rc release by TheLastCicada · Pull Request #1563 · Chia-Network/cadt

TheLastCicada · 2026-03-31T17:06:28Z

Note

Medium Risk
Medium risk because it changes the release/test GitHub Actions (major-version bumps for artifact upload/download and new wallet network config), which could break CI packaging or integration runs despite minimal product-code impact.

Overview
CI/release workflows updated. actions/upload-artifact is bumped to v7 and actions/download-artifact to v8 across build, deb packaging, and release jobs.

Integration tests tweaked for sqlite3 + wallet connectivity. Tests now set npm_config_build_from_source=sqlite3, and Chia test setup additionally configures wallet.trusted_cidrs alongside disabling unknown peers.

Docs + lint config refreshed. V2 RPC docs add a detailed XLSX import/export section (format, multi-sheet structure, NEW-<n> placeholders, limits, sample files) and update the XLS export/import examples; ESLint config drops the Babel parser, targets ecmaVersion: 2025, warns on preserve-caught-error, and adds file-based exceptions for dynamic imports and .cjs source type.

^{Written by Cursor Bugbot for commit 1d0833a. This will update automatically on new commits. Configure here.}

Bumps and [picomatch](https://github.com/micromatch/picomatch). These dependencies needed to be updated together. Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) --- updated-dependencies: - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Add comprehensive XLSX Import/Export section to the V2 API guide covering file format, multi-sheet structure, NEW-<n> placeholder IDs, update merging, array fields, and file size limits. Enhance existing project and unit export/import endpoint docs with detailed descriptions and links to sample XLSX files in the repository.

docs(V2): add xlsx import/export documentation

Update all semver-compatible npm dependencies and fix HIGH/MODERATE severity vulnerabilities. Key security fixes: - express-rate-limit 8.2.1->8.3.1 (rate-limit bypass via IPv6) - multer 2.0.2->2.1.1 (3 DoS vulnerabilities) - sequelize 6.37.7->6.37.8 (SQL injection via JSON column cast) - tar override 7.5.7->7.5.13 (3 path traversal vulnerabilities) - dottie, flatted, socket.io-parser, picomatch (transitive fixes) Also updates: dotenv, mysql2, log-update, babel, commitlint, eslint (patch), globals, sinon, babel-plugin-module-resolver.

Set Content-Type to the proper XLSX MIME type instead of text/plain, and add a "Downloading the Export" section to the V2 API docs with instructions for browser, cURL, and Postman.

fix(V2): correct XLSX Content-Type and add export download docs

…ates Add .npmrc with legacy-peer-deps=true to prevent npm from incorrectly marking direct dependencies (express, joi, winston) with "peer: true" in the lockfile. This is a known npm bug triggered when packages serve as both direct deps and peer deps of other packages. Tier 2 updates: - Remove unused @eslint/eslintrc devDependency (not imported anywhere) - Bump actions/upload-artifact v6 -> v7 (tests.yaml, build.yaml) - Bump actions/download-artifact v7 -> v8 (build.yaml) Note: joi 17->18 upgrade deferred — express-joi-validation@6.1.0 requires joi@17 as a peer dependency with no compatible update available. Moved to tier 3 alongside express-joi-validation replacement.

The "peer: true" flags in the lockfile are expected npm behavior when direct dependencies also satisfy peer deps of other packages. Our CI does not use --omit=peer, so this is not a practical risk.

Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.8 to 4.7.9. - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9) --- updated-dependencies: - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

The testneta-node-msp.chia.net endpoint has multiple full_node instances behind the same IP. When a TCP connection drops and the wallet reconnects, it can land on a different node with a different peer_node_id. Since trusted_peers is keyed by node_id, the new connection is treated as untrusted, causing expensive weight proof verification and potential sync failures. Keep add-trusted-peer for connectivity (populates full_node_peers) and its initial node_id trust. Add trusted_cidrs with the resolved IP at /32 as a fallback so all node instances behind the same IP are trusted regardless of their cryptographic identities.

chore: update tier 1 npm dependencies and fix vulnerabilities

standard-version has been deprecated since May 2022 and its transitive dependency on handlebars@4.7.8 has a known prototype pollution vulnerability (GHSA-2qvq-rjwj-gvw9). commit-and-tag-version is the actively maintained fork with identical CLI and config format. - Remove standard-version devDependency - Install commit-and-tag-version@12.7.1 - Update 'release' script to use commit-and-tag-version - Rename 'standard-version' config key to 'commit-and-tag-version'

Move CADT to eslint@10/@eslint-js@10 and remove @babel/eslint-parser, which is not compatible with ESLint 10 in this codebase. Update flat config for CJS/ESM edge cases, keep intentional dynamic imports exempt, and clean up no-useless-assignment findings while preserving runtime behavior verified by v1 and v2 integration test suites.

chore: replace deprecated standard-version with commit-and-tag-version

…ndlebars-4.7.9 chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9

…lti-bf05dc1ecf chore(deps): bump picomatch

Move sqlite3 from v5 to v6 to reduce high-severity transitive risk in its node-gyp chain while keeping the existing pkg binary path behavior compatible with the current build pipeline.

sqlite3 v6 prebuilt linux binaries can require newer glibc than the node:24 test container provides. Force source builds in tests workflow so native bindings are compiled against the runner libc.

…tes-phase3 fix: upgrade sqlite3 to v6.0.1

Ensure the renamed main V2 worksheet is always emitted first in generated XLSX files so the primary entity tab opens first for users.

fix(V2): keep primary worksheet first in xlsx exports

Rename all src/models modeltypes modules from .cjs to .js, convert CommonJS exports to ESM defaults, and update all consuming model imports. This unblocks the planned uuid v13 upgrade by removing CJS-only usage.

Move uuid from v10 to v13 now that modeltypes modules are ESM-only. This keeps dependencies current while preserving existing runtime behavior.

…tes-phase4 refactor(V2): convert modeltypes files from cjs to esm

socket-security · 2026-03-31T17:07:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
@commitlint/cli@20.4.1 ⏵ 20.5.0			⁺¹
@babel/preset-env@7.29.0 ⏵ 7.29.2
uuid@10.0.0 ⏵ 13.0.0
babel-plugin-module-resolver@5.0.2 ⏵ 5.0.3	⁺¹		⁺¹
globals@17.3.0 ⏵ 17.4.0	⁺¹		⁺¹	^-2
log-update@7.1.0 ⏵ 7.2.0				^-1
eslint@9.39.2 ⏵ 10.1.0	⁺¹
sequelize@6.37.7 ⏵ 6.37.8		⁺¹⁶	⁺¹	^-1
sqlite3@5.1.7 ⏵ 6.0.1
commit-and-tag-version@12.7.1
sinon@21.0.1 ⏵ 21.0.3			⁺¹	⁺¹
multer@2.0.2 ⏵ 2.1.1	⁺¹	⁺³¹	⁺¹
dotenv@17.2.4 ⏵ 17.3.1
@eslint/js@9.39.2 ⏵ 10.0.1
mysql2@3.17.0 ⏵ 3.20.0
express-rate-limit@8.2.1 ⏵ 8.3.1	⁺¹	⁺¹⁶		⁺²
@commitlint/config-conventional@20.4.1 ⏵ 20.5.0

View full report

socket-security · 2026-03-31T17:07:12Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: npm `caniuse-lite` under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/package.json) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) From: package-lock.json → `npm/@babel/core@7.29.0` → `npm/@babel/preset-env@7.29.2` → `npm/caniuse-lite@1.0.30001781` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001781`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `typescript` under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) License: MIT-Khronos-old - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) From: package-lock.json → `npm/@commitlint/cli@20.5.0` → `npm/typescript@6.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@6.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `@babel/helpers` is 100.0% likely to have a medium risk anomaly Notes: The code fragment is a standard Babel decorator runtime helper (applyDecs2203). Its security posture hinges on the trustworthiness of the supplied decorators. If decorators are from untrusted sources, they can execute arbitrary code during decoration or initialization. The library itself does not exhibit malicious behavior, but this pattern introduces a high-risk surface via external inputs. Recommended mitigations include validating decorator outputs, enforcing sandboxing or runner boundaries for decorators, and auditing decorator sources in the application. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/@babel/core@7.29.0` → `npm/@babel/helpers@7.29.2` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/helpers@7.29.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code is a straightforward build script to bundle and minify a specified package using Browserify and UglifyJS. The primary security concern is potential path manipulation: json.main is used to form a require path without validating that it stays within the target package directory. If a malicious or misconfigured package.json includes an absolute path or traversal outside the package, the script could bundle unintended files. Otherwise, the script does not perform network access, data exfiltration, or backdoor actions, and there is no hard-coded secrets or dynamic code execution beyond standard bundling/minification. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/eslint@10.1.0` → `npm/ajv@6.14.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@6.14.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code augments a meta-schema to permit remote dereferencing of keyword schemas via a hardcoded data.json resource. This introduces network dependency and potential changes to validation semantics at runtime. While not inherently malicious, the remote reference constitutes a notable security and reliability risk that should be mitigated with local fallbacks, input validation, and explicit remote-resource governance. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/eslint@10.1.0` → `npm/ajv@6.14.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@6.14.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code implements a standard AJV-like dynamic parser generator for JTD schemas. There are no explicit malware indicators in this fragment. The primary security concern is the dynamic code generation and execution from external schemas, which introduces a medium risk if schemas are untrusted. With trusted schemas and proper schema management, the risk is typically acceptable within this pattern. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/@commitlint/cli@20.5.0` → `npm/ajv@8.18.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@8.18.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: This module generates JavaScript code at runtime via standaloneCode(...) and then immediately executes it with require-from-string. Because the generated code can incorporate user-supplied schemas or custom keywords without sanitization or sandboxing, an attacker who controls those inputs could inject arbitrary code and achieve remote code execution in the Node process. Users should audit and lock down the standaloneCode output or replace dynamic evaluation with a safer, static bundling approach. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/@commitlint/cli@20.5.0` → `npm/ajv@8.18.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@8.18.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code implements standard timestamp validation with clear logic for normal and leap years and leap seconds. There is no network, file, or execution of external code within this isolated fragment. The only anomalous aspect is assigning a string to validTimestamp.code, which could enable external tooling to inject behavior in certain environments, but this does not constitute active malicious behavior in this isolated snippet. Overall, low to moderate security risk in typical usage; no malware detected within the shown code. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/@commitlint/cli@20.5.0` → `npm/ajv@8.18.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@8.18.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `cacache` is 100.0% likely to have a medium risk anomaly Notes: The analyzed code is a straightforward content-cache retrieval and streaming utility. It reads from a cache using an index, supports digest-based access, and optionally memoizes results. There is no evidence of malicious behavior, data exfiltration, backdoors, or external network activity within this module. The security risk appears low, assuming the surrounding system properly manages cache integrity and does not expose untrusted cache contents without validation. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/sqlite3@6.0.1` → `npm/cacache@20.0.4` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/cacache@20.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `glob` is 100.0% likely to have a medium risk anomaly Notes: The Glob utilities implement a conventional and well-structured filesystem glob-walking mechanism with robust control flow (abort signals, backpressure) and safe output semantics. There is no evidence of malicious behavior, backdoors, or data exfiltration within this fragment. Risks mainly relate to how downstream consumers may handle emitted paths, not to the library itself. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/sqlite3@6.0.1` → `npm/glob@13.0.6` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/glob@13.0.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `minipass-fetch` is 100.0% likely to have a medium risk anomaly Notes: No evidence of malicious behavior or supply-chain sabotage within this code fragment. The code adheres to standard fetch-like behavior with conventional TLS/config handling. Potential security considerations include the ability to disable TLS verification via an environment variable (a known risk if misused) but this is typical for Node.js TLS configurations and not a deliberate backdoor. Overall risk is moderate due to TLS verification control but not due to malicious intent in this module. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/sqlite3@6.0.1` → `npm/minipass-fetch@5.0.2` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minipass-fetch@5.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `node-gyp` is 100.0% likely to have a medium risk anomaly Notes: The code is a legitimate Windows registry query and filesystem readability utility, with no inherent malware or backdoors. Primary security concerns are data exposure through verbose logging and the potential misuse of reg.exe with untrusted inputs. Mitigations include restricting input sources, redacting sensitive outputs in logs, and ensuring callers handle registry data securely. Overall security risk is moderate due to sensitive operations and logging exposure, but no active malicious behavior detected. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/sqlite3@6.0.1` → `npm/node-gyp@12.2.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-gyp@12.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `yaml` is 100.0% likely to have a medium risk anomaly Notes: The code presents a standard, non-malicious NodeBase component used in YAML/JS conversion. The primary risk surface is the optional reviver and onAnchor callbacks provided by the user: if untrusted, these can execute arbitrary code or influence the transformed representation via applyReviver or the reviver itself. This is expected behavior for extensible YAML libraries; ensure callbacks come from trusted sources and sandbox or validate revivers where possible. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/commit-and-tag-version@12.7.1` → `npm/yaml@2.8.3` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/yaml@2.8.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

The .cjs modeltypes override block targeted files that were renamed to .js in 29c0c0f. As .js files they are already covered by the main config's sourceType: "module" setting.

dependabot Bot and others added 24 commits March 26, 2026 01:50

Merge pull request #1553 from Chia-Network/docs/v2-xlsx-import-export

40ed3b4

docs(V2): add xlsx import/export documentation

fix(V2): correct XLSX Content-Type and add export download docs

6a1b290

Set Content-Type to the proper XLSX MIME type instead of text/plain, and add a "Downloading the Export" section to the V2 API docs with instructions for browser, cURL, and Postman.

Merge pull request #1555 from Chia-Network/docs/v2-xlsx-import-export

b524731

fix(V2): correct XLSX Content-Type and add export download docs

revert: remove .npmrc and restore default peer dep resolution

39ad6d3

The "peer: true" flags in the lockfile are expected npm behavior when direct dependencies also satisfy peer deps of other packages. Our CI does not use --omit=peer, so this is not a practical risk.

Merge pull request #1554 from Chia-Network/chore/tier1-dep-updates

700d7b0

chore: update tier 1 npm dependencies and fix vulnerabilities

Merge pull request #1557 from Chia-Network/chore/tier2-tier3-dep-updates

634e308

chore: replace deprecated standard-version with commit-and-tag-version

Merge pull request #1556 from Chia-Network/dependabot/npm_and_yarn/ha…

a1dd39f

…ndlebars-4.7.9 chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9

Merge pull request #1552 from Chia-Network/dependabot/npm_and_yarn/mu…

f9b270d

…lti-bf05dc1ecf chore(deps): bump picomatch

fix: upgrade sqlite3 to v6.0.1

43545d2

Move sqlite3 from v5 to v6 to reduce high-severity transitive risk in its node-gyp chain while keeping the existing pkg binary path behavior compatible with the current build pipeline.

fix(CI): build sqlite3 from source in test jobs

2862d67

sqlite3 v6 prebuilt linux binaries can require newer glibc than the node:24 test container provides. Force source builds in tests workflow so native bindings are compiled against the runner libc.

Merge pull request #1559 from Chia-Network/chore/tier2-tier3-dep-upda…

dbfb826

…tes-phase3 fix: upgrade sqlite3 to v6.0.1

fix(V2): keep primary worksheet first in xlsx exports

c8a57c5

Ensure the renamed main V2 worksheet is always emitted first in generated XLSX files so the primary entity tab opens first for users.

Merge pull request #1560 from Chia-Network/fix-v2-projects-sheet-first

87acdfc

fix(V2): keep primary worksheet first in xlsx exports

refactor(V2): convert modeltypes files from cjs to esm

29c0c0f

Rename all src/models modeltypes modules from .cjs to .js, convert CommonJS exports to ESM defaults, and update all consuming model imports. This unblocks the planned uuid v13 upgrade by removing CJS-only usage.

chore(V2): upgrade uuid to v13

d594c0d

Move uuid from v10 to v13 now that modeltypes modules are ESM-only. This keeps dependencies current while preserving existing runtime behavior.

Merge pull request #1561 from Chia-Network/chore/tier2-tier3-dep-upda…

608a2cd

…tes-phase4 refactor(V2): convert modeltypes files from cjs to esm

cursor Bot reviewed Mar 31, 2026

View reviewed changes

Comment thread eslint.config.mjs Outdated

fix: remove dead eslint override for renamed modeltypes files

1d0833a

The .cjs modeltypes override block targeted files that were renamed to .js in 29c0c0f. As .js files they are already covered by the main config's sourceType: "module" setting.

TheLastCicada merged commit 83133bc into develop Mar 31, 2026
27 checks passed

TheLastCicada deleted the v2-rc2 branch March 31, 2026 20:07

TheLastCicada restored the v2-rc2 branch April 6, 2026 15:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

rc release#1563

rc release#1563
TheLastCicada merged 25 commits into
developfrom
v2-rc2

TheLastCicada commented Mar 31, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

TheLastCicada commented Mar 31, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

TheLastCicada commented Mar 31, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Mar 31, 2026 •

edited

Loading

socket-security Bot commented Mar 31, 2026 •

edited

Loading