Raise marlin-wallet-web's direct fast-uri pin from ^3.1.5 (resolved 3.1.5) to ^3.1.7 so ajv and the web package pick up 3.1.6/3.1.7 patches for SSRF, host confusion, and authority injection (GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp, GHSA-qw65-cvwx-89v3, GHSA-58mr-gqgx-xq4g).
Details
Details
- Reviewers
PiRK - Group Reviewers
Restricted Project - Commits
- rABC973520f2db49: [marlin-wallet] Bump fast-uri to ^3.1.7 for SSRF and host-confusion fixes
pnpm install --lockfile-only && rg 'fast-uri@' pnpm-lock.yaml
Diff Detail
Diff Detail
- Repository
- rABC Bitcoin ABC
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Comment Actions
Tail of the build log:
-- Performing Test have_C__Wcast_align_strict - Success -- Performing Test have_C__Wno_duplicated_branches -- Performing Test have_C__Wno_duplicated_branches - Success -- Performing Test USE_ASM_X86_64 -- Performing Test USE_ASM_X86_64 - Success -- Performing Test have_linker__Wl___no_undefined -- Performing Test have_linker__Wl___no_undefined - Success -- Found Event component event: /usr/lib/x86_64-linux-gnu/libevent.so -- Found Event: /usr/include (found suitable version "2.1.12-stable", minimum required is "2.1.8") found components: event -- Found Boost component headers: /usr/include (found suitable version "1.74.0", minimum required is "1.64") -- Found Event component pthreads: /usr/lib/x86_64-linux-gnu/libevent_pthreads.so -- Found Event: /usr/include (found suitable version "2.1.12-stable", minimum required is "2.1.8") found components: pthreads -- Performing Test fuzz_target_builds_without_main_fuzz -- Performing Test fuzz_target_builds_without_main_fuzz - Failed -- Found BerkeleyDB component CXX: /usr/lib/x86_64-linux-gnu/libdb_cxx-5.3.so -- Found BerkeleyDB: /usr/include (found suitable version "5.3.28", minimum required is "5.3") found components: CXX -- Found SQLite3: /usr/include (found suitable version "3.40.1", minimum required is "3.7.17") -- Found ZeroMQ component zmq: /usr/lib/x86_64-linux-gnu/libzmq.so -- Found ZeroMQ: /usr/include (found suitable version "4.3.4", minimum required is "4.1.5") -- Could NOT find Protobuf (missing: Protobuf_DIR) -- Found Protobuf: /usr/lib/x86_64-linux-gnu/libprotobuf.so (found version "3.21.12") -- Found OpenSSL: /usr/lib/x86_64-linux-gnu/libcrypto.so (found version "3.0.20") -- Looking for EVP_MD_CTX_new -- Looking for EVP_MD_CTX_new - found -- Found QREncode component qrencode: /usr/lib/x86_64-linux-gnu/libqrencode.so -- Found QREncode: /usr/include [1/9] Creating directories for 'corrosion-populate' [1/9] Performing download step (git clone) for 'corrosion-populate' Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing -- Had to git clone more than once: 3 times. CMake Error at corrosion-subbuild/corrosion-populate-prefix/tmp/corrosion-populate-gitclone.cmake:39 (message): Failed to clone repository: 'https://github.com/corrosion-rs/corrosion.git' FAILED: corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download /work/abc-ci-builds/ecash-lib-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download cd /work/abc-ci-builds/ecash-lib-integration-tests/_deps && /usr/bin/cmake -P /work/abc-ci-builds/ecash-lib-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/tmp/corrosion-populate-gitclone.cmake && /usr/bin/cmake -E touch /work/abc-ci-builds/ecash-lib-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download ninja: build stopped: subcommand failed. CMake Error at /usr/share/cmake-3.25/Modules/FetchContent.cmake:1616 (message): Build step for corrosion failed: 1 Call Stack (most recent call first): /usr/share/cmake-3.25/Modules/FetchContent.cmake:1756:EVAL:2 (__FetchContent_directPopulate) /usr/share/cmake-3.25/Modules/FetchContent.cmake:1756 (cmake_language) /usr/share/cmake-3.25/Modules/FetchContent.cmake:1970 (FetchContent_Populate) cmake/modules/RustHelper.cmake:9 (FetchContent_MakeAvailable) chronik/CMakeLists.txt:6 (include) -- Configuring incomplete, errors occurred! See also "/work/abc-ci-builds/ecash-lib-integration-tests/CMakeFiles/CMakeOutput.log". See also "/work/abc-ci-builds/ecash-lib-integration-tests/CMakeFiles/CMakeError.log". Build ecash-lib-integration-tests failed with exit code 1
Comment Actions
Tail of the build log:
-- Performing Test have_C__Wcast_align_strict - Success -- Performing Test have_C__Wno_duplicated_branches -- Performing Test have_C__Wno_duplicated_branches - Success -- Performing Test USE_ASM_X86_64 -- Performing Test USE_ASM_X86_64 - Success -- Performing Test have_linker__Wl___no_undefined -- Performing Test have_linker__Wl___no_undefined - Success -- Found Event component event: /usr/lib/x86_64-linux-gnu/libevent.so -- Found Event: /usr/include (found suitable version "2.1.12-stable", minimum required is "2.1.8") found components: event -- Found Boost component headers: /usr/include (found suitable version "1.74.0", minimum required is "1.64") -- Found Event component pthreads: /usr/lib/x86_64-linux-gnu/libevent_pthreads.so -- Found Event: /usr/include (found suitable version "2.1.12-stable", minimum required is "2.1.8") found components: pthreads -- Performing Test fuzz_target_builds_without_main_fuzz -- Performing Test fuzz_target_builds_without_main_fuzz - Failed -- Found BerkeleyDB component CXX: /usr/lib/x86_64-linux-gnu/libdb_cxx-5.3.so -- Found BerkeleyDB: /usr/include (found suitable version "5.3.28", minimum required is "5.3") found components: CXX -- Found SQLite3: /usr/include (found suitable version "3.40.1", minimum required is "3.7.17") -- Found ZeroMQ component zmq: /usr/lib/x86_64-linux-gnu/libzmq.so -- Found ZeroMQ: /usr/include (found suitable version "4.3.4", minimum required is "4.1.5") -- Could NOT find Protobuf (missing: Protobuf_DIR) -- Found Protobuf: /usr/lib/x86_64-linux-gnu/libprotobuf.so (found version "3.21.12") -- Found OpenSSL: /usr/lib/x86_64-linux-gnu/libcrypto.so (found version "3.0.20") -- Looking for EVP_MD_CTX_new -- Looking for EVP_MD_CTX_new - found -- Found QREncode component qrencode: /usr/lib/x86_64-linux-gnu/libqrencode.so -- Found QREncode: /usr/include [1/9] Creating directories for 'corrosion-populate' [1/9] Performing download step (git clone) for 'corrosion-populate' Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing -- Had to git clone more than once: 3 times. CMake Error at corrosion-subbuild/corrosion-populate-prefix/tmp/corrosion-populate-gitclone.cmake:39 (message): Failed to clone repository: 'https://github.com/corrosion-rs/corrosion.git' FAILED: corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download /work/abc-ci-builds/ecash-agora-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download cd /work/abc-ci-builds/ecash-agora-integration-tests/_deps && /usr/bin/cmake -P /work/abc-ci-builds/ecash-agora-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/tmp/corrosion-populate-gitclone.cmake && /usr/bin/cmake -E touch /work/abc-ci-builds/ecash-agora-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download ninja: build stopped: subcommand failed. CMake Error at /usr/share/cmake-3.25/Modules/FetchContent.cmake:1616 (message): Build step for corrosion failed: 1 Call Stack (most recent call first): /usr/share/cmake-3.25/Modules/FetchContent.cmake:1756:EVAL:2 (__FetchContent_directPopulate) /usr/share/cmake-3.25/Modules/FetchContent.cmake:1756 (cmake_language) /usr/share/cmake-3.25/Modules/FetchContent.cmake:1970 (FetchContent_Populate) cmake/modules/RustHelper.cmake:9 (FetchContent_MakeAvailable) chronik/CMakeLists.txt:6 (include) -- Configuring incomplete, errors occurred! See also "/work/abc-ci-builds/ecash-agora-integration-tests/CMakeFiles/CMakeOutput.log". See also "/work/abc-ci-builds/ecash-agora-integration-tests/CMakeFiles/CMakeError.log". Build ecash-agora-integration-tests failed with exit code 1
Comment Actions
Tail of the build log:
-- Performing Test have_C__Wcast_align_strict - Success -- Performing Test have_C__Wno_duplicated_branches -- Performing Test have_C__Wno_duplicated_branches - Success -- Performing Test USE_ASM_X86_64 -- Performing Test USE_ASM_X86_64 - Success -- Performing Test have_linker__Wl___no_undefined -- Performing Test have_linker__Wl___no_undefined - Success -- Found Event component event: /usr/lib/x86_64-linux-gnu/libevent.so -- Found Event: /usr/include (found suitable version "2.1.12-stable", minimum required is "2.1.8") found components: event -- Found Boost component headers: /usr/include (found suitable version "1.74.0", minimum required is "1.64") -- Found Event component pthreads: /usr/lib/x86_64-linux-gnu/libevent_pthreads.so -- Found Event: /usr/include (found suitable version "2.1.12-stable", minimum required is "2.1.8") found components: pthreads -- Performing Test fuzz_target_builds_without_main_fuzz -- Performing Test fuzz_target_builds_without_main_fuzz - Failed -- Found BerkeleyDB component CXX: /usr/lib/x86_64-linux-gnu/libdb_cxx-5.3.so -- Found BerkeleyDB: /usr/include (found suitable version "5.3.28", minimum required is "5.3") found components: CXX -- Found SQLite3: /usr/include (found suitable version "3.40.1", minimum required is "3.7.17") -- Found ZeroMQ component zmq: /usr/lib/x86_64-linux-gnu/libzmq.so -- Found ZeroMQ: /usr/include (found suitable version "4.3.4", minimum required is "4.1.5") -- Could NOT find Protobuf (missing: Protobuf_DIR) -- Found Protobuf: /usr/lib/x86_64-linux-gnu/libprotobuf.so (found version "3.21.12") -- Found OpenSSL: /usr/lib/x86_64-linux-gnu/libcrypto.so (found version "3.0.20") -- Looking for EVP_MD_CTX_new -- Looking for EVP_MD_CTX_new - found -- Found QREncode component qrencode: /usr/lib/x86_64-linux-gnu/libqrencode.so -- Found QREncode: /usr/include [1/9] Creating directories for 'corrosion-populate' [1/9] Performing download step (git clone) for 'corrosion-populate' Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing -- Had to git clone more than once: 3 times. CMake Error at corrosion-subbuild/corrosion-populate-prefix/tmp/corrosion-populate-gitclone.cmake:39 (message): Failed to clone repository: 'https://github.com/corrosion-rs/corrosion.git' FAILED: corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download /work/abc-ci-builds/ecash-wallet-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download cd /work/abc-ci-builds/ecash-wallet-integration-tests/_deps && /usr/bin/cmake -P /work/abc-ci-builds/ecash-wallet-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/tmp/corrosion-populate-gitclone.cmake && /usr/bin/cmake -E touch /work/abc-ci-builds/ecash-wallet-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download ninja: build stopped: subcommand failed. CMake Error at /usr/share/cmake-3.25/Modules/FetchContent.cmake:1616 (message): Build step for corrosion failed: 1 Call Stack (most recent call first): /usr/share/cmake-3.25/Modules/FetchContent.cmake:1756:EVAL:2 (__FetchContent_directPopulate) /usr/share/cmake-3.25/Modules/FetchContent.cmake:1756 (cmake_language) /usr/share/cmake-3.25/Modules/FetchContent.cmake:1970 (FetchContent_Populate) cmake/modules/RustHelper.cmake:9 (FetchContent_MakeAvailable) chronik/CMakeLists.txt:6 (include) -- Configuring incomplete, errors occurred! See also "/work/abc-ci-builds/ecash-wallet-integration-tests/CMakeFiles/CMakeOutput.log". See also "/work/abc-ci-builds/ecash-wallet-integration-tests/CMakeFiles/CMakeError.log". Build ecash-wallet-integration-tests failed with exit code 1
Comment Actions
Tail of the build log:
-- Performing Test have_C__Wcast_align_strict - Success -- Performing Test have_C__Wno_duplicated_branches -- Performing Test have_C__Wno_duplicated_branches - Success -- Performing Test USE_ASM_X86_64 -- Performing Test USE_ASM_X86_64 - Success -- Performing Test have_linker__Wl___no_undefined -- Performing Test have_linker__Wl___no_undefined - Success -- Found Event component event: /usr/lib/x86_64-linux-gnu/libevent.so -- Found Event: /usr/include (found suitable version "2.1.12-stable", minimum required is "2.1.8") found components: event -- Found Boost component headers: /usr/include (found suitable version "1.74.0", minimum required is "1.64") -- Found Event component pthreads: /usr/lib/x86_64-linux-gnu/libevent_pthreads.so -- Found Event: /usr/include (found suitable version "2.1.12-stable", minimum required is "2.1.8") found components: pthreads -- Performing Test fuzz_target_builds_without_main_fuzz -- Performing Test fuzz_target_builds_without_main_fuzz - Failed -- Found BerkeleyDB component CXX: /usr/lib/x86_64-linux-gnu/libdb_cxx-5.3.so -- Found BerkeleyDB: /usr/include (found suitable version "5.3.28", minimum required is "5.3") found components: CXX -- Found SQLite3: /usr/include (found suitable version "3.40.1", minimum required is "3.7.17") -- Found ZeroMQ component zmq: /usr/lib/x86_64-linux-gnu/libzmq.so -- Found ZeroMQ: /usr/include (found suitable version "4.3.4", minimum required is "4.1.5") -- Could NOT find Protobuf (missing: Protobuf_DIR) -- Found Protobuf: /usr/lib/x86_64-linux-gnu/libprotobuf.so (found version "3.21.12") -- Found OpenSSL: /usr/lib/x86_64-linux-gnu/libcrypto.so (found version "3.0.20") -- Looking for EVP_MD_CTX_new -- Looking for EVP_MD_CTX_new - found -- Found QREncode component qrencode: /usr/lib/x86_64-linux-gnu/libqrencode.so -- Found QREncode: /usr/include [1/9] Creating directories for 'corrosion-populate' [1/9] Performing download step (git clone) for 'corrosion-populate' Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing Cloning into 'corrosion-src'... fatal: could not read Username for 'https://github.com': No such device or address fatal: expected flush after ref listing -- Had to git clone more than once: 3 times. CMake Error at corrosion-subbuild/corrosion-populate-prefix/tmp/corrosion-populate-gitclone.cmake:39 (message): Failed to clone repository: 'https://github.com/corrosion-rs/corrosion.git' FAILED: corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download /work/abc-ci-builds/chronik-client-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download cd /work/abc-ci-builds/chronik-client-integration-tests/_deps && /usr/bin/cmake -P /work/abc-ci-builds/chronik-client-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/tmp/corrosion-populate-gitclone.cmake && /usr/bin/cmake -E touch /work/abc-ci-builds/chronik-client-integration-tests/_deps/corrosion-subbuild/corrosion-populate-prefix/src/corrosion-populate-stamp/corrosion-populate-download ninja: build stopped: subcommand failed. CMake Error at /usr/share/cmake-3.25/Modules/FetchContent.cmake:1616 (message): Build step for corrosion failed: 1 Call Stack (most recent call first): /usr/share/cmake-3.25/Modules/FetchContent.cmake:1756:EVAL:2 (__FetchContent_directPopulate) /usr/share/cmake-3.25/Modules/FetchContent.cmake:1756 (cmake_language) /usr/share/cmake-3.25/Modules/FetchContent.cmake:1970 (FetchContent_Populate) cmake/modules/RustHelper.cmake:9 (FetchContent_MakeAvailable) chronik/CMakeLists.txt:6 (include) -- Configuring incomplete, errors occurred! See also "/work/abc-ci-builds/chronik-client-integration-tests/CMakeFiles/CMakeOutput.log". See also "/work/abc-ci-builds/chronik-client-integration-tests/CMakeFiles/CMakeError.log". Build chronik-client-integration-tests failed with exit code 1
Comment Actions
Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review
Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────
(\(\
(• .•) Fun fact: 'idempotent' doesn't mean 'it usually works'.
────────────────────────────────────────
Review complete
No findings ✔
2 files reviewed:
- apps/marlin-wallet/web/package.json
- pnpm-lock.yaml
────────────────────────────────────────
Comment Actions
Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review
Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────
(\(\
(• .•) Nice abstraction. Shame about the reality underneath it.
────────────────────────────────────────
Review complete
No findings ✔
2 files reviewed:
- apps/marlin-wallet/web/package.json
- pnpm-lock.yaml
────────────────────────────────────────