Skip to content

Harden supply chain security #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yosriady merged 2 commits into from
May 20, 2026
Merged

Harden supply chain security #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e729c1f
Harden supply chain security
yosriady May 20, 2026
73663dd
Sync lockfile specifier with pinned ethereum-cryptography
yosriady May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,3 +59,22 @@ jobs:

- name: Run tests
run: pnpm test

audit:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup pnpm
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
with:
version: 11.1.2

- name: Setup Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: "22.14.0"

- name: Audit production dependencies
run: pnpm audit --prod --audit-level=high
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
"lint": "tsc --noEmit"
},
"dependencies": {
"ethereum-cryptography": "^3.2.0"
"ethereum-cryptography": "3.2.0"
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Pinning a dependency to an exact version in a library's package.json can lead to dependency conflicts for consumers. It prevents the package manager from deduplicating the dependency if other packages in the consumer's tree require a compatible but different version. For libraries, it is generally recommended to use semver ranges (e.g., ^3.2.0) and rely on the lockfile for reproducible development.

Suggested change
"ethereum-cryptography": "3.2.0"
"ethereum-cryptography": "^3.2.0"

},
"devDependencies": {
"@swc/core": "^1.3.102",
Expand Down
2 changes: 1 addition & 1 deletion pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 2 additions & 3 deletions pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,8 @@ packages:
- '.'

# Supply-chain cooldown: don't resolve dependency versions until they
# are at least 2880 minutes (48h) old. pnpm 11's default is 1440 (24h);
# this preserves the explicit 48h policy from PR #14.
minimumReleaseAge: 2880
# are at least 10080 minutes (7d) old. pnpm 11's default is 1440 (24h).
minimumReleaseAge: 10080
Comment on lines +11 to +12
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

Setting minimumReleaseAge to 7 days (10080 minutes) significantly delays the availability of all new dependency versions, including critical security patches. While this mitigates the risk of "poisoned" packages, it introduces a window of vulnerability where the project cannot easily update to a patched version of a dependency after a vulnerability is disclosed. A shorter window (e.g., 24 to 48 hours) is typically sufficient to catch most malicious releases while allowing for faster response to legitimate security updates.

# are at least 2880 minutes (48h) old. pnpm 11's default is 1440 (24h).
minimumReleaseAge: 2880


# Dependency build-script policy (pnpm 11 strictDepBuilds default).
# Both packages ship prebuilt native bindings via platform-specific
Expand Down