Skip to content

fix: patch token-list transitive dependencies - #437

Merged
jeanchambras merged 1 commit into
mainfrom
chore/security-dependencies-2026-10
Oct 23, 2026
Merged

jeanchambras merged 1 commit into
mainfrom
chore/security-dependencies-2026-10

Conversation

@jeanchambras

Copy link
Copy Markdown
Contributor

Summary

Refresh compatible transitive dependencies in the npm lockfile. npm audit also selects older compatible MetaMask releases that avoid the affected uuid chain; these version decreases are intentional.

- @metamask/rpc-errors 6.4.0; nested utils 8.5.0/9.3.0
+ @metamask/rpc-errors 6.3.0; nested utils 8.3.0

Evidence

  • Before: npm audit reports 27 affected dependency entries.
  • After: clean npm installation succeeds. Running the installed Bun platform binary for src/build.ts followed by tsup produces both CJS and declaration builds; no generated source files changed.
  • The Bun npm wrapper is empty when lifecycle scripts are disabled, so validation invoked the existing @oven/bun-linux-x64 binary directly.
  • npm audit still reports 18 entries (seven high, 11 moderate) in the existing wagmi/wallet dependency chain. No runtime integration or browser wallet tests are available in this repository.

Merge Danger

Door: two-way. Revert this commit to roll back.

Blast Radius: library. Review the remaining advisories and validation limits above before merging.

@jeanchambras
jeanchambras merged commit 17a94ca into main Oct 23, 2026
1 check passed
@jeanchambras
jeanchambras deleted the chore/security-dependencies-2026-10 branch October 23, 2026 10:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant