fix(sei-global-wallet): clear the sharp, Vite, and stream-json drift

.changeset/fix-global-wallet-sharp-stream-json-advisories.md

@@ -0,0 +1,15 @@
+---
+'@sei-js/sei-global-wallet': patch
+---
+
+Raise the documented `sharp` override to `0.35.5`, and accept the two new `stream-json` advisories that no override can reach.
+
+Advisories published since October 5 turned the nightly consumer smoke red without any change in this repository.
+
+`GHSA-wq5f-xc86-pv6w` covers `sharp` below `0.35.5`: a memory bug in the bundled librsvg (CVE-2026-96889) that can lead to remote code execution on glibc-based Linux when decoding untrusted SVG input. It reaches applications through `@dynamic-labs/iconic`'s exact `sharp@0.35.0` pin, the path the existing `0.35.4` override already corrects, so the wallet-only npm consumer, which is held to a strictly clean audit, reported `sharp` plus the eight packages above it in the dependency chain. The [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks now carry `"sharp": "0.35.5"`, a patch-level move inside the pinned minor, and the README's Sharp note covers both advisories.
+
+`GHSA-hqr4-qq8f-hg3x` and `GHSA-mjw6-4jj6-33hc` cover `stream-json` below `3.6.0`, which the Solana RPC client's `jayson` requires as CommonJS on the optional AA path. `3.6.0` is still ESM-only under the moved `src/` layout, so like `GHSA-528h-pc64-c93x` they cannot be overridden without breaking `jayson`'s require, and both are now accepted for the npm and Bun AA consumers. Neither is reachable from a wallet. `stream-json@1.9.1` ships no JSONC parser, which the first covers, and `jayson` runs the `Assembler` the second covers only in its TCP and TLS transports, while the Solana RPC client uses `jayson/lib/client/browser`. The wallet-only npm consumer still has no waiver.
+
+The verifier's browser consumer moves from `vite@8.2.2` to `8.2.4`, clearing six Vite and bundled `launch-editor` advisories published on October 20 and 21 against its own build tooling.
+
+No published dependency or peer range changes.

packages/sei-global-wallet/README.md

@@ -26,7 +26,7 @@ Complete npm root overrides when the optional AA path is not enabled:
 {
 	"overrides": {
 		"axios": "1.20.0",
-		"sharp": "0.35.4",
+		"sharp": "0.35.5",
 		"uuid": "11.1.1",
 		"viem": {
 			"ws": "8.21.0"
@@ -40,7 +40,7 @@ Complete Bun root overrides. The block is the same with or without the optional
 {
 	"overrides": {
 		"axios": "1.20.0",
-		"sharp": "0.35.4",
+		"sharp": "0.35.5",
 		"uuid": "11.1.1"
 	}
 }
@@ -49,7 +49,7 @@ Complete Bun root overrides. The block is the same with or without the optional
 The Axios, Sharp, and UUID overrides are temporary until Dynamic updates its exact transitive pins:
 
 - Dynamic pins `axios@1.16.0` exactly, and `1.20.0` is the first release outside every advisory reported against it. The high-severity Axios issues are in Node-only transports (the HTTP adapter, opt-in HTTP/2, and `NO_PROXY` handling) or are prototype-pollution gadgets that need a separate pollution primitive in the same process. Browser wallet paths do not use the Node transports, which reduces exploitability but does not make the vulnerable install acceptable; the `toFormData` and fetch-adapter gadgets apply in browsers too.
-- The high-severity Sharp issue is the bundled libheif heap overflow reported as `GHSA-rgj7-g3m4-5g8c`, reached through `@dynamic-labs/iconic`'s exact `sharp@0.35.0` pin. It is only triggered by decoding untrusted HEIF input, which no wallet path does, and `sharp` is a build-time image dependency that never reaches a browser bundle. The override is a patch-level move within `0.35.x`, so it carries no API change.
+- `@dynamic-labs/iconic` pins `sharp@0.35.0` exactly, and `0.35.5` is the first release outside both high-severity Sharp advisories against it: the bundled libheif heap overflow `GHSA-rgj7-g3m4-5g8c`, triggered by decoding untrusted HEIF input, and the bundled librsvg memory bug `GHSA-wq5f-xc86-pv6w` (CVE-2026-96889), triggered by decoding untrusted SVG input, which can lead to remote code execution on glibc-based Linux. No wallet path decodes images, and `sharp` is a build-time image dependency that never reaches a browser bundle. The override is a patch-level move within `0.35.x`, so it carries no API change.
 - The UUID issue affects the v3, v5, and v6 buffer APIs. Dynamic's observed call sites use UUID v4, which reduces exploitability but does not clear the audit finding.
 
 Applications using the optional `./zerodev` / Dynamic account-abstraction path must also replace the vulnerable exact `bn.js@4.11.6` copies used by `ethjs-unit` and `number-to-bn`. The complete npm root override block is:
@@ -63,7 +63,7 @@ Applications using the optional `./zerodev` / Dynamic account-abstraction path m
 		"number-to-bn": {
 			"bn.js": "4.12.5"
 		},
-		"sharp": "0.35.4",
+		"sharp": "0.35.5",
 		"uuid": "11.1.1",
 		"viem": {
 			"ws": "8.21.0"
@@ -74,13 +74,15 @@ Applications using the optional `./zerodev` / Dynamic account-abstraction path m
 
 Bun 1.3.14 does not support nested overrides. Do **not** globally override `bn.js` or `ws`: Solana/borsh require bn5 while Jayson requires ws7. Bun's complete root override block is therefore the same with or without the optional AA path.
 
-For npm, scoped `bn.js@4.12.5` stays on the legacy dependencies' expected major while Solana resolves `bn.js@5.2.5`. Scoped `ws@8.21.0` patches Viem's ws8 subtree while Jayson resolves `ws@7.5.13` from its `^7.5.10` range. With the overrides above, a wallet-only npm install audits clean; the optional AA path carries the one `stream-json` advisory described below, on npm and Bun alike.
+For npm, scoped `bn.js@4.12.5` stays on the legacy dependencies' expected major while Solana resolves `bn.js@5.2.5`. Scoped `ws@8.21.0` patches Viem's ws8 subtree while Jayson resolves `ws@7.5.13` from its `^7.5.10` range. With the overrides above, a wallet-only npm install audits clean; the optional AA path carries the three `stream-json` advisories described below, on npm and Bun alike.
 
 The verifier builds its browser consumer against `viem@2.45.3`, because the previously tested 2.55.19 pulls Ox Tempo's `node:worker_threads` path into Vite resolution while 2.45.3 predates it. That is a property of the verifier's own bundle, not a constraint on applications: the published `viem` peer range stays `^2.7.12`. If your bundler externalizes `node:worker_threads` on a newer Viem, configure it in your application rather than downgrading.
 
-One advisory on the optional AA path has no fix any override can reach, on either package manager:
+Three advisories on the optional AA path have no fix any override can reach, on either package manager. All three are on `stream-json@1.9.1`, which the Solana RPC client's `jayson` requires as CommonJS. Every release outside them is ESM-only under a moved `src/` layout (`3.5.0` onward for the first, `3.6.0` onward for the other two), so overriding `stream-json` to a fixed version replaces the advisories with a `MODULE_NOT_FOUND` on `jayson`'s own require. `jayson` loads `stream-json` only in its TCP and TLS transports, and the Solana RPC client uses `jayson/lib/client/browser`, which never does:
 
-- `GHSA-528h-pc64-c93x` on `stream-json@1.9.1` — moderate, CVSS 6.2. Reached through the Solana RPC client's `jayson`, which requires `stream-json` as CommonJS. The advisory covers every version up to `3.4.0`, and `3.5.0` onward is ESM-only under a moved `src/` layout, so overriding it to a fixed version replaces the advisory with a `MODULE_NOT_FOUND` on `jayson`'s own require. The finding is an `O(depth²)` slowdown in the `pick`/`ignore`/`filter`/`replace` filters, reachable only by feeding crafted deeply nested JSON through them, which no wallet path does.
+- `GHSA-528h-pc64-c93x` — moderate, CVSS 6.2. An `O(depth²)` slowdown in the `pick`/`ignore`/`filter`/`replace` filters, reachable only by feeding crafted deeply nested JSON through them, which no wallet path does.
+- `GHSA-hqr4-qq8f-hg3x` — moderate, CVSS 6.2. A quadratic re-scan of long comments in the JSONC parser and verifier. `stream-json@1.9.1` ships no JSONC parser, so the advisory matches it by version range only.
+- `GHSA-mjw6-4jj6-33hc` — moderate, CVSS 5.1. A `__proto__` key in streamed JSON replaces the prototype of the object `Assembler` builds. `jayson` parses streams that way only in its TCP and TLS transports.
 
 For Bun, scoped overrides are unavailable, so the waiver also accepts these advisories that npm resolves with the scoped blocks above, while preserving compatible majors:
 

scripts/check-sei-global-wallet.ts

@@ -43,10 +43,17 @@ const fastCheck = process.env.SEI_GLOBAL_WALLET_FAST_CHECK === '1';
 // can excuse a finding an application gets from a plain install.
 //
 // `stream-json` is shared by both: the Solana RPC client's CommonJS `jayson`
-// requires it, and every version outside the advisory is ESM-only under a moved
-// `src/` layout, so an override turns the advisory into a MODULE_NOT_FOUND.
-const acceptedNpmAdvisories: readonly string[] = ['GHSA-528h-pc64-c93x'];
-const acceptedBunAdvisories: readonly string[] = ['GHSA-378v-28hj-76wf', 'GHSA-528h-pc64-c93x', 'GHSA-58qx-3vcg-4xpx', 'GHSA-96hv-2xvq-fx4p'];
+// requires it, and every version outside its advisories is ESM-only under a
+// moved `src/` layout, so an override turns them into a MODULE_NOT_FOUND.
+const acceptedNpmAdvisories: readonly string[] = ['GHSA-528h-pc64-c93x', 'GHSA-hqr4-qq8f-hg3x', 'GHSA-mjw6-4jj6-33hc'];
+const acceptedBunAdvisories: readonly string[] = [
+	'GHSA-378v-28hj-76wf',
+	'GHSA-528h-pc64-c93x',
+	'GHSA-58qx-3vcg-4xpx',
+	'GHSA-96hv-2xvq-fx4p',
+	'GHSA-hqr4-qq8f-hg3x',
+	'GHSA-mjw6-4jj6-33hc'
+];
 
 const manifest = JSON.parse(await readFile(join(packageDir, 'package.json'), 'utf8')) as {
 	dependencies: Record<string, string>;
@@ -167,7 +174,7 @@ const assertTestedPeersFitPublishedRanges = (testedPeerVersions: TestedPeerVersi
 // safe to apply globally.
 const baseSafeOverrides = {
 	axios: '1.20.0',
-	sharp: '0.35.4',
+	sharp: '0.35.5',
 	uuid: '11.1.1'
 };
 const overriddenTransitivePins = Object.keys(baseSafeOverrides);
@@ -226,7 +233,7 @@ const fullConsumerManifest = (tarball: string, packageManager: 'bun' | 'npm', dy
 	devDependencies: {
 		esbuild: '0.28.2',
 		typescript: '5.9.3',
-		vite: '8.2.2'
+		vite: '8.2.4'
 	},
 	overrides: packageManager === 'npm' ? npmSafeOverrides : baseSafeOverrides
 });