

Update all semver-compatible npm dependencies and fix HIGH/MODERATE severity vulnerabilities. Key security fixes: - express-rate-limit 8.2.1->8.3.1 (rate-limit bypass via IPv6) - multer 2.0.2->2.1.1 (3 DoS vulnerabilities) - sequelize 6.37.7->6.37.8 (SQL injection via JSON column cast) - tar override 7.5.7->7.5.13 (3 path traversal vulnerabilities) - dottie, flatted, socket.io-parser, picomatch (transitive fixes) Also updates: dotenv, mysql2, log-update, babel, commitlint, eslint (patch), globals, sinon, babel-plugin-module-resolver.

socket-security · 2026-03-26T19:59:37Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
@commitlint/cli@20.4.1 ⏵ 20.5.0			⁺¹
@babel/preset-env@7.29.0 ⏵ 7.29.2				^-1
babel-plugin-module-resolver@5.0.2 ⏵ 5.0.3	⁺¹		⁺¹
globals@17.3.0 ⏵ 17.4.0	⁺¹		⁺¹
log-update@7.1.0 ⏵ 7.2.0
eslint@9.39.2 ⏵ 9.39.4	⁺¹			^-1
sequelize@6.37.7 ⏵ 6.37.8		⁺¹⁶	⁺¹	^-1
dotenv@17.2.4 ⏵ 17.3.1
multer@2.0.2 ⏵ 2.1.1	⁺¹	⁺³¹	⁺¹
express-rate-limit@8.2.1 ⏵ 8.3.1	⁺¹	⁺¹⁶
@eslint/js@9.39.2 ⏵ 9.39.4
sinon@21.0.1 ⏵ 21.0.3	⁺³		⁺¹	⁺⁴
mysql2@3.17.0 ⏵ 3.20.0
@commitlint/config-conventional@20.4.1 ⏵ 20.5.0

View full report

socket-security · 2026-03-26T19:59:39Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: npm `caniuse-lite` under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/package.json) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) From: package-lock.json → `npm/@babel/core@7.29.0` → `npm/@babel/preset-env@7.29.2` → `npm/caniuse-lite@1.0.30001781` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001781`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `typescript` under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) License: MIT-Khronos-old - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) From: package-lock.json → `npm/@commitlint/cli@20.5.0` → `npm/typescript@6.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@6.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `@babel/helpers` is 100.0% likely to have a medium risk anomaly Notes: The code fragment is a standard Babel decorator runtime helper (applyDecs2203). Its security posture hinges on the trustworthiness of the supplied decorators. If decorators are from untrusted sources, they can execute arbitrary code during decoration or initialization. The library itself does not exhibit malicious behavior, but this pattern introduces a high-risk surface via external inputs. Recommended mitigations include validating decorator outputs, enforcing sandboxing or runner boundaries for decorators, and auditing decorator sources in the application. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/@babel/core@7.29.0` → `npm/@babel/helpers@7.29.2` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/helpers@7.29.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code is a straightforward build script to bundle and minify a specified package using Browserify and UglifyJS. The primary security concern is potential path manipulation: json.main is used to form a require path without validating that it stays within the target package directory. If a malicious or misconfigured package.json includes an absolute path or traversal outside the package, the script could bundle unintended files. Otherwise, the script does not perform network access, data exfiltration, or backdoor actions, and there is no hard-coded secrets or dynamic code execution beyond standard bundling/minification. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/eslint@9.39.4` → `npm/ajv@6.14.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@6.14.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code augments a meta-schema to permit remote dereferencing of keyword schemas via a hardcoded data.json resource. This introduces network dependency and potential changes to validation semantics at runtime. While not inherently malicious, the remote reference constitutes a notable security and reliability risk that should be mitigated with local fallbacks, input validation, and explicit remote-resource governance. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/eslint@9.39.4` → `npm/ajv@6.14.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@6.14.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code implements a standard AJV-like dynamic parser generator for JTD schemas. There are no explicit malware indicators in this fragment. The primary security concern is the dynamic code generation and execution from external schemas, which introduces a medium risk if schemas are untrusted. With trusted schemas and proper schema management, the risk is typically acceptable within this pattern. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/@commitlint/cli@20.5.0` → `npm/ajv@8.18.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@8.18.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: This module generates JavaScript code at runtime via standaloneCode(...) and then immediately executes it with require-from-string. Because the generated code can incorporate user-supplied schemas or custom keywords without sanitization or sandboxing, an attacker who controls those inputs could inject arbitrary code and achieve remote code execution in the Node process. Users should audit and lock down the standaloneCode output or replace dynamic evaluation with a safer, static bundling approach. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/@commitlint/cli@20.5.0` → `npm/ajv@8.18.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@8.18.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code implements standard timestamp validation with clear logic for normal and leap years and leap seconds. There is no network, file, or execution of external code within this isolated fragment. The only anomalous aspect is assigning a string to validTimestamp.code, which could enable external tooling to inject behavior in certain environments, but this does not constitute active malicious behavior in this isolated snippet. Overall, low to moderate security risk in typical usage; no malware detected within the shown code. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/@commitlint/cli@20.5.0` → `npm/ajv@8.18.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@8.18.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

…ates Add .npmrc with legacy-peer-deps=true to prevent npm from incorrectly marking direct dependencies (express, joi, winston) with "peer: true" in the lockfile. This is a known npm bug triggered when packages serve as both direct deps and peer deps of other packages. Tier 2 updates: - Remove unused @eslint/eslintrc devDependency (not imported anywhere) - Bump actions/upload-artifact v6 -> v7 (tests.yaml, build.yaml) - Bump actions/download-artifact v7 -> v8 (build.yaml) Note: joi 17->18 upgrade deferred — express-joi-validation@6.1.0 requires joi@17 as a peer dependency with no compatible update available. Moved to tier 3 alongside express-joi-validation replacement.

The "peer: true" flags in the lockfile are expected npm behavior when direct dependencies also satisfy peer deps of other packages. Our CI does not use --omit=peer, so this is not a practical risk.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

The testneta-node-msp.chia.net endpoint has multiple full_node instances behind the same IP. When a TCP connection drops and the wallet reconnects, it can land on a different node with a different peer_node_id. Since trusted_peers is keyed by node_id, the new connection is treated as untrusted, causing expensive weight proof verification and potential sync failures. Keep add-trusted-peer for connectivity (populates full_node_peers) and its initial node_id trust. Add trusted_cidrs with the resolved IP at /32 as a fallback so all node instances behind the same IP are trusted regardless of their cryptographic identities.

cursor Bot reviewed Mar 26, 2026

View reviewed changes

Comment thread package-lock.json

TheLastCicada added 2 commits March 26, 2026 13:49

revert: remove .npmrc and restore default peer dep resolution

39ad6d3

The "peer: true" flags in the lockfile are expected npm behavior when direct dependencies also satisfy peer deps of other packages. Our CI does not use --omit=peer, so this is not a practical risk.

cursor Bot reviewed Mar 27, 2026

View reviewed changes

Comment thread .github/workflows/tests.yaml Outdated

TheLastCicada force-pushed the chore/tier1-dep-updates branch from 70b8576 to 88ca1c6 Compare March 27, 2026 17:03

cursor Bot reviewed Mar 27, 2026

View reviewed changes

Comment thread .github/workflows/tests.yaml Outdated

TheLastCicada force-pushed the chore/tier1-dep-updates branch 2 times, most recently from 65743a8 to 83716a3 Compare March 27, 2026 17:11

TheLastCicada force-pushed the chore/tier1-dep-updates branch from 83716a3 to 5ede4b9 Compare March 27, 2026 17:14

TheLastCicada merged commit 700d7b0 into v2-rc2 Mar 27, 2026
25 checks passed

TheLastCicada deleted the chore/tier1-dep-updates branch March 27, 2026 18:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: update tier 1 npm dependencies and fix vulnerabilities#1554

chore: update tier 1 npm dependencies and fix vulnerabilities#1554
TheLastCicada merged 4 commits into
v2-rc2from
chore/tier1-dep-updates

TheLastCicada commented Mar 26, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

TheLastCicada commented Mar 26, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security Fixes

Non-Security Updates

Remaining Vulnerabilities (Tier 2/3 — separate PRs)

Test Plan

Dependabot PRs Superseded

Uh oh!

socket-security Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

TheLastCicada commented Mar 26, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Mar 26, 2026 •

edited

Loading

socket-security Bot commented Mar 26, 2026 •

edited

Loading