diff --git a/.changeset/security-pin-asyncapi.md b/.changeset/security-pin-asyncapi.md new file mode 100644 index 00000000..e8e8a173 --- /dev/null +++ b/.changeset/security-pin-asyncapi.md @@ -0,0 +1,14 @@ +--- +"@sei-js/create-sei": patch +"@sei-js/ledger": patch +"@sei-js/mcp-server": patch +"@sei-js/precompiles": patch +"@sei-js/registry": patch +"@sei-js/sei-global-wallet": patch +--- + +Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`. + +This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively. + +No shipped code or public API changes in this package — this is a repository/CI hardening release. diff --git a/CHANGELOG.md b/CHANGELOG.md index 825c32f0..a8de5d9e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1 +1,15 @@ # Changelog + +## 2.0.1 — 2026-07-22 + +### Security + +- Pin `@asyncapi/*` packages to non-compromised versions via `pnpm.overrides`, in + response to the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident. Stops a + fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the + compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). + - Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`. + - `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` + pinned preventively (not currently in the tree). + - No published `@sei-js/*` package's code or public API changes. A coordinated + patch release across all six packages carries this note for consumer visibility. diff --git a/package.json b/package.json index f839277c..4af7e934 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "sei-js", - "version": "2.0.0", + "version": "2.0.1", "private": true, "license": "MIT", "scripts": { @@ -25,5 +25,13 @@ "ts-node": "2.1.2", "typescript": "^5.8.2" }, - "packageManager": "pnpm@9.0.0" + "packageManager": "pnpm@9.0.0", + "pnpm": { + "overrides": { + "@asyncapi/specs": "6.11.1", + "@asyncapi/generator": "3.3.0", + "@asyncapi/generator-helpers": "1.1.0", + "@asyncapi/generator-components": "1.0.0" + } + } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4af8e54b..6a72d110 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,12 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + '@asyncapi/specs': 6.11.1 + '@asyncapi/generator': 3.3.0 + '@asyncapi/generator-helpers': 1.1.0 + '@asyncapi/generator-components': 1.0.0 + importers: .: @@ -227,8 +233,8 @@ packages: '@asyncapi/parser@3.4.0': resolution: {integrity: sha512-Sxn74oHiZSU6+cVeZy62iPZMFMvKp4jupMFHelSICCMw1qELmUHPvuZSr+ZHDmNGgHcEpzJM5HN02kR7T4g+PQ==} - '@asyncapi/specs@6.10.0': - resolution: {integrity: sha512-vB5oKLsdrLUORIZ5BXortZTlVyGWWMC1Nud/0LtgxQ3Yn2738HigAD6EVqScvpPsDUI/bcLVsYEXN4dtXQHVng==} + '@asyncapi/specs@6.11.1': + resolution: {integrity: sha512-A3WBLqAKGoJ2+6FWFtpjBlCQ1oFCcs4GxF7zsIGvNqp/klGUHjlA3aAcZ9XMMpLGE8zPeYDz2x9FmO6DSuKraQ==} '@babel/code-frame@7.27.1': resolution: {integrity: sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==} @@ -575,6 +581,7 @@ packages: '@cosmjs/crypto@0.32.4': resolution: {integrity: sha512-zicjGU051LF1V9v7bp8p7ovq+VyC91xlaHdsFOTo2oVry3KQikp8L/81RkXmUIT8FxMwdx1T7DmFwVQikcSDIw==} + deprecated: This uses elliptic for cryptographic operations, which contains several security-relevant bugs. To what degree this affects your application is something you need to carefully investigate. See https://github.com/cosmos/cosmjs/issues/1708 for further pointers. Starting with version 0.34.0 the cryptographic library has been replaced. However, private keys might still be at risk. '@cosmjs/encoding@0.32.4': resolution: {integrity: sha512-tjvaEy6ZGxJchiizzTn7HVRiyTg1i4CObRRaTRPknm5EalE13SV+TCHq38gIDfyUeden4fCuaBVEdBR5+ti7Hw==} @@ -1483,6 +1490,7 @@ packages: '@mintlify/cli@4.0.701': resolution: {integrity: sha512-TWxZqPivFvfxMHpHcfYwIWFOpLYxw0v0SUiIVfIVbLkF8IVf29GhaXsqXMdnWqqz0WujDc4nicZUMzIW8JaFDg==} engines: {node: '>=18.0.0'} + deprecated: This version is deprecated. Please upgrade to version 4.0.423 or later. hasBin: true '@mintlify/common@1.0.513': @@ -2048,6 +2056,7 @@ packages: '@ungap/structured-clone@1.3.0': resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==} + deprecated: Potential CWE-502 - Update to 1.3.1 or higher '@unrs/resolver-binding-android-arm-eabi@1.11.1': resolution: {integrity: sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==} @@ -2567,6 +2576,7 @@ packages: basic-ftp@5.0.5: resolution: {integrity: sha512-4Bcg1P8xhUuqcii/S0Z9wiHIrQVPMermM1any+MX5GeGD7faD3/msQUDGLol9wOcz4/jbg/WJnGqoJF6LiBdtg==} engines: {node: '>=10.0.0'} + deprecated: Security vulnerability fixed in 5.2.1, please upgrade bech32@1.1.4: resolution: {integrity: sha512-s0IrSOzLlbvX7yp4WBfPITzpAU8sqQcpsmwXDiKwrG4r491vwCO/XpejasRNl0piBMe/DvP4Tz0mIS/X1DPJBQ==} @@ -3633,11 +3643,12 @@ packages: glob@10.4.5: resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==} + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me hasBin: true glob@7.2.3: resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==} - deprecated: Glob versions prior to v9 are no longer supported + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me globalthis@1.0.4: resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==} @@ -4864,6 +4875,7 @@ packages: mint@4.2.97: resolution: {integrity: sha512-4DDWOJ1qQPgq+kWHQDApcPVsC3NLoEqlEauiMWF8CGQx+StgPYH/tipQaS7v1F9qBsSxBaZ8GTw8n08YOmSZKA==} engines: {node: '>=18.0.0'} + deprecated: This version is deprecated. Please upgrade to version 4.0.423 or later. hasBin: true mipd@0.0.7: @@ -5305,6 +5317,7 @@ packages: prebuild-install@7.1.3: resolution: {integrity: sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==} engines: {node: '>=10'} + deprecated: No longer maintained. Please contact the author of the relevant native addon; alternatives are available. hasBin: true prettier@2.8.8: @@ -5367,7 +5380,7 @@ packages: puppeteer@22.15.0: resolution: {integrity: sha512-XjCY1SiSEi1T7iSYuxS82ft85kwDJUS7wj1Z0eGVXKdtr5g4xnVcbjwxhq5xBnpK/E7x1VZZoJDxpjAOasHT4Q==} engines: {node: '>=18'} - deprecated: < 24.9.0 is no longer supported + deprecated: < 24.15.0 is no longer supported hasBin: true pure-rand@6.1.0: @@ -6004,6 +6017,7 @@ packages: tar@6.2.1: resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==} engines: {node: '>=10'} + deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me term-size@2.2.1: resolution: {integrity: sha512-wK0Ri4fOGjv/XPy8SBHZChl8CM7uMc5VML7SqiQ0zG7+J5Vr+RMQDoHa2CNT6KHUnTGIXH34UDMkPzAUyapBZg==} @@ -6345,6 +6359,7 @@ packages: uuid@8.3.2: resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==} + deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). hasBin: true v8-compile-cache-lib@3.0.1: @@ -6667,7 +6682,7 @@ snapshots: '@asyncapi/parser@3.4.0': dependencies: - '@asyncapi/specs': 6.10.0 + '@asyncapi/specs': 6.11.1 '@openapi-contrib/openapi-schema-to-json-schema': 3.2.0 '@stoplight/json': 3.21.0 '@stoplight/json-ref-readers': 1.2.2 @@ -6689,7 +6704,7 @@ snapshots: transitivePeerDependencies: - encoding - '@asyncapi/specs@6.10.0': + '@asyncapi/specs@6.11.1': dependencies: '@types/json-schema': 7.0.15