fix(deps-update): bump cipher-base from 1.0.4 to 1.0.7 #6491

dependabot · 2025-11-06T15:59:49Z

Bumps cipher-base from 1.0.4 to 1.0.7.

Changelog

v1.0.7 - 2025-09-24

Commits

[Refactor] use to-buffer fd1e5ee

[Dev Deps] update @ljharb/eslint-config 08ba803

v1.0.6 - 2024-11-26

Commits

[Fix] io.js 3.0 - Node.js 5.3 typed array support b7ddd2a

v1.0.5 - 2024-11-17

Commits

[Tests] standard -> eslint, make test dir, etc ae02fd6

[Tests] migrate from travis to GHA 66387d7

[meta] fix package.json indentation 5c02918

[Fix] return valid values on multi-byte-wide TypedArray input 8fd1364

[meta] add auto-changelog 88dc806

[meta] add npmignore and safe-publish-latest 7a137d7

Only apps should have lockfiles 42528f2

[Deps] update inherits, safe-buffer 0e7a2d9

[meta] add missing engines.node f2dc13e

Commits

0056718 v1.0.7
fd1e5ee [Refactor] use to-buffer
08ba803 [Dev Deps] update @ljharb/eslint-config
f5249f9 v1.0.6
b7ddd2a [Fix] io.js 3.0 - Node.js 5.3 typed array support
f03cebf v1.0.5
88dc806 [meta] add auto-changelog
7a137d7 [meta] add npmignore and safe-publish-latest
5c02918 [meta] fix package.json indentation
8fd1364 [Fix] return valid values on multi-byte-wide TypedArray input
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for cipher-base since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

vercel · 2025-11-06T15:59:53Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
cowfi	Ready	Preview	Nov 12, 2025 3:07pm
explorer-dev	Ready	Preview	Nov 12, 2025 3:07pm
swap-dev	Ready	Preview	Nov 12, 2025 3:07pm
widget-configurator	Ready	Preview	Nov 12, 2025 3:07pm

2 Skipped Deployments

Project	Deployment	Preview	Updated (UTC)
cosmos	Ignored		Nov 12, 2025 3:07pm
sdk-tools	Ignored	Preview	Nov 12, 2025 3:07pm

coderabbitai · 2025-11-06T16:00:07Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

socket-security · 2025-11-11T22:11:56Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Quality
	@babel/preset-react@7.27.1
	@commitlint/cli@20.1.0
	@cowprotocol/sdk-subgraph@0.2.0
	@lingui/macro@5.5.1
	@metamask/jazzicon@2.0.0
	@lingui/vite-plugin@5.5.1
	@cowprotocol/sdk-cow-shed@0.1.10
	@cowprotocol/sdk-ethers-v5-adapter@0.2.0
	@1inch/permit-signed-approvals-utils@1.4.10
	@material-ui/core@4.12.4
	@cowprotocol/cow-sdk@7.1.0
	@lingui/react@5.5.1
	@ethersproject/experimental@5.8.0
	@cowprotocol/sdk-composable@0.1.10
	@cowprotocol/cow-runner-game@0.2.9
	@babel/runtime@7.27.0
	@lingui/core@5.5.1
	@cowprotocol/sdk-bridging@0.6.0
	@lingui/cli@5.5.1
	@cowprotocol/cms@0.11.0
	@emotion/styled@10.3.0 ⏵ 11.14.0	⁺³
	@eslint/eslintrc@3.3.1
	@fortawesome/fontawesome-svg-core@6.7.2
	@fortawesome/free-regular-svg-icons@6.7.1
	@gnosis.pm/dex-js@0.10.0
	@emotion/react@11.14.0
	@metamask/eth-sig-util@5.1.0
	@fortawesome/free-solid-svg-icons@6.7.1
	@mui/icons-material@5.17.1
	@commitlint/config-conventional@20.0.0
	@coinbase/wallet-sdk@3.9.3
	@apollo/client@3.8.8
	@metamask/sdk@0.31.4
See 3 more rows in the dashboard

View full report

socket-security · 2025-11-11T22:11:57Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code in npm `@babel/traverse` CVE: GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (CRITICAL) Affected versions: < 7.23.2; >= 8.0.0-alpha.0 < 8.0.0-alpha.4 Patched version: 7.23.2 From: `?` → `npm/@babel/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Bumps [cipher-base](https://github.com/crypto-browserify/cipher-base) from 1.0.4 to 1.0.7. - [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md) - [Commits](browserify/cipher-base@v1.0.4...v1.0.7) --- updated-dependencies: - dependency-name: cipher-base dependency-version: 1.0.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 6, 2025

vercel bot temporarily deployed to Preview – sdk-tools November 6, 2025 16:22 Inactive

vercel bot deployed to Preview – cowfi November 6, 2025 16:57 View deployment

vercel bot deployed to Preview – widget-configurator November 6, 2025 17:21 View deployment

vercel bot deployed to Preview – swap-dev November 6, 2025 17:24 View deployment

vercel bot deployed to Preview – explorer-dev November 6, 2025 17:27 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/cipher-base-1.0.7 branch from f7a1503 to 2100388 Compare November 7, 2025 22:10

vercel bot deployed to Preview – cowfi November 7, 2025 22:38 View deployment

vercel bot deployed to Preview – widget-configurator November 7, 2025 22:50 View deployment

vercel bot deployed to Preview – swap-dev November 7, 2025 22:51 View deployment

vercel bot deployed to Preview – explorer-dev November 7, 2025 22:51 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/cipher-base-1.0.7 branch from 2100388 to aa40002 Compare November 10, 2025 22:12

vercel bot deployed to Preview – widget-configurator November 10, 2025 22:33 View deployment

vercel bot deployed to Preview – explorer-dev November 10, 2025 22:33 View deployment

vercel bot deployed to Preview – swap-dev November 10, 2025 22:35 View deployment

vercel bot deployed to Preview – cowfi November 10, 2025 22:36 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/cipher-base-1.0.7 branch from aa40002 to bf5807a Compare November 11, 2025 22:11

vercel bot deployed to Preview – explorer-dev November 11, 2025 22:35 View deployment

vercel bot deployed to Preview – widget-configurator November 11, 2025 22:36 View deployment

vercel bot deployed to Preview – swap-dev November 11, 2025 22:38 View deployment

vercel bot deployed to Preview – cowfi November 11, 2025 22:42 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/cipher-base-1.0.7 branch from bf5807a to 05bce7c Compare November 12, 2025 13:48

vercel bot deployed to Preview – widget-configurator November 12, 2025 13:54 View deployment

vercel bot deployed to Preview – explorer-dev November 12, 2025 13:55 View deployment

vercel bot deployed to Preview – swap-dev November 12, 2025 13:56 View deployment

vercel bot deployed to Preview – cowfi November 12, 2025 15:07 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps-update): bump cipher-base from 1.0.4 to 1.0.7 #6491

fix(deps-update): bump cipher-base from 1.0.4 to 1.0.7 #6491

Uh oh!

dependabot bot commented on behalf of github Nov 6, 2025 •

edited

Loading

Uh oh!

vercel bot commented Nov 6, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Nov 6, 2025 •

edited

Loading

Review skipped

Uh oh!

socket-security bot commented Nov 11, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Nov 11, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fix(deps-update): bump cipher-base from 1.0.4 to 1.0.7 #6491

Are you sure you want to change the base?

fix(deps-update): bump cipher-base from 1.0.4 to 1.0.7 #6491

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.0.7 - 2025-09-24

Commits

v1.0.6 - 2024-11-26

Commits

v1.0.5 - 2024-11-17

Commits

Uh oh!

vercel bot commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

socket-security bot commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Nov 6, 2025 •

edited

Loading

vercel bot commented Nov 6, 2025 •

edited

Loading

coderabbitai bot commented Nov 6, 2025 •

edited

Loading

socket-security bot commented Nov 11, 2025 •

edited

Loading

socket-security bot commented Nov 11, 2025 •

edited

Loading