Bump library dependencies #99
Conversation
|
New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
🚮 Removed packages: @ethereumjs/[email protected], [email protected] |
legobeat
force-pushed
the
deps-bumps-v7
branch
2 times, most recently
from
3782743 to
731b02f
Compare
|
👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎ This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring: Next stepsTake a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with |
This comment was marked as resolved.
This comment was marked as resolved.
src/HDKeyring.ts
Outdated
| opts: KeyringOpt = {}, | ||
| ): Promise<string> { | ||
| if (!isStrictHexString(data)) { |
There was a problem hiding this comment.
Is data expected to always have 0x? If not, we should use isHexString instead.
There was a problem hiding this comment.
Doesn't seem like it's actually made explicit. Moved to using assertIsHexString and changed the type back to string.
legobeat
force-pushed
the
deps-bumps-v7
branch
from
731b02f to
52ad57e
Compare
The library previously rejected non-hex-string data but relied on an underlying library to throw the error. This makes the validation explicit, and changes the type of the `data` parameter of `signMessage` from `string` to `Hex` to reflect that.
legobeat
force-pushed
the
deps-bumps-v7
branch
from
52ad57e to
538bd22
Compare
Updates all runtime dependencies to latest, except holding back
@ethereumjsfrom latest majors to preserve Node.js v16 compatibility as well as aligning as peers.