Snyk fix cad645a0511a80339810d91e2854a929 #7966

Dargon789 · 2025-10-01T13:58:09Z

No description provided.

Signed-off-by: AU_gdev_19 <[email protected]>

Circleci project setup

…bilities (#60) The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-REXML-12878608 - https://snyk.io/vuln/SNYK-RUBY-WEBRICK-10500756 - https://snyk.io/vuln/SNYK-RUBY-WEBRICK-8068535 Co-authored-by: snyk-bot <[email protected]>

…updates (#61) Bumps the npm_and_yarn group with 2 updates in the /apps/extension directory: [webpack](https://github.com/webpack/webpack) and [webpack-dev-server](https://github.com/webpack/webpack-dev-server). Bumps the npm_and_yarn group with 1 update in the /apps/mobile directory: [react-native-mmkv](https://github.com/mrousavy/react-native-mmkv). Bumps the npm_and_yarn group with 3 updates in the /apps/web directory: [webpack](https://github.com/webpack/webpack), [graphql](https://github.com/graphql/graphql-js) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 2 updates in the /packages/uniswap directory: [react-native-mmkv](https://github.com/mrousavy/react-native-mmkv) and [graphql](https://github.com/graphql/graphql-js). Bumps the npm_and_yarn group with 1 update in the /packages/utilities directory: [graphql](https://github.com/graphql/graphql-js). Bumps the npm_and_yarn group with 1 update in the /packages/wallet directory: [graphql](https://github.com/graphql/graphql-js). Updates `webpack` from 5.90.0 to 5.94.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.90.0...v5.94.0) Updates `webpack-dev-server` from 4.15.1 to 5.2.1 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.1...v5.2.1) Updates `react-native-mmkv` from 2.10.1 to 2.11.0 - [Release notes](https://github.com/mrousavy/react-native-mmkv/releases) - [Commits](mrousavy/react-native-mmkv@v2.10.1...v2.11.0) Updates `webpack` from 5.90.0 to 5.94.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.90.0...v5.94.0) Updates `graphql` from 16.6.0 to 16.8.1 - [Release notes](https://github.com/graphql/graphql-js/releases) - [Commits](graphql/graphql-js@v16.6.0...v16.8.1) Updates `hono` from 4.8.4 to 4.9.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.4...v4.9.7) Updates `react-native-mmkv` from 2.10.1 to 2.11.0 - [Release notes](https://github.com/mrousavy/react-native-mmkv/releases) - [Commits](mrousavy/react-native-mmkv@v2.10.1...v2.11.0) Updates `graphql` from 16.6.0 to 16.8.1 - [Release notes](https://github.com/graphql/graphql-js/releases) - [Commits](graphql/graphql-js@v16.6.0...v16.8.1) Updates `graphql` from 16.6.0 to 16.8.1 - [Release notes](https://github.com/graphql/graphql-js/releases) - [Commits](graphql/graphql-js@v16.6.0...v16.8.1) Updates `graphql` from 16.6.0 to 16.8.1 - [Release notes](https://github.com/graphql/graphql-js/releases) - [Commits](graphql/graphql-js@v16.6.0...v16.8.1) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.94.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: react-native-mmkv dependency-version: 2.11.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.94.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: graphql dependency-version: 16.8.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.9.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: react-native-mmkv dependency-version: 2.11.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: graphql dependency-version: 16.8.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: graphql dependency-version: 16.8.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: graphql dependency-version: 16.8.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ession for hostnames (#63) Signed-off-by: AU_gdev_19 <[email protected]> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Update issue templates * Update .github/ISSUE_TEMPLATE/feature_request.md Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Signed-off-by: AU_gdev_19 <[email protected]> --------- Signed-off-by: AU_gdev_19 <[email protected]> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

…ession for hostnames (#65) Signed-off-by: AU_gdev_19 <[email protected]> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Configure tag_and_release GitHub Actions workflow with explicit write permissions and annotate the GITHUB_TOKEN usage. CI: Add explicit contents, issues, and pull-requests write permissions to the workflow Chores: Add comment noting alternative use of a personal access token for GITHUB_TOKEN Signed-off-by: AU_gdev_19 <[email protected]>

Signed-off-by: AU_gdev_19 <[email protected]>

Dargon789

Snyk fix cad645a0511a80339810d91e2854a929 #7966

…ession for hostnames Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: AU_019 <[email protected]>

Signed-off-by: AU_019 <[email protected]>

…ing or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: AU_019 <[email protected]>

Signed-off-by: AU_019 <[email protected]>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-ELLIPTIC-8720086 - https://snyk.io/vuln/SNYK-JS-ELLIPTIC-8187303 - https://snyk.io/vuln/SNYK-JS-ELLIPTIC-7577916 - https://snyk.io/vuln/SNYK-JS-ELLIPTIC-7577917 - https://snyk.io/vuln/SNYK-JS-ELLIPTIC-7577918

socket-security · 2025-10-01T14:25:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
npm/@tamagui/theme-base@1.125.17 ⏵ 1.114.4	^-7
npm/@tamagui/remove-scroll@1.125.17 ⏵ 1.114.4				⁺¹
npm/@tamagui/helpers-icon@1.125.17 ⏵ 1.114.4	^-2		⁺¹	⁺¹
gem/fastlane@2.214.0 ⏵ 2.215.0	⁺¹
npm/@tamagui/animations-moti@1.125.17 ⏵ 1.114.4	^-1			⁺¹
npm/@tamagui/react-native-media-driver@1.114.4
npm/@tamagui/animations-react-native@1.125.17 ⏵ 1.114.4	^-1			⁺¹
npm/@tamagui/font-inter@1.125.17 ⏵ 1.114.4			⁺¹	⁺¹
npm/@storybook/react@8.4.2
npm/@tamagui/core@1.114.4
npm/tamagui@1.125.17 ⏵ 1.114.4	^-2			⁺¹
npm/@shopify/react-native-skia@1.4.2
npm/expo-linear-gradient@12.7.2
npm/@react-native-masked-view/masked-view@0.2.9
gem/cocoapods@1.14.3 ⏵ 1.15.0	^-1
npm/webpack-dev-server@4.15.1 ⏵ 5.2.1	⁺¹	⁺⁸
npm/@testing-library/react-hooks@7.0.2
npm/ethers@6.0.0
npm/react-native-mmkv@2.10.1 ⏵ 2.11.0		⁺⁵		⁺¹¹
npm/react-native-safe-area-context@4.9.0
npm/@tamagui/build@1.114.4
npm/graphql@16.6.0 ⏵ 16.8.1	⁺¹	⁺⁴
npm/react-native-reanimated@3.15.0
npm/react-native-svg@15.1.0
npm/react-native-webview@11.23.1
npm/@shopify/flash-list@1.6.3
npm/@gorhom/bottom-sheet@4.5.1
npm/react-native-gesture-handler@2.19.0
npm/hono@4.8.4 ⏵ 4.9.7	⁺¹	⁺¹⁹	^-1
npm/webpack@5.90.0 ⏵ 5.94.0	⁺¹	⁺⁵		⁺¹
npm/react-native@0.73.6
npm/@testing-library/react-native@11.5.0

View full report

socket-security · 2025-10-01T14:25:57Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/@jsonjoy.com/[email protected]` has a Potential vulnerability. Location: Package overview From: `?` → `npm/[email protected]` → `npm/@jsonjoy.com/[email protected]` ℹ Read more on: This package \| This alert \| Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@jsonjoy.com/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`gem/[email protected]` has Shell access. Location: Package overview From: apps/mobile/Gemfile.lock → `gem/[email protected]` → `gem/[email protected]` → `gem/[email protected]` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore gem/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`gem/[email protected]` has Shell access. Location: Package overview From: apps/mobile/Gemfile.lock → `gem/[email protected]` → `gem/[email protected]` → `gem/[email protected]` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore gem/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/@react-native-community/[email protected]` has Shell access. Module: child_process Location: Package overview From: `?` → `npm/[email protected]` → `npm/@react-native-community/[email protected]` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native-community/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`gem/[email protected]` has Filesystem access. Location: Package overview From: apps/mobile/Gemfile.lock → `gem/[email protected]` → `gem/[email protected]` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore gem/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`gem/[email protected]` has Filesystem access. Location: Package overview From: apps/mobile/Gemfile.lock → `gem/[email protected]` → `gem/[email protected]` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore gem/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`gem/[email protected]` has Filesystem access. Location: Package overview From: apps/mobile/Gemfile.lock → `gem/[email protected]` → `gem/[email protected]` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore gem/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`gem/[email protected]` has Filesystem access. Location: Package overview From: apps/mobile/Gemfile.lock → `gem/[email protected]` → `gem/[email protected]` → `gem/[email protected]` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore gem/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/@react-native-community/[email protected]` has Filesystem access. Module: fs Location: Package overview From: `?` → `npm/[email protected]` → `npm/@react-native-community/[email protected]` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native-community/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/@react-native-community/[email protected]` has a Dynamic require. Location: Package overview From: `?` → `npm/[email protected]` → `npm/@react-native-community/[email protected]` ℹ Read more on: This package \| This alert \| What is dynamic require? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should avoid dynamic imports when possible. Audit the use of dynamic require to ensure it is not executing malicious or vulnerable code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native-community/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/@react-native-community/[email protected]` has Filesystem access. Module: fs-extra Location: Package overview From: `?` → `npm/[email protected]` → `npm/@react-native-community/[email protected]` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native-community/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Dargon789 and others added 10 commits September 23, 2025 15:48

Create config.yml (#56)

c2e03b7

Signed-off-by: AU_gdev_19 <[email protected]>

Merge branch 'Uniswap:main' into circleci-project-setup

a272a7c

Merge pull request #62 from Dargon789/circleci-project-setup

4e41d0b

Circleci project setup

Potential fix for code scanning alert no. 19: Incomplete regular expr…

607e2db

…ession for hostnames (#63) Signed-off-by: AU_gdev_19 <[email protected]> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Potential fix for code scanning alert no. 17: Incomplete regular expr…

87893de

…ession for hostnames (#65) Signed-off-by: AU_gdev_19 <[email protected]> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Update tag_and_release.yml (#67)

4b5c40f

Signed-off-by: AU_gdev_19 <[email protected]>

Dargon789 commented Oct 1, 2025

View reviewed changes

Dargon789 and others added 6 commits October 1, 2025 21:12

Potential fix for code scanning alert no. 10: Incomplete regular expr…

008555b

…ession for hostnames Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: AU_019 <[email protected]>

Create SECURITY.md

085f13d

Signed-off-by: AU_019 <[email protected]>

Potential fix for code scanning alert no. 11: Incomplete string escap…

a6b4970

…ing or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: AU_019 <[email protected]>

Create static.yml

8a4ae07

Signed-off-by: AU_019 <[email protected]>

Create jekyll-gh-pages.yml

46b0af5

Signed-off-by: AU_019 <[email protected]>

Dargon789 force-pushed the snyk-fix-cad645a0511a80339810d91e2854a929 branch from 6c168fe to bdef851 Compare October 1, 2025 14:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Snyk fix cad645a0511a80339810d91e2854a929 #7966

Snyk fix cad645a0511a80339810d91e2854a929 #7966

Uh oh!

Dargon789 commented Oct 1, 2025

Uh oh!

Dargon789 left a comment

Uh oh!

socket-security bot commented Oct 1, 2025

Uh oh!

socket-security bot commented Oct 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Snyk fix cad645a0511a80339810d91e2854a929 #7966

Are you sure you want to change the base?

Snyk fix cad645a0511a80339810d91e2854a929 #7966

Uh oh!

Conversation

Dargon789 commented Oct 1, 2025

Uh oh!

Dargon789 left a comment

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Oct 1, 2025

Uh oh!

socket-security bot commented Oct 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants