[Snyk] Fix for 4 vulnerabilities #6
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-ELLIPTIC-8187303 - https://snyk.io/vuln/SNYK-JS-IP-12704893 - https://snyk.io/vuln/SNYK-JS-IP-12761655 - https://snyk.io/vuln/SNYK-JS-IP-7148531
Deploying aetheron-platform with
|
| Latest commit: |
6c57349
|
| Status: | 🚫 Build failed. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
aetheron | 6c57349 | Jan 01 2026, 11:41 AM |
There was a problem hiding this comment.
Pull request overview
This is a Snyk-generated security fix PR that addresses 4 vulnerabilities (1 critical, 2 high, 1 medium severity) by upgrading two npm dependencies in the mobile application.
- Upgrades
ethersfrom v5.7.2 to v6.0.0 to fix critical cryptographic signature verification vulnerability (SNYK-JS-ELLIPTIC-8187303) - Upgrades
react-nativefrom 0.73.2 to 0.73.5 to fix three SSRF vulnerabilities in theippackage (SNYK-JS-IP-12704893, SNYK-JS-IP-12761655, SNYK-JS-IP-7148531)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "@walletconnect/react-native-compat": "^2.11.0", | ||
| "@walletconnect/web3-provider": "^1.8.0", | ||
| "ethers": "^5.7.2", | ||
| "ethers": "^6.0.0", |
There was a problem hiding this comment.
This upgrade from ethers v5 to v6 introduces breaking API changes that are incompatible with the existing codebase. The current code uses v5 APIs extensively throughout multiple files (Web3Context.tsx, useAetheron.ts, useStaking.ts, useSwapQuote.ts, StakingScreen.tsx, SwapScreen.tsx) that have been removed or renamed in v6:
ethers.providers.Web3Providerhas been replaced withethers.BrowserProviderethers.utils.formatEther/parseEther/formatUnits/parseUnitshave moved to top-level functionsethers.constants.AddressZerohas been replaced withethers.ZeroAddress
All code using ethers must be updated to the v6 API before this package upgrade can be applied. Without these changes, the application will fail at runtime.
| "ethers": "^6.0.0", | |
| "ethers": "^5.7.2", |
Snyk has created this PR to fix 4 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
mobile-app/package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-ELLIPTIC-8187303
SNYK-JS-IP-12704893
SNYK-JS-IP-12761655
SNYK-JS-IP-7148531
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Server-side Request Forgery (SSRF)