[jayantk]

Summary

This PR bumps the dependencies in the example lockfiles to versions that fix critical and high advisories. Every bump stays inside the semver range already in each package.json or Cargo.toml. The only manifest changes are next 14.2.x → 14.2.35 in entropy/growing/app and price_feeds/fuel/fetch-and-update-btc-price.

How the lockfiles were changed:

• npm: npm audit fix --package-lock-only (without --force), then npm update <pkg> on the vulnerable packages that were still in range.
• pnpm: pnpm update --lockfile-only <pkg> (pnpm 10; the lockfile format is still 9.0).
• Cargo: cargo update -p <crate> for bytes, openssl, tracing-subscriber, crossbeam-channel, crossbeam-epoch, ring 0.17.x, tar and rkyv 0.7.45 → 0.7.46.
  • lazer/publisher pins rustc 1.75.0 in its rust-toolchain file. openssl there goes to 0.10.78 and openssl-sys to 0.9.114. These are the newest versions that build on rustc 1.75 (openssl 0.10.79 and later need rustc 1.80). 0.10.78 fixes the advisories up to 0.10.72, but it still has GHSA-xp3w-r5p5-63rr (high, fixed in 0.10.79) and two moderate advisories. See "Advisories left open".

@pythnetwork/pyth-fuel-js stays at its current version in both Fuel examples. Version 1.1.0 pulls in fuels 0.101, which breaks sdk_js_usage (Provider.create was removed).

Lockfiles that were out of sync on main

On main, npm ci fails in entropy/growing/app, price_feeds/starknet/sdk_js_usage and price_feeds/starknet/send_usd/client, because their lockfiles no longer match package.json. This PR regenerates those lockfiles, and npm ci now passes in all three.

Results (osv-scanner)

osv-scanner scan source -r ., before and after:

Lockfile	All before	All after	High/critical before	High/critical after
entropy/coin_flip/app/package-lock.json	95	33	46	19
entropy/growing/app/package-lock.json	93	41	53	23
lazer/js/pnpm-lock.yaml	14	10	10	7
lazer/publisher/Cargo.lock	25	11¹	5	1¹
lazer/solana-anchor/Cargo.lock	14	11	0	0
lazer/solana-anchor/pnpm-lock.yaml	44	28	27	16
lazer/solana/Cargo.lock	81	66	8	6
lazer/stellar/Cargo.lock	2	2	0	0
lazer/stellar/client/package-lock.json	7	5	7	5
price_feeds/aptos/mint_nft/app/package-lock.json	210	48	115	21
price_feeds/evm/chainlink_migration/package-lock.json	27	21	10	4
price_feeds/evm/my_first_pyth_app/app/package-lock.json	42	0	19	0
price_feeds/evm/oracle_swap/app/package-lock.json	239	57	125	28
price_feeds/fuel/fetch-and-update-btc-price/package-lock.json	226	58	131	32
price_feeds/fuel/sdk_js_usage/package-lock.json	107	11	60	8
price_feeds/solana/send_usd/app/package-lock.json	269	69	143	34
price_feeds/solana/send_usd/program/Cargo.lock	25	24	0	0
price_feeds/starknet/sdk_js_usage/package-lock.json	70	2	34	1
price_feeds/starknet/send_usd/client/package-lock.json	71	2	35	1
price_feeds/ton/sdk_js_usage/package-lock.json	87	3	47	2
price_feeds/ton/send_usd/package-lock.json	88	12	47	7
pro/frontend-jwt-auth/pnpm-lock.yaml	31	29	16	14
Total	1867	543	938	229

¹ osv-scanner reported 8 and 0 when openssl was at 0.10.81. The later pin to 0.10.78 reopens three openssl advisories (one high), per the OSV database. osv-scanner was not rerun after the pin.

Advisories left open

Fix needs a major bump of a direct dependency or a chain SDK

• next 14.2.35: the remaining advisories are fixed only in 15.5.x or later.
• react-scripts (CRA) in the aptos, oracle_swap and solana apps: svgo, nth-check, postcss 7, webpack-dev-server, webpack-dev-middleware, serialize-javascript, node-forge. CRA is unmaintained, so these have no in-range fix.
• web3 1.x and @truffle/hdwallet-provider (coin_flip, oracle_swap): request/form-data 2.3.3, tar 4 (via swarm-js), secp256k1 4.0.3, semver 5.4.1.
• zod 3 → 4, uuid → 11, protobufjs 6 → 7 in older trees, toml (via @stellar/stellar-sdk and fuels), tmp 0.0.33, @ton/blueprint, @fuels/connectors, fuels/@pythnetwork/pyth-fuel-js.
• Rust: ed25519-dalek 1 → 2, curve25519-dalek 3 → 4, quinn-proto 0.10 → 0.11, rustls 0.21 / rustls-webpki 0.101 → 0.103, webpki-roots, h2 0.3 → 0.4 and ring 0.16 (all from Solana 1.18 in lazer/solana), plus crypto-bigint 0.5 → 0.7 (lazer/stellar). rkyv 0.8.17 is needed only for RUSTSEC-2026-0235.

Fix needs a newer rustc than the pinned toolchain

• openssl 0.10.78 in lazer/publisher: GHSA-xp3w-r5p5-63rr (high, fixed in 0.10.79), GHSA-xv59-967r-8726 (moderate, fixed in 0.10.79) and GHSA-phqj-4mhp-q6mq (moderate, fixed in 0.10.80). openssl 0.10.79 and later need rustc 1.80, and lazer/publisher/rust-toolchain pins rustc 1.75.0. Fixing these needs a toolchain bump in that example.

Fixed version exists in-major but a parent pins an exact version

A fix would need npm overrides or a newer parent, so these are left as is:

• postcss 8.4.31: pinned by next 14.2.35.
• ws 8.17.x/8.18.x: pinned by ethers/viem/@walletconnect.
• protobufjs 7.4.0/7.5.5: pinned by @trezor/protobuf (solana app).
• underscore 1.13.6: pinned by jsonpath.
• lodash 4.17.21: pinned by @walletconnect/universal-provider.
• @openzeppelin/contracts 4.7.3: pinned by @arbitrum/nitro-contracts (chainlink_migration).
• glob/minimatch 9.0.3: pinned by eslint-config-next.
• js-yaml 4.1.0, minimatch 4.2.1, nanoid 3.3.1: pinned by mocha 9 (solana-anchor).

bigint-buffer and http-cache-semantics have no fix.

Checks run

Each check ran on this branch and on main, with Node 24.12. "Same on main" means the check fails the same way on main.

Example	Command	Result
entropy/coin_flip/app	npm ci && npm run build	pass
entropy/growing/app	npm ci && next build	pass (npm ci fails on main)
lazer/js	pnpm@9.2.0 install --frozen-lockfile && pnpm test	pass
lazer/solana-anchor	pnpm@10 install --frozen-lockfile	pass
lazer/solana-anchor	pnpm run lint	fail, same on main (prettier issues in 2 files)
lazer/stellar/client	npm ci && npm test	pass
price_feeds/aptos/mint_nft/app	npm ci && npm run build	pass
price_feeds/evm/chainlink_migration	npm ci	pass
price_feeds/evm/my_first_pyth_app/app	npm ci	pass
price_feeds/evm/oracle_swap/app	npm ci && npm run build	pass without CI=true; with CI=true it fails the same as main (unused env lint warning)
price_feeds/fuel/fetch-and-update-btc-price	npm ci	pass
price_feeds/fuel/fetch-and-update-btc-price	next build	fail, same on main (needs fuels build output in src/sway-api)
price_feeds/fuel/sdk_js_usage	npm ci && npm run compile	pass
price_feeds/solana/send_usd/app	npm ci && npm run build	pass
price_feeds/starknet/sdk_js_usage, send_usd/client	npm ci && npm run compile	pass (npm ci fails on main)
price_feeds/ton/sdk_js_usage	npm ci && npm run compile	pass
price_feeds/ton/send_usd	npm ci && PYTH_CONTRACT_ADDRESS=<addr> jest	pass (1 test)
pro/frontend-jwt-auth	pnpm@9.2.0 install --frozen-lockfile, test:format, test:types, build	pass
lazer/publisher	rustc 1.81.0: cargo +1.81.0 clippy --all-targets --locked -- -D warnings	pass
lazer/publisher	rustc 1.75.0 (rust-toolchain): cargo +1.75.0 test --locked	pass
lazer/solana	rustc 1.81.0: cargo +1.81.0 clippy --all-targets --locked -- -D warnings	pass
lazer/solana	rustc 1.89.0 (Solana 3.1.10 platform-tools v1.52): cargo build-sbf -- --locked	pass
lazer/solana	rustc 1.75.0 (rust-toolchain): cargo test --locked, after the build-sbf above	pass. An earlier run, with a different Solana toolchain, failed test1 with InvalidAccountData, the same as main
lazer/solana-anchor	rustc 1.88.0 (rust-toolchain.toml): cargo check --all-targets --locked	pass
price_feeds/solana/send_usd/program	rustc 1.88.0 (rustup default; no toolchain file): cargo check --all-targets --locked	pass
all Rust examples	cargo audit, before the openssl pin	publisher 6 → 2, solana 27 → 20, solana-anchor 3 → 2 vulnerabilities; the rest need major bumps (listed above). The pin to 0.10.78 adds the openssl advisories listed above back to publisher

These are example apps, not deployed services.

🤖 Generated with Claude Code