-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Snyk] Security upgrade @ledgerhq/ledger-core from 6.10.0 to 6.14.5 #40
base: develop
Are you sure you want to change the base?
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-TAR-6476909
Lint outputs ✅
Tests outputs ❌
FAIL tests/specs/account.spec.js
● Account › should start in this state
● Account › should start in this state
● Account › add accounts flow › for dogecoin
● Account › add accounts flow › for dogecoin
● Account › add accounts flow › for xrp
● Account › add accounts flow › for xrp
● Account › add accounts flow › for ethereum_classic
● Account › add accounts flow › for ethereum_classic
● Account › add accounts flow › for tezos
● Account › add accounts flow › for tezos
● Account › add accounts flow › for cosmos
● Account › add accounts flow › for cosmos
● Account › add token accounts flow › token when parent missing
● Account › add token accounts flow › token when parent missing
● Account › add token accounts flow › receive token when subAccount exist already
● Account › add token accounts flow › receive token when subAccount exist already
● Account › add token accounts flow › receive new token
● Account › add token accounts flow › receive new token
● Account › account flows › account migration flow
● Account › account flows › account migration flow
● Account › account flows › receive flow
● Account › account flows › receive flow
● Account › account flows › send flow
● Account › account flows › send flow
● Account › account flows › cosmos delegate flow
● Account › account flows › cosmos delegate flow
● Account › account flows › tezos delegate flow
● Account › account flows › tezos delegate flow
● Account › remove accounts flow › displays a list of accounts
● Account › remove accounts flow › displays a list of accounts
● Account › remove accounts flow › remove one account
● Account › remove accounts flow › remove one account
FAIL tests/specs/onboarding.spec.js
● Onboarding › should start in this state
● Onboarding › should start in this state
● Onboarding › go through start
● Onboarding › go through start
● Onboarding › accept terms
● Onboarding › accept terms
● Onboarding › selects nanoX
● Onboarding › selects nanoX
● Onboarding › goes through the tutorial
● Onboarding › goes through the tutorial
● Onboarding › gets started
● Onboarding › gets started
● Onboarding › goest to pincode
● Onboarding › goest to pincode
● Onboarding › goest to pincode 2
● Onboarding › goest to pincode 2
● Onboarding › goest to recovery phrase
● Onboarding › goest to recovery phrase
● Onboarding › goest to recovery phrase 2
● Onboarding › goest to recovery phrase 2
● Onboarding › goest to recovery phrase 3
● Onboarding › goest to recovery phrase 3
● Onboarding › goest to recovery phrase 4
● Onboarding › goest to recovery phrase 4
● Onboarding › goest to quizz
● Onboarding › goest to quizz
● Onboarding › finished the quizz
● Onboarding › finished the quizz
● Onboarding › goest to connect
● Onboarding › goest to connect
● Onboarding › check nano
● Onboarding › check nano
● Onboarding › should be on app
● Onboarding › should be on app
FAIL tests/specs/swap.spec.js
● Swap › should start in this state
● Swap › should start in this state
● Swap › access the feature
● Swap › access the feature
● Swap › pass KYC landing
● Swap › pass KYC landing
● Swap › fill the form and get rates
● Swap › fill the form and get rates
● Swap › confirm summary step
● Swap › confirm summary step
● Swap › confirm swap on device and broadcast step
● Swap › confirm swap on device and broadcast step
● Swap › should appear in the history
● Swap › should appear in the history
FAIL tests/specs/firmwareupdate.spec.js
● Firmware Update › should start in this state
● Firmware Update › should start in this state
● Firmware Update › access manager
● Firmware Update › access manager
● Firmware Update › firmware update flow-1
● Firmware Update › firmware update flow-1
● Firmware Update › firmware update flow-2
● Firmware Update › firmware update flow-2
● Firmware Update › firmware update flow-3
● Firmware Update › firmware update flow-3
● Firmware Update › firmware update flow-5
● Firmware Update › firmware update flow-5
● Firmware Update › firmware update flow-6
● Firmware Update › firmware update flow-6
● Firmware Update › firmware update flow-7
● Firmware Update › firmware update flow-7
● Firmware Update › firmware update flow-8
● Firmware Update › firmware update flow-8
● Firmware Update › firmware update flow-9
● Firmware Update › firmware update flow-9
FAIL tests/specs/settings.spec.js
● Settings › should start in this state
● Settings › should start in this state
● Settings › naive discreet mode toggle and assorted screens
● Settings › naive discreet mode toggle and assorted screens
Test Suites: 5 failed, 5 total Diff output ✅
|
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.
Changes included in this PR
Note for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/
directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarn
to update the contents of the./yarn/cache
directory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed
With an upgrade:
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.5
SNYK-JS-TAR-6476909
(*) Note that the real score may have changed since the PR was raised.
Check the changes in this PR to ensure they won't cause issues with your project.
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
🛠 Adjust project settings
📚 Read more about Snyk's upgrade and patch logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Uncontrolled Resource Consumption ('Resource Exhaustion')