diff --git a/audit-ci.jsonc b/audit-ci.jsonc index 52bdc29750..7ef6ee0bba 100644 --- a/audit-ci.jsonc +++ b/audit-ci.jsonc @@ -1,5 +1,22 @@ { "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json", "low": true, - "allowlist": [] + "allowlist": [ + // https://github.com/advisories/GHSA-rmvr-2pp2-xj38 + // Octokit request package vulnerable to ReDoS + // Only used in development scripts for GitHub API interactions + "GHSA-rmvr-2pp2-xj38", + // https://github.com/advisories/GHSA-h5c3-5r3r-rr8q + // Octokit plugin-paginate-rest vulnerable to ReDoS + // Only used in development scripts for GitHub API pagination + "GHSA-h5c3-5r3r-rr8q", + // https://github.com/advisories/GHSA-xx4v-prfh-6cgc + // Octokit request-error package vulnerable to ReDoS in authorization header processing + // Only used in development scripts for GitHub API error handling + "GHSA-xx4v-prfh-6cgc", + // https://github.com/advisories/GHSA-x4c5-c7rf-jjgv + // Octokit endpoint package vulnerable to ReDoS in preview header processing + // Only used in development scripts for GitHub API endpoint handling + "GHSA-x4c5-c7rf-jjgv" + ] } diff --git a/package.json b/package.json index 2c64d0bf3f..f563075f0c 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,7 @@ "**/@walletconnect/ethereum-provider": "2.13.1", "**/@ethersproject/providers/ws": "7.5.10", "**/@synthetixio/synpress/ws": "8.17.1", - "**/elliptic": "6.6.0" + "**/elliptic": "6.6.1" }, "keywords": [], "author": "", diff --git a/yarn.lock b/yarn.lock index ca76eb9b90..8eb2a2a547 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6576,10 +6576,10 @@ electron-to-chromium@^1.4.431: resolved "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.431.tgz" integrity sha512-m232JTVmCawA2vG+1azVxhKZ9Sv1Q//xxNv5PkP5rWxGgQE8c3CiZFrh8Xnp+d1NmNxlu3QQrGIfdeW5TtXX5w== -elliptic@6.5.4, elliptic@6.6.0, elliptic@^6.5.4: - version "6.6.0" - resolved "https://registry.yarnpkg.com/elliptic/-/elliptic-6.6.0.tgz#5919ec723286c1edf28685aa89261d4761afa210" - integrity sha512-dpwoQcLc/2WLQvJvLRHKZ+f9FgOdjnq11rurqwekGQygGPsYSK29OMMD2WalatiqQ+XGFDglTNixpPfI+lpaAA== +elliptic@6.5.4, elliptic@6.6.1, elliptic@^6.5.4: + version "6.6.1" + resolved "https://registry.yarnpkg.com/elliptic/-/elliptic-6.6.1.tgz#3b8ffb02670bf69e382c7f65bf524c97c5405c06" + integrity sha512-RaddvvMatK2LJHqFJ+YA4WysVN5Ita9E35botqIYspQ4TkRAlCicdzKOjlyv/1Za5RyTNn7di//eEV0uTAfe3g== dependencies: bn.js "^4.11.9" brorand "^1.1.0"