Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade eosjs from 20.0.3 to 22.1.0 #1

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

naiba4
Copy link
Owner

@naiba4 naiba4 commented Aug 31, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to upgrade eosjs from 20.0.3 to 22.1.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


Warning: This is a major version upgrade, and may be a breaking change.

  • The recommended version is 110 versions ahead of your current version.
  • The recommended version was released 2 years ago, on 2021-07-13.
Release notes
Package name: eosjs
  • 22.1.0 - 2021-07-13
    Read more
  • 22.1.0-74-4f30fd7 - 2021-07-13
  • 22.1.0-73-f29efff - 2021-07-09
  • 22.1.0-70-6434716 - 2021-07-08
  • 22.1.0-69-ca26f30 - 2021-07-08
  • 22.1.0-68-9c8d70d - 2021-07-06
  • 22.1.0-67-9dafdfa - 2021-07-01
  • 22.1.0-66-ee54e3b - 2021-07-01
  • 22.1.0-65-34b9bbc - 2021-07-01
  • 22.1.0-64-d0ab284 - 2021-07-01
  • 22.1.0-63-009def8 - 2021-07-01
  • 22.1.0-62-b89fc92 - 2021-06-30
  • 22.1.0-61-2c1d6ae - 2021-06-01
  • 22.1.0-60-ed34147 - 2021-06-01
  • 22.1.0-59-17838a0 - 2021-06-01
  • 22.1.0-58-5125a54 - 2021-05-28
  • 22.1.0-57-e8a23a7 - 2021-05-20
  • 22.0.0 - 2021-05-20

    This release is the stable release of EOSJS v22.0.0 and contains features, security, stability and miscellaneous fixes. Please note that since this release promotes EOSJS v22.0.0-rc2 to v22.0.0 (stable), using the @ latest tag will now automatically cause an upgrade from v21.0.x to v22.0.0.

    Support for Action Return Values

    This release introduces support for the new feature of return values from actions within smart contracts. More information can be found here in the documentation for eosio.cdt and here in the documentation specific to eosjs.

    Additionally, an example application has been created to demonstrate how to use this new feature with nodeos and eosjs.

    Support for Key Value Databases

    This release introduces support for the new key value database feature. More information can be found here in the documentation for eosio.cdt and here in the documentation specific to eosjs.

    Due to differences in the format of key value databases in smart contract ABIs, abi.abi.json has been removed and added directly into the code of eosjs-serialize.ts.

    A new data type in EOSIO.CDT v1.8.0 called eosio::kv::map provides the underlying functionality and should be used in contracts over the type called eosio::kv::table that is currently in a developer preview state.

    Additionally, an example application has been created to demonstrate how to use this new feature with nodeos and eosjs.

    New Method for Constructing Actions and Transactions

    A concise new method for constructing actions has been added to improve the developer experience. It is now possible to either construct an action in either a shorter syntax or construct both actions and transactions by creating a stateful TransactionBuilder object that can be passed through an application before sending when ready. The details for this concise method can be found here in the eosjs documentation.

    BREAKING CHANGE: New Endpoints and Typescript Types for Nodeos API Plugins

    New endpoints have been added to eosjs to match the latest versions of the api plugins. New Typescript types have been added to assist developers in better understanding what to expect from certain features or responses from the nodeos api plugins. The goal of these new types is to facilitate accurate typescript support and additional documentation for eosjs but there is the possibility of backwards incompatibility. In these situations, it is advised to override the affected types with any or a user-defined type.

    Other Changes

    • (#742) Removing RC1 from develop version
    • (#776) Merging changes from master or release/21.0.x that were not on develop
    • (#777) add bn.js as explicit dependency
    • (#778) Adding testing for Action return values
    • (#779) Documentation for action return values
    • (#780) Updating abi.abi.json to eosio::abi/1.2
    • (#789) Bumping develop version to 21.1.0
    • (#784) Additional types for documentation/development
    • (#792) Context Free Tests/Fixes
    • (#791) Allowing a name to be an empty string (develop branch)
    • (#796) Fixing an issue with response from fetch in the query method
    • (#803) Code to support KV Tables
    • (#804) updating how-to-get-table-information with kv example
    • (#805) Adjusting bios contracts and adding kv_bios
    • (#812) New chain_api endpoints and more efficient Tapos fields
    • (#813) Documentation for new transaction shorthand design
    • (#831) Adjusting CI/CD to use new bios/boot systems (release/22.0.x)
    • (#832) Webpack separating external packages and cross-platform building (release/22.0.x)
    • (#834) Additional types for JsonRPC endpoints (release/22.0.x)
    • (#841) Adding two pipelines for release branch for ci/cd (release 22.0.x)
    • (#849) Updating dependencies of eosjs to latest possible versions (release/22.0.x)
    • (#847) Switching to eosio/eosio docker image in CI/CD (release/22.0.x)
    • (#860) Bump docker/setup-qemu-action from 6520a2d2cb6db42c90c297c8025839c98e531268 to 1.0.2
    • (#863) Bump actions/setup-node from c6fd00ceb9747fb23ffdf72987450a2664414867 to 2.1.5
    • (#866) Bump docker/setup-buildx-action from 154c24e1f33dbb5865a021c99f1318cfebf27b32 to 1.1.2
    • (#869) Bump cypress-io/github-action from 6e9b583c9652e99b72b042a3957980fc6166efae to 2.9.11
    • (#873) Bump actions/checkout from f90c7b395dac7c5a277c1a6d93d5057c1cddb74e to 2.3.4
    • (#907) Bump webpack from 5.33.2 to 5.34.0
    • (#895) Bump cypress from 6.9.1 to 7.1.0
    • (#892) Bump docker/build-push-action from 4a531fa5a603bab87dfa56578bd82b28508c9547 to 2.4.0
    • (#897) Bump cypress-io/github-action from 89161930792c0050baeba2737caa058c395ecfcb to 2.9.12
    • (#900) Bump ts-loader from 8.1.0 to 9.0.0
    • (#920) Bump docker/setup-qemu-action from 25f0500ff22e406f7191a2a8ba8cda16901ca018 to 1.1.0
    • (#921) Bump docker/setup-buildx-action from 2a4b53665e15ce7d7049afb11ff1f70ff1610609 to 1.2.0
    • (#928) Bump docker/setup-buildx-action from 012185ccbeb554a7f5f987bea0f1a73519b3cdf5 to 1.3.0
    • (#929) Bump docker/login-action from f3364599c6aa293cdc2b8391b1b56d0c30e45c8a to 1.9.0
    • (#933) Bump cypress-io/github-action from 62779d1ffd6210d6f246a8f708cf937d2beac1e9 to 2.10.1
    • (#935) Adjusting the eosjs key value documentation (release/22.0.x branch)
    • (#938) Bumping version to v22.0.0
    • (#940) Merging master into release/22.0.x

    Thanks!

    Special thanks to the community contributors that submitted patches for this release:

    Disclaimer: All repositories and other materials are provided subject to this IMPORTANT notice and you must familiarize yourself with its terms. The notice contains important information, limitations and restrictions relating to our software, publications, trademarks, third-party resources, and forward-looking statements. By accessing any of our repositories and other materials, you accept and agree to the terms of the notice.

  • 22.0.0-rc2 - 2021-02-17

    This is a RELEASE CANDIDATE for version 22.0.0. The latest STABLE release is v21.0.3.

    This Release Candidate can be accessed by running yarn add eosjs@RC.

    BREAKING CHANGE: New Endpoints and Typescript Types for Nodeos API Plugins

    More endpoints and types have been added to eosjs to match the latest versions of the api plugins. The goal of these types is to facilitate accurate typescript support and additional documentation for eosjs but there is the possibility of backwards incompatibility. In these situations, it is advised to override the affected types with any or a user-defined type at this time.

    Other Changes

    • (#831) Adjusting CI/CD to use new bios/boot systems (release/22.0.x)
    • (#832) Webpack separating external packages and cross-platform building (release/22.0.x)
    • (#834) Additional types for JsonRPC endpoints (release/22.0.x)

    Disclaimer: All repositories and other materials are provided subject to this IMPORTANT notice and you must familiarize yourself with its terms. The notice contains important information, limitations and restrictions relating to our software, publications, trademarks, third-party resources, and forward-looking statements. By accessing any of our repositories and other materials, you accept and agree to the terms of the notice.

  • 22.0.0-rc1 - 2020-12-15

    This is a RELEASE CANDIDATE for version 22.0.0. The latest STABLE release is v21.0.3.

    This Release Candidate can be accessed by running yarn add eosjs@RC.

    Support for Action Return Values

    This release candidate introduces support for the new feature of return values from actions within smart contracts. More information can be found here in the documentation for eosio.cdt and here in the documentation specific to eosjs.

    Additionally, an example application has been created to demonstrate how to use this new feature with nodeos and eosjs.

    Support for Key Value Databases

    This release candidate introduces support for the new key value database feature. More information can be found here in the documentation for eosio.cdt and here in the documentation specific to eosjs.

    Due to difference in the format of key value databases in smart contract ABIs, abi.abi.json has been removed and added directly into the code of eosjs-serialize.ts.

    Additionally, an example application has been created to demonstrate how to use this new feature with nodeos and eosjs.

    New Method for Constructing Actions and Transactions

    A concise new method for constructing actions has been added to improve the developer experience. It is now possible to either construct an action in either a shorter syntax or construct both actions and transactions by creating a stateful TransactionBuilder object that can be passed through an application before sending when ready. The details for this concise method can be found here in the eosjs documentation.

    BREAKING CHANGE: Additional Typescript Types/Nodeos API Plugin Responses

    New Typescript types have been added to assist developers in better understanding what to expect from certain features or responses from the nodeos api plugins. These types are defined for the latest versions of the api plugins which have changed, specifically the response for submitting a transaction.

    Other Changes

    • (#742) Removing RC1 from develop version
    • (#776) Merging changes from master or release/21.0.x that were not on develop
    • (#777) add bn.js as explicit dependency
    • (#778) Adding testing for Action return values
    • (#779) Documentation for action return values
    • (#780) Updating abi.abi.json to eosio::abi/1.2
    • (#789) Bumping develop version to 21.1.0
    • (#784) Additional types for documentation/development
    • (#792) Context Free Tests/Fixes
    • (#791) Allowing a name to be an empty string (develop branch)
    • (#796) Fixing an issue with response from fetch in the query method
    • (#803) Code to support KV Tables
    • (#804) updating how-to-get-table-information with kv example
    • (#805) Adjusting bios contracts and adding kv_bios
    • (#812) New chain_api endpoints and more efficient Tapos fields
    • (#813) Documentation for new transaction shorthand design

    Thanks!

    Special thanks to the community contributors that submitted patches for this release:

    Disclaimer: All repositories and other materials are provided subject to this IMPORTANT notice and you must familiarize yourself with its terms. The notice contains important information, limitations and restrictions relating to our software, publications, trademarks, third-party resources, and forward-looking statements. By accessing any of our repositories and other materials, you accept and agree to the terms of the notice.

  • 21.1.0-56-5e4c707 - 2021-05-20
  • 21.1.0-55-ce3f2be - 2021-05-18
  • 21.1.0-54-1663a4c - 2021-05-18
  • 21.1.0-53-840f800 - 2021-05-18
  • 21.1.0-52-82f1a1e - 2021-05-17
  • 21.1.0-51-5bc1ca0 - 2021-04-29
  • 21.1.0-50-367c0dc - 2021-04-29
  • 21.1.0-49-1c4a7f2 - 2021-04-20
  • 21.1.0-48-8d54b10 - 2021-04-20
  • 21.1.0-47-2a0f8bf - 2021-04-20
  • 21.1.0-46-b91ef8d - 2021-04-20
  • 21.1.0-45-fb08c97 - 2021-04-16
  • 21.1.0-44-8a09605 - 2021-04-16
  • 21.1.0-43-19538db - 2021-04-16
  • 21.1.0-42-0380992 - 2021-04-15
  • 21.1.0-41-eff9609 - 2021-04-15
  • 21.1.0-40-c707726 - 2021-04-15
  • 21.1.0-39-bd2f3b5 - 2021-04-07
  • 21.1.0-38-ae8c65a - 2021-03-24
  • 21.1.0-37-f695d47 - 2021-03-23
  • 21.1.0-36-fac425d - 2021-03-23
  • 21.1.0-35-3ec6730 - 2021-02-24
  • 21.1.0-34-bb61c84 - 2021-02-19
  • 21.1.0-33-584cf8f - 2021-02-17
  • 21.1.0-32-8065061 - 2021-02-10
  • 21.1.0-31-6067080 - 2021-02-10
  • 21.1.0-30-c3b2962 - 2021-02-09
  • 21.1.0-29-d765fc3 - 2020-11-20
  • 21.1.0-28-3664985 - 2020-11-20
  • 21.1.0-27-2e51a04 - 2020-11-20
  • 21.1.0-26-c8af9dc - 2020-11-19
  • 21.1.0-25-707787d - 2020-10-12
  • 21.1.0-24-c73b44d - 2020-09-29
  • 21.1.0-23-08dc543 - 2020-09-21
  • 21.1.0-22-95f1f9b - 2020-09-11
  • 21.1.0-21-ca1b301 - 2020-09-11
  • 21.1.0-20-c31c737 - 2020-08-19
  • 21.1.0-19-ed75695 - 2020-08-12
  • 21.0.4 - 2021-04-19

    This release contains security, stability, and miscellaneous fixes.

    Other Changes

    • (#856) Allowing a name to be an empty string
    • (#857) Addressing identified security vulnerabilities (y18n, elliptic, node-notifier, ini, node-fetch)
    • (#858) Bumping version to 21.0.4

    Thanks!

    Special thanks to the community contributors that submitted patches for this release:

    Disclaimer: All repositories and other materials are provided subject to this IMPORTANT notice and you must familiarize yourself with its terms. The notice contains important information, limitations and restrictions relating to our software, publications, trademarks, third-party resources, and forward-looking statements. By accessing any of our repositories and other materials, you accept and agree to the terms of the notice.

  • 21.0.3 - 2020-08-12
    Read more
  • 21.0.3-18-7739b8c - 2020-08-11
  • 21.0.3-17-796555b - 2020-08-05
  • 21.0.3-16-61a8bdf - 2020-07-28
  • 21.0.3-15-12c1d1e - 2020-07-27
  • 21.0.3-14-3d0b936 - 2020-07-24
  • 21.0.3-12-8c17f52 - 2020-07-15
  • 21.0.3-11-6da6936 - 2020-07-15
  • 21.0.2 - 2020-07-14
    Read more
  • 21.0.2-rc3 - 2020-06-24
    Read more
  • 21.0.1-rc3 - 2020-06-16
  • 21.0.1-rc2 - 2020-02-07
  • 21.0.1-rc1 - 2020-01-16
  • 21.0.1-9-c4814f3 - 2020-06-12
  • 21.0.1-8-f252e2a - 2020-06-09
  • 21.0.1-7-52bdc54 - 2020-06-09
  • 21.0.1-6-5bba805 - 2020-06-08
  • 21.0.1-5-f0b92e8 - 2020-06-08
  • 21.0.1-4-edd9641 - 2020-06-08
  • 21.0.1-3-e95c391 - 2020-06-08
  • 21.0.1-10-275c3bb - 2020-06-24
  • 21.0.0-rc1 - 2020-01-16
  • 21.0.0-ea5150e.0 - 2020-01-29
  • 21.0.0-ccc1b7e.0 - 2020-05-29
  • 21.0.0-b64e61e.0 - 2020-02-11
  • 21.0.0-b10b79d.0 - 2020-04-10
  • 21.0.0-a6ad012.0 - 2020-04-06
  • 21.0.0-9b03ef8.0 - 2020-02-06
  • 21.0.0-92cf49f.0 - 2020-01-16
  • 21.0.0-8deba86.0 - 2020-05-28
  • 21.0.0-75f449c.0 - 2020-01-31
  • 21.0.0-6c2ef05.0 - 2020-06-05
  • 21.0.0-646cad9.0 - 2020-05-21
  • 21.0.0-60fa818.0 - 2020-02-04
  • 21.0.0-489474c.0 - 2020-02-05
  • 21.0.0-45854c1.0 - 2020-03-13
  • 21.0.0-443b8c8.0 - 2020-01-23
  • 21.0.0-3c17dd8.0 - 2020-02-10
  • 21.0.0-37d6d0f.0 - 2020-02-04
  • 21.0.0-2f4c99f.0 - 2020-02-06
  • 21.0.0-28594c3.0 - 2020-02-12
  • 21.0.0-2-f93a703-rc1 - 2020-06-08
  • 21.0.0-131a987.0 - 2020-01-23
  • 21.0.0-0a31612.0 - 2020-01-16
  • 21.0.0-01fbd4a.0 - 2020-02-11
  • 20.0.4-e2c667e.0 - 2019-12-11
  • 20.0.4-ccbd83e.0 - 2020-01-03
  • 20.0.4-b3eb443.0 - 2020-01-03
  • 20.0.4-7938e1a.0 - 2020-01-03
  • 20.0.4-67ee21f.0 - 2019-12-09
  • 20.0.4-3f9295a.0 - 2020-01-16
  • 20.0.3 - 2020-01-16
from eosjs GitHub release notes

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@socket-security
Copy link

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives Size Publisher
eosjs 20.0.3...22.1.0 None +9/-28 2.39 MB b1serviceaccount

@socket-security
Copy link

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Issue Package Version Note Source
Chronological version anomaly bn.js 4.12.0
Unmaintained bn.js 4.12.0
  • Last Publish: 5/24/2022, 10:36:50 AM
Unmaintained bn.js 5.2.0
  • Last Publish: 5/24/2022, 10:36:50 AM
Unmaintained brorand 1.1.0
  • Last Publish: 2/22/2017, 9:39:22 PM
Unmaintained minimalistic-assert 1.0.1
  • Last Publish: 4/11/2018, 12:21:23 PM
Unmaintained hash.js 1.1.7
  • Last Publish: 11/30/2018, 7:50:03 PM
Unmaintained elliptic 6.5.4
  • Last Publish: 2/2/2021, 6:22:21 PM
Unmaintained minimalistic-crypto-utils 1.0.1
  • Last Publish: 2/22/2017, 9:20:57 PM
Unmaintained hmac-drbg 1.0.1
  • Last Publish: 4/9/2017, 10:33:31 PM

Next steps

What is a chronological version anomaly?

Semantic versions published out of chronological order.

This could either indicate dependency confusion or a patched vulnerability.

What are unmaintained packages?

Package has not been updated in more than a year and may be unmaintained. Problems with the package may go unaddressed.

Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] bar@* or ignore all packages with @SocketSecurity ignore-all

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants