[CHIA-3924] Fixed npm audit issue

[ChiaMineJP]

Summary

Resolves all high-severity npm audit vulnerabilities (0 remaining) and upgrades Node.js from 20 (approaching EOL April 2026) to 24.

Changes

Node.js upgrade (20 → 24)

• Updated .nvmrc to 24
• Updated all CI workflows (code-check.yml, audit.yml, extract-strings.yml, crowdin-push.yml, crowdin-pull.yml) to use Node 24.x / node:24
• This also upgrades npm from 10.x to 11.x, which enables version-specific override syntax

Security fixes via npm overrides

• minimatch@3.0.5 → 3.1.4 — ReDoS vulnerabilities (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74). Pinned by lerna@8.2.1 / @lerna/create.
• minimatch@9.0.3 → 9.0.9 — Same advisories. Pinned by nx@19.0.1 / @nx/devkit.
• rollup → 4.59.0 — Path traversal (GHSA-mw96-cpmx-2vgc)
• serialize-javascript → 7.0.4 — RCE via RegExp.flags (GHSA-5c6j-r48x-rmvq). Affects copy-webpack-plugin and terser-webpack-plugin.

Other dependency updates

• ajv 8.17.1 → 8.18.0 (direct devDependency)

Why overrides can't be removed

lerna@8.2.1 and nx@19.0.1 pin exact vulnerable minimatch versions in their dependencies. Until these packages release patched versions, the overrides are required. Upgrading nx to v22+ would fix its minimatch dependency but is a major version bump with breaking changes.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tailwindcss/​cli@​4.1.18 ⏵ 4.2.1	+1		+1	+2
	postcss@​8.5.6 ⏵ 8.5.8
	tailwindcss@​4.1.18 ⏵ 4.2.1	+1		+1
	rollup@​4.59.0
	ajv@​8.17.1 ⏵ 8.18.0		+2
	qs@​6.14.1 ⏵ 6.15.0	+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm caniuse-lite under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/package.json) From: package-lock.json → npm/webpack@5.105.1 → npm/styled-components@6.0.7 → npm/@lingui/cli@4.11.4 → npm/babel-loader@9.2.1 → npm/nyc@17.1.0 → npm/react-scroll-to-bottom@4.2.0 → npm/babel-core@7.0.0-bridge.0 → npm/@loadable/babel-plugin@5.16.1 → npm/@svgr/rollup@8.1.0 → npm/babel-plugin-styled-components@2.1.4 → npm/@babel/register@7.27.1 → npm/@babel/preset-react@7.27.1 → npm/@babel/preset-typescript@7.27.1 → npm/@babel/preset-env@7.27.2 → npm/@rollup/plugin-babel@6.0.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/plugin-transform-runtime@7.27.4 → npm/@svgr/webpack@8.1.0 → npm/jest@29.6.3 → npm/caniuse-lite@1.0.30001776 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001776. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @babel/core is 100.0% likely to have a medium risk anomaly Notes: The examined code is a standard, benign helper for constructing and wrapping configuration items from descriptors within Babel’s tooling. There is no evidence of data leakage, exfiltration, backdoors, or other malicious activity in this fragment. The combination of immutability, brand-based identity, and non-enumerable descriptor storage indicates a well-scoped internal utility rather than anything suspicious. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/styled-components@6.0.7 → npm/@lingui/cli@4.11.4 → npm/babel-loader@9.2.1 → npm/nyc@17.1.0 → npm/react-scroll-to-bottom@4.2.0 → npm/babel-core@7.0.0-bridge.0 → npm/@loadable/babel-plugin@5.16.1 → npm/@svgr/rollup@8.1.0 → npm/babel-plugin-styled-components@2.1.4 → npm/@babel/register@7.27.1 → npm/@babel/preset-react@7.27.1 → npm/@babel/preset-typescript@7.27.1 → npm/@babel/preset-env@7.27.2 → npm/@rollup/plugin-babel@6.0.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/core@7.27.4 → npm/@babel/plugin-transform-runtime@7.27.4 → npm/@svgr/webpack@8.1.0 → npm/jest@29.6.3 → npm/@babel/core@7.29.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/core@7.29.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: The code augments a meta-schema to permit remote dereferencing of keyword schemas via a hardcoded data.json resource. This introduces network dependency and potential changes to validation semantics at runtime. While not inherently malicious, the remote reference constitutes a notable security and reliability risk that should be mitigated with local fallbacks, input validation, and explicit remote-resource governance. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/eslint@8.57.1 → npm/ajv@6.14.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: The code is a straightforward build script to bundle and minify a specified package using Browserify and UglifyJS. The primary security concern is potential path manipulation: json.main is used to form a require path without validating that it stays within the target package directory. If a malicious or misconfigured package.json includes an absolute path or traversal outside the package, the script could bundle unintended files. Otherwise, the script does not perform network access, data exfiltration, or backdoor actions, and there is no hard-coded secrets or dynamic code execution beyond standard bundling/minification. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/eslint@8.57.1 → npm/ajv@6.14.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: The code implements a standard AJV-like dynamic parser generator for JTD schemas. There are no explicit malware indicators in this fragment. The primary security concern is the dynamic code generation and execution from external schemas, which introduces a medium risk if schemas are untrusted. With trusted schemas and proper schema management, the risk is typically acceptable within this pattern. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/ajv@8.18.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: The code implements standard timestamp validation with clear logic for normal and leap years and leap seconds. There is no network, file, or execution of external code within this isolated fragment. The only anomalous aspect is assigning a string to validTimestamp.code, which could enable external tooling to inject behavior in certain environments, but this does not constitute active malicious behavior in this isolated snippet. Overall, low to moderate security risk in typical usage; no malware detected within the shown code. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/ajv@8.18.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: This module generates JavaScript code at runtime via standaloneCode(...) and then immediately executes it with require-from-string. Because the generated code can incorporate user-supplied schemas or custom keywords without sanitization or sandboxing, an attacker who controls those inputs could inject arbitrary code and achieve remote code execution in the Node process. Users should audit and lock down the standaloneCode output or replace dynamic evaluation with a safer, static bundling approach. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/ajv@8.18.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[seeden]

maybe instead of patch we should just wait few hours until they will merge github/advisory-database#7002

[ChiaMineJP]

@seeden Right, the PR was merged. I'm removing patch-packages now

[ChiaMineJP]

@emlowe I've updated .nvmrc in order to simplify the fix for this audit issue. So this PR is taking over #2849

[emlowe]

code changes seem ok to me, but I can't match up the description with the actual code changes - perhaps the description needs an update