From 8f567f902ea43034c444c6169994e22d43c90bf6 Mon Sep 17 00:00:00 2001 From: alexander-sei Date: Fri, 2 Oct 2026 10:38:45 +0200 Subject: [PATCH 1/2] fix(sei-global-wallet): raise the axios override to 1.20.0 Twelve Axios advisories published on 2026-09-30 cover every release below 1.20.0, including the 1.18.0 that the README override blocks and the consumer verifier pinned, so the nightly consumer smoke went red without any change in this repository. The wallet-only npm consumer, which must audit clean, reported axios plus the eight Dynamic packages above it in the dependency chain. Dynamic still pins axios@1.16.0 exactly, so the fix stays a root override: the verifier's override set, all three README blocks, and the workspace override move to 1.20.0, the first release with no open advisory. It keeps the exports and dependencies of 1.18.0 apart from a form-data floor of ^4.0.6, which the lockfile already satisfied. The README's Axios note described only the Node HTTP adapter issue that 1.18.0 cleared. It now covers the new set, including the toFormData and fetch-adapter gadgets that also apply in browsers. Co-authored-by: Cursor --- .changeset/fix-global-wallet-axios-override.md | 13 +++++++++++++ bun.lock | 4 ++-- package.json | 2 +- packages/sei-global-wallet/README.md | 8 ++++---- scripts/check-sei-global-wallet.ts | 2 +- 5 files changed, 21 insertions(+), 8 deletions(-) create mode 100644 .changeset/fix-global-wallet-axios-override.md diff --git a/.changeset/fix-global-wallet-axios-override.md b/.changeset/fix-global-wallet-axios-override.md new file mode 100644 index 00000000..f97c6aa6 --- /dev/null +++ b/.changeset/fix-global-wallet-axios-override.md @@ -0,0 +1,13 @@ +--- +'@sei-js/sei-global-wallet': patch +--- + +Raise the documented `axios` override to `1.20.0` to clear the Axios advisories published on 2026-09-30. + +Twelve advisories published that day cover every Axios release below `1.20.0`, including the `1.18.0` the [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks pinned, so the nightly consumer run went red without any change in this repository. The wallet-only npm consumer, which is held to a strictly clean audit, reported nine findings: `axios` itself and the eight Dynamic packages above it in the dependency chain. + +Dynamic still pins `axios@1.16.0` exactly, so the correction stays a root override. All three blocks now carry `"axios": "1.20.0"`, the first release outside every advisory reported against that pin. It ships the same exports and dependencies as `1.18.0`, apart from raising the `form-data` floor to `^4.0.6`. + +The README's Axios note described only the Node HTTP adapter issue that `1.18.0` cleared. It now covers the current set: the high-severity issues are in Node-only transports or are prototype-pollution gadgets, and the `toFormData` and fetch-adapter gadgets also apply in browsers. + +No published dependency or peer range changes. diff --git a/bun.lock b/bun.lock index 68c9a6be..8776cfab 100644 --- a/bun.lock +++ b/bun.lock @@ -114,7 +114,7 @@ }, }, "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "uuid": "11.1.1", }, "packages": { @@ -528,7 +528,7 @@ "available-typed-arrays": ["available-typed-arrays@1.0.7", "", { "dependencies": { "possible-typed-array-names": "^1.0.0" } }, "sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ=="], - "axios": ["axios@1.18.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.5", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw=="], + "axios": ["axios@1.20.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg=="], "base-x": ["base-x@3.0.11", "", { "dependencies": { "safe-buffer": "^5.0.1" } }, "sha512-xz7wQ8xDhdyP7tQxwdteLYeFfS68tSMNCZ/Y37WJ4bhGfKPpqEIlmIyueQHqOyoPhE6xNUqjzRr8ra0eF9VRvA=="], diff --git a/package.json b/package.json index b44c0b48..44ff4233 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ "packages/*" ], "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "uuid": "11.1.1" }, "scripts": { diff --git a/packages/sei-global-wallet/README.md b/packages/sei-global-wallet/README.md index b03582c3..c689528b 100644 --- a/packages/sei-global-wallet/README.md +++ b/packages/sei-global-wallet/README.md @@ -25,7 +25,7 @@ Complete npm root overrides when the optional AA path is not enabled: ```json { "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "sharp": "0.35.4", "uuid": "11.1.1", "viem": { @@ -39,7 +39,7 @@ Complete Bun root overrides. The block is the same with or without the optional ```json { "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "sharp": "0.35.4", "uuid": "11.1.1" } @@ -48,7 +48,7 @@ Complete Bun root overrides. The block is the same with or without the optional The Axios, Sharp, and UUID overrides are temporary until Dynamic updates its exact transitive pins: -- The high-severity Axios issue is in the Node HTTP adapter and requires a prerequisite prototype-pollution/interceptor pattern. Browser wallet paths do not use that adapter, which reduces exploitability but does not make the vulnerable install acceptable. +- Dynamic pins `axios@1.16.0` exactly, and `1.20.0` is the first release outside every advisory reported against it. The high-severity Axios issues are in Node-only transports (the HTTP adapter, opt-in HTTP/2, and `NO_PROXY` handling) or are prototype-pollution gadgets that need a separate pollution primitive in the same process. Browser wallet paths do not use the Node transports, which reduces exploitability but does not make the vulnerable install acceptable; the `toFormData` and fetch-adapter gadgets apply in browsers too. - The high-severity Sharp issue is the bundled libheif heap overflow reported as `GHSA-rgj7-g3m4-5g8c`, reached through `@dynamic-labs/iconic`'s exact `sharp@0.35.0` pin. It is only triggered by decoding untrusted HEIF input, which no wallet path does, and `sharp` is a build-time image dependency that never reaches a browser bundle. The override is a patch-level move within `0.35.x`, so it carries no API change. - The UUID issue affects the v3, v5, and v6 buffer APIs. Dynamic's observed call sites use UUID v4, which reduces exploitability but does not clear the audit finding. @@ -56,7 +56,7 @@ Applications using the optional `./zerodev` / Dynamic account-abstraction path m ```json { "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "ethjs-unit": { "bn.js": "4.12.5" }, diff --git a/scripts/check-sei-global-wallet.ts b/scripts/check-sei-global-wallet.ts index 13d1cf7d..d2933bf2 100644 --- a/scripts/check-sei-global-wallet.ts +++ b/scripts/check-sei-global-wallet.ts @@ -166,7 +166,7 @@ const assertTestedPeersFitPublishedRanges = (testedPeerVersions: TestedPeerVersi // Flat by necessity: Bun cannot nest overrides, so every entry here has to be // safe to apply globally. const baseSafeOverrides = { - axios: '1.18.0', + axios: '1.20.0', sharp: '0.35.4', uuid: '11.1.1' }; From 503f10b6d1d8254f2f4df3b76d2a797097e87b33 Mon Sep 17 00:00:00 2001 From: alexander-sei Date: Fri, 2 Oct 2026 10:44:40 +0200 Subject: [PATCH 2/2] docs(sei-global-wallet): list the axios advisory IDs in the changeset Co-authored-by: Cursor --- .changeset/fix-global-wallet-axios-override.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.changeset/fix-global-wallet-axios-override.md b/.changeset/fix-global-wallet-axios-override.md index f97c6aa6..e19b1c0d 100644 --- a/.changeset/fix-global-wallet-axios-override.md +++ b/.changeset/fix-global-wallet-axios-override.md @@ -6,6 +6,11 @@ Raise the documented `axios` override to `1.20.0` to clear the Axios advisories Twelve advisories published that day cover every Axios release below `1.20.0`, including the `1.18.0` the [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks pinned, so the nightly consumer run went red without any change in this repository. The wallet-only npm consumer, which is held to a strictly clean audit, reported nine findings: `axios` itself and the eight Dynamic packages above it in the dependency chain. +Every one of them is patched in `1.20.0` and still open in `1.19.0`: + +- High: `GHSA-3pq3-5fj3-cg6v`, `GHSA-542g-h47m-68v8`, `GHSA-c29m-xwm3-cm6r`, `GHSA-m8m8-qj5v-23w3`, `GHSA-mghh-pgcx-3jjj`, `GHSA-r4gj-5m52-g5wh`, `GHSA-x97p-jq2g-jp4f`. +- Medium: `GHSA-44g4-m2mj-wpvx`, `GHSA-4hqw-qxg8-jxx2`, `GHSA-9fr6-4gfg-395g`, `GHSA-j8rh-479h-cp32`, `GHSA-vh66-26gq-q6x8`. + Dynamic still pins `axios@1.16.0` exactly, so the correction stays a root override. All three blocks now carry `"axios": "1.20.0"`, the first release outside every advisory reported against that pin. It ships the same exports and dependencies as `1.18.0`, apart from raising the `form-data` floor to `^4.0.6`. The README's Axios note described only the Node HTTP adapter issue that `1.18.0` cleared. It now covers the current set: the high-severity issues are in Node-only transports or are prototype-pollution gadgets, and the `toFormData` and fetch-adapter gadgets also apply in browsers.