10BC0 fix: bump openpgp (CVE-2025-47934) · input-output-hk/lace@c9829ce · GitHub
[go: up one dir, main page]
Skip to content

Commit c9829ce

Browse files
przemyslaw-wlodekprzemyslaw-wlodek
committed
fix: bump openpgp (CVE-2025-47934)
1 parent 10a2996 commit c9829ce

File tree

6 files changed

+19
-13
lines changed

6 files changed

+19
-13
lines changed

‎apps/browser-extension-wallet/package.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,6 @@
9898
"little-state-machine": "4.8.0",
9999
"lodash": "4.17.21",
100100
"node-abort-controller": "^3.1.1",
101-
"openpgp": "^5.11.2",
102101
"p-debounce": "^4.0.0",
103102
"pluralize": "^8.0.0",
104103
"posthog-js": "^1.161.3",

‎apps/browser-extension-wallet/src/utils/pgp.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* eslint-disable unicorn/no-null */
2-
import { createMessage, decrypt, encrypt, readKey, readMessage, readPrivateKey, decryptKey } from 'openpgp';
2+
import { createMessage, decrypt, encrypt, readKey, readMessage, readPrivateKey, decryptKey, enums } from 'openpgp';
33
import type { Key, MaybeArray, Message, PartialConfig, PrivateKey, PublicKey } from 'openpgp';
44
import { i18n } from '@lace/translation';
55
import type { PublicPgpKeyData } from '@src/types';
@@ -127,7 +127,7 @@ export const encryptMessageWithPgpAsBinaryFormat = async ({
127127
signingKeys: privateKeys,
128128
format: 'binary',
129129
config: {
130-
deflateLevel: 9
130+
preferredCompressionAlgorithm: enums.compression.zlib
131131
}
132132
});
133133

‎apps/browser-extension-wallet/test/jest.setup.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,12 @@ if (typeof global.TextDecoder === 'undefined') {
2828
global.TextDecoder = TextDecoder;
2929
}
3030

31+
// Add WebCrypto API polyfill, required for openpgp.js
32+
const { webcrypto } = require('node:crypto');
33+
if (typeof global.crypto === 'undefined') {
34+
global.crypto = webcrypto;
35+
}
36+
3137
// Add Uint8Array to prototype chain of Buffer, so that it behaves the same in jsdom as in nodejs and polyfilled browser env
3238
let Type = Buffer;
3339
while (Type.prototype) Type = Type.prototype;

‎package.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,12 +110,14 @@
110110
"ws@^8.4.2": "^8.17.1",
111111
"ws@^8.5.0": "^8.17.1",
112112
"ws@^8.8.0": "^8.17.1",
113-
"axios": "^1.9.0"
113+
"axios": "^1.9.0",
114+
"openpgp": "^6.1.1"
114115
},
115116
"dependencies": {
116117
"@input-output-hk/lace-ui-toolkit": "3.5.0",
117118
"axios": "^1.9.0",
118119
"normalize.css": "^8.0.1",
120+
"openpgp": "^6.1.1",
119121
"uuid": "^8.3.2"
120122
},
121123
"devDependencies": {

‎test/createJestConfig.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ const esmExceptions = jestEsmExceptions([
1818
'p-retry',
1919
'p-debounce',
2020
'react-icons',
21-
'bip32'
21+
'bip32',
22+
'openpgp'
2223
]);
2324

2425
const rootDir = process.cwd();

‎yarn.lock‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12500,7 +12500,6 @@ __metadata:
1250012500
lodash: 4.17.21
1250112501
node-abort-controller: ^3.1.1
1250212502
npm-run-all: 4.1.5
12503-
openpgp: ^5.11.2
1250412503
p-debounce: ^4.0.0
1250512504
pluralize: ^8.0.0
1250612505
posthog-js: ^1.161.3
@@ -26470,7 +26469,7 @@ __metadata:
2647026469
languageName: node
2647126470
linkType: hard
2647226471

26473-
"asn1.js@npm:^5.0.0, asn1.js@npm:^5.2.0":
26472+
"asn1.js@npm:^5.2.0":
2647426473
version: 5.4.1
2647526474
resolution: "asn1.js@npm:5.4.1"
2647626475
dependencies:
@@ -43021,6 +43020,7 @@ __metadata:
4302143020
node-sass: 9.0.0
4302243021
normalize.css: ^8.0.1
4302343022
npm-run-all: 4.1.5
43023+
openpgp: ^6.1.1
4302443024
p-retry: 5.1.2
4302543025
postcss: 8.4.31
4302643026
prettier: ^2.3.2
@@ -46955,12 +46955,10 @@ __metadata:
4695546955
languageName: node
4695646956
linkType: hard
4695746957

46958-
"openpgp@npm:^5.11.2":
46959-
version: 5.11.2
46960-
resolution: "openpgp@npm:5.11.2"
46961-
dependencies:
46962-
asn1.js: ^5.0.0
46963-
checksum: 1e7627e4dc89add906cb0c1060b50dfcee40817fd425a5077b7c1abe44f5176d2433d66f1dfca0ad04f3c69bb3714f1a3afca1c578f40c436941266feecfa679
46958+
"openpgp@npm:^6.1.1":
46959+
version: 6.1.1
46960+
resolution: "openpgp@npm:6.1.1"
46961+
checksum: 364efcaf6fb308e59d777adaa874dbe716962f5adbcafaff263cfc2754820af278f5455cc6955025d366fab9b1a0a0b170f2a3c2069f9d8d79f44cd55c13fbb5
4696446962
languageName: node
4696546963
linkType: hard
4696646964

0 commit comments

Comments
 (0)
0