-
Notifications
You must be signed in to change notification settings - Fork 87
Feature/jss 110 security pin all versions v8 #950
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: naga
Are you sure you want to change the base?
Conversation
…rkspace references
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR pins all package versions to exact versions for security purposes, removing caret (^) and tilde (~) version ranges across the entire monorepo.
- Pin all dependency versions from flexible ranges (^, ~) to exact versions for enhanced security and reproducibility
- Update package manager tooling references from yarn to pnpm
- Add syncpack tooling for version management consistency
Reviewed Changes
Copilot reviewed 18 out of 19 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/wrapped-keys-lit-actions/src/index.ts | Removes extra blank lines in export statements |
| packages/wasm/package.json | Pins ethers and pako versions, updates yarn to pnpm in scripts |
| packages/types/package.json | Pins ethers version to exact 5.7.2 |
| packages/schemas/package.json | Pins ethers and siwe versions |
| packages/networks/package.json | Pins multiple dependencies including @noble/curves, ethers, pino |
| packages/logger/package.json | Pins pino version |
| packages/lit-client/package.json | Pins bs58 version |
| packages/e2e/package.json | Adds @lit-protocol/lit-status-sdk dependency |
| packages/crypto/package.json | Pins @noble/curves, @noble/hashes, ajv, and tslib versions |
| packages/contracts/package.json | Pins all devDependencies and peerDependencies, downgrades ethers from v6 to v5 |
| packages/constants/package.json | Pins @openagenda/verror and tslib versions |
| packages/auth/package.json | Pins multiple auth-related dependencies and updates peer dependency |
| packages/auth-services/package.json | Pins numerous service dependencies including express, redis, stytch |
| packages/auth-helpers/package.json | Pins @wagmi/core, ethers, and siwe versions |
| packages/artillery/package.json | Pins artillery version |
| packages/access-control-conditions/package.json | Pins ethers version |
| package.json | Comprehensive version pinning, adds syncpack tooling, updates package manager to pnpm |
| .vscode/settings.json | Updates VS Code color theme configuration |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| "express-rate-limit": "8.1.0", | ||
| "google-auth-library": "9.15.1", | ||
| "helmet": "8.1.0", | ||
| "jose": "4.14.4", |
Copilot
AI
Oct 14, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The jose library version is being downgraded from 6.0.7 to 4.14.4, which is a major version downgrade that may introduce breaking changes and security vulnerabilities from using an older version.
| "jose": "4.14.4", | |
| "jose": "6.0.7", |
…s-110-security-pin-all-versions-v8
WHAT
Pin all versions
^) in package.json files with fixed versions.