[ExcelDsigN-tech]

Overview

npm audit --audit-level=high failed in sdk/ (2 critical, 3 high), and sdk was not in the Security Gates npm-audit matrix, so nothing caught it. This patches the advisories and adds sdk to the matrix so the now-blocking job (#905) covers it.

Feature Summary

• vitest 2 to 5 (fixes vitest, vite and tinypool advisories; no 2.x patch exists)
• npm audit fix --ignore-scripts (no --force): zod 4.6.7, source-map-js 1.2.2
• sdk added to the npm-audit matrix in security-gates.yml
• AGENTS.md stack line updated to vitest 5

Technical Implementation

• Findings fixed: vitest <=4.1.10 (critical: UI server file read/exec, mocker path traversal), tinypool <=2.1.1 (critical: prototype pollution to RCE), vite <=6.4.3 (high: path traversal and related), zod <4.6.6 (high: memory exhaustion), source-map-js 1.0.0-1.2.1 (high: event-loop DoS). All are dev or transitive deps; the published package's only runtime dependency (@stellar/freighter-api) is unchanged.
• vitest 5 pulls vite 8 and requires Node ^22.12, which matches .nvmrc (22). The sdk has no vitest config file and the tests needed no changes.
• 11 low/moderate findings remain; they only clear with --force.

Test Coverage

• npm audit --audit-level=high in sdk/: exit 0 (was 1)
• ./scripts/ci-local.sh sdk supply: pass (lint, typecheck, 79/79 tests under vitest 5, build)
• The tsup "use client" ... was ignored build warnings are pre-existing: same 4 warnings building main
• This PR's Security Gates run includes the new npm audit (sdk) job

Checklists

General

• Ran ./scripts/ci-local.sh <area> and it passes
• Tests added or updated for the change (dependency-only; existing suite passes unchanged)
• No skipped tests, removed assertions or raised limits
• Docs updated if behaviour changed (AGENTS.md stack line)
• Conventional Commits title and messages
• Security-sensitive change: .github/THREAT_MODEL.md attached and maintainer review requested

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f8b9d4d8-0d0d-4ab8-8fb1-190124d0633f

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn