security: fix high and critical vulnerabilities#235
Merged
matthewjablack merged 9 commits intomasterfrom Jan 15, 2026
Merged
Conversation
…spaces - Fix 99.5% of vulnerabilities (187 → 9) - Eliminate all high (114 → 0) and critical (14 → 0) severity issues - Only 1 moderate remains (deprecated request in coveralls dev dependency) Package updates: - Upgrade root dev dependencies (lerna 4→8, mocha 8→11, eslint 8→9, etc.) - Switch from bitcoin-networks@1.0.0 to bitcoin-network@0.1.0 - Upgrade secp256k1 from ^4.0.x to ^5.0.1 (reduces elliptic from high→low) - Fix critical sha.js vulnerability Infrastructure improvements: - Enable yarn workspaces for better monorepo management - Add resolutions to enforce secure dependency versions globally - Update bootstrap commands (lerna bootstrap → yarn install) - Remove deprecated package-lock.json files (workspace uses root yarn.lock) Breaking changes: - Root package now marked as private (required for yarn workspaces) - lerna bootstrap no longer available (use yarn install/bootstrap instead)
matthewjablack
force-pushed
the
security/fix-audit-vulnerabilities
branch
from
4ff3bc6 to
aaa9947
Compare
The wire package tests have a cleanup issue where async operations don't finish properly, causing the test process to hang. Adding the --exit flag forces mocha to exit after tests complete. All tests pass successfully with this change.
The noise package tests have the same cleanup issue as wire where async operations don't finish properly. Adding the --exit flag forces mocha to exit after tests complete.
- Change noise integration test port from 10000 to 10001 to avoid conflict with wire tests - Add nx.json to disable test caching and prevent flaky test behavior - Clear Nx cache in CI before running tests - Add .nx/ cache directory to .gitignore Fixes intermittent test failures caused by port conflicts when wire and noise tests run in parallel.
In CI, yarn workspaces require packages to be built before tests can run. Added 'yarn build' step before 'yarn test' to ensure all packages are compiled and available.
The "Clear Nx cache" step was interfering with the TypeScript build process in CI, causing module resolution errors. Nx's build cache is needed for proper dependency resolution between workspace packages.
Add targetDefaults for build task with dependsOn: ["^build"] to ensure Nx builds package dependencies before dependent packages. This fixes CI build failures where TypeScript couldn't resolve workspace packages like @node-dlc/bufio and @node-dlc/crypto because they weren't built yet. The ^ prefix means "build all dependencies first", ensuring proper build order in the monorepo.
Replace all imports of 'bitcoin-networks' with 'bitcoin-network' across the codebase. This fixes TypeScript compilation errors in CI where the old package name couldn't be resolved. Updated files: - packages/messaging/lib/messages/AddressCache.ts - packages/messaging/lib/messages/DlcOffer.ts - packages/messaging/lib/messages/DlcAccept.ts - packages/core/lib/dlc/finance/Builder.ts - packages/core/__tests__/dlc/finance/Builder.spec.ts - packages/core/__tests__/dlc/finance/CsoInfo.spec.ts - packages/messaging/__tests__/messages/DlcOffer.spec.ts - packages/messaging/__tests__/messages/AddressCache.spec.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes critical security vulnerabilities and modernizes the monorepo infrastructure by migrating to yarn workspaces.
Security Improvements
requestincoverallsdev dependency)Key Changes
Package Updates
bitcoin-networks@1.0.0withbitcoin-network@0.1.0to eliminate high-severity vulnerabilitiessecp256k1from^4.0.xto^5.0.1(downgrades elliptic vulnerability from high→low)sha.jsvulnerabilityInfrastructure Improvements
bootstrap:lerna bootstrap→yarn installbootstrap:ci:lerna bootstrap --hoist→yarn install --frozen-lockfilenew:version: Removed deprecatedlerna clean && lerna bootstrapBreaking Changes
"private": true(required for yarn workspaces)yarn bootstrapnow runsyarn installinstead oflerna bootstrap(removed in lerna v7+)Migration Notes
For developers:
yarn installoryarn bootstrapafter pulling these changesTest Plan
yarn installcompletes successfullyyarn audit --level highshows 0 high/critical vulnerabilitiesyarn bootstrapworks correctlyAudit Results
Before: