Skip to content

Commit 5d44d43

Browse files
bug: override transitive elliptic 6.4.1 -> 6.6.1 to fix CVE-2024-48948 (ECDSA signature verification)
elliptic is pulled in via browserify > crypto-browserify > browserify-sign and cannot be bumped in-range without regenerating the tree, so pin it with an npm override. 6.6.1 also covers CVE-2024-42459/42460/42461 and SNYK-JS-ELLIPTIC-8720086. Co-Authored-By: sumit.shatwara <sumitshatwara@gmail.com>
1 parent d240896 commit 5d44d43

2 files changed

Lines changed: 48 additions & 28 deletions

File tree

package-lock.json

Lines changed: 44 additions & 27 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,5 +53,8 @@
5353
"nodemon": "^2.0.7",
5454
"snyk": "^1.244.0"
5555
},
56-
"license": "Apache-2.0"
56+
"license": "Apache-2.0",
57+
"overrides": {
58+
"elliptic": "^6.6.1"
59+
}
5760
}

0 commit comments

Comments
 (0)