From 2d8756a6dbd598d5173aa10e6b22c667af86d0f6 Mon Sep 17 00:00:00 2001 From: Nigel Sheridan-Smith Date: Tue, 2 Jun 2026 20:23:52 +1000 Subject: [PATCH] security: remove elliptic package (CVE mitigation) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove unused elliptic package to mitigate CVE-2025-14505 as no patched release is available. Changes: - package.json: Remove elliptic ^6.6.0 from dependencies - Regenerate pnpm-lock.yaml CVEs Addressed: - CVE-2025-14505: elliptic package vulnerability (mitigation via removal) The elliptic package contains a vulnerability (CVE-2025-14505) with no patched release available. After verification that the package was not directly used by the application codebase, it has been removed as a mitigation strategy. Test Results: - Frontend tests: ✓ All 15 test suites passed (90 tests) - TypeScript compilation: ✓ Type checking passed - No import errors or missing dependencies Co-authored-by: Cursor --- package.json | 1 - pnpm-lock.yaml | 48 ------------------------------------------------ 2 files changed, 49 deletions(-) diff --git a/package.json b/package.json index 810287b952..5481618c16 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,6 @@ "d3": "^3.5.17", "debug": "^3.2.7", "dompurify": "^2.0.17", - "elliptic": "^6.6.0", "font-awesome": "^4.7.0", "history": "^4.10.1", "hoist-non-react-statics": "^3.3.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 55b8abcfc1..67b7b22b4f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -46,9 +46,6 @@ importers: dompurify: specifier: ^2.0.17 version: 2.5.8 - elliptic: - specifier: ^6.6.0 - version: 6.6.1 font-awesome: specifier: ^4.7.0 version: 4.7.0 @@ -3100,9 +3097,6 @@ packages: bluebird@3.7.2: resolution: {integrity: sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==} - bn.js@4.12.3: - resolution: {integrity: sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==} - body-parser@1.20.4: resolution: {integrity: sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==} engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16} @@ -3136,9 +3130,6 @@ packages: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} engines: {node: '>=8'} - brorand@1.1.0: - resolution: {integrity: sha512-cKV8tMCEpQs4hK/ik71d6LrPOnpkpGBR0wzxqr68g2m/LB2GxVYQroAjMJZRVM1Y4BCjCKc3vAamxSzOY2RP+w==} - browserslist@3.2.8: resolution: {integrity: sha512-WHVocJYavUwVgVViC0ORikPHQquXwVh939TaelZ4WDqpWgTX/FsGhl/+P4qBUAGcRvtOgDgC+xftNWWp2RUTAQ==} hasBin: true @@ -3979,9 +3970,6 @@ packages: elementary-circuits-directed-graph@1.3.1: resolution: {integrity: sha512-ZEiB5qkn2adYmpXGnJKkxT8uJHlW/mxmBpmeqawEHzPxh9HkLD4/1mFYX5l0On+f6rcPIt8/EWlRU2Vo3fX6dQ==} - elliptic@6.6.1: - resolution: {integrity: sha512-RaddvvMatK2LJHqFJ+YA4WysVN5Ita9E35botqIYspQ4TkRAlCicdzKOjlyv/1Za5RyTNn7di//eEV0uTAfe3g==} - emittery@0.13.1: resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==} engines: {node: '>=12'} @@ -4931,9 +4919,6 @@ packages: resolution: {integrity: sha512-qdSAmqLF6209RFj4VVItywPMbm3vWylknmB3nvNiUIs72xAimcM8nVYxYr7ncvZq5qzk9MKIZR8ijqD/1QuYjQ==} engines: {node: '>= 0.4.0'} - hash.js@1.1.7: - resolution: {integrity: sha512-taOaskGt4z4SOANNseOviYDvjEJinIkRgmp7LbKP2YTTmVxWBl87s/uzK9r+44BclBSp2X7K1hqeNfz9JbBeXA==} - hasha@5.2.2: resolution: {integrity: sha512-Hrp5vIK/xr5SkeN2onO32H0MgNZ0f17HRNH39WfL0SYUNOTZ5Lz1TJ8Pajo/87dYGEFlLMm7mIc/k/s6Bvz9HQ==} engines: {node: '>=8'} @@ -4949,9 +4934,6 @@ packages: history@4.10.1: resolution: {integrity: sha512-36nwAD620w12kuzPAsyINPWJqlNbij+hpK1k9XRloDtym8mxzGYl2c17LnV6IAGB2Dmg4tEa7G7DlawS0+qjew==} - hmac-drbg@1.0.1: - resolution: {integrity: sha512-Tti3gMqLdZfhOQY1Mzf/AanLiqh1WTiJgEj26ZuYQ9fbkLomzGchCws4FyrSd4VkpBfiNhaE1On+lOz894jvXg==} - hoist-non-react-statics@3.3.2: resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==} @@ -6097,9 +6079,6 @@ packages: minimalistic-assert@1.0.1: resolution: {integrity: sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==} - minimalistic-crypto-utils@1.0.1: - resolution: {integrity: sha512-JIYlbt6g8i5jKfJ3xz7rF0LXmv2TkDxBLUkiBeZ7bAx4GnnNMr8xFpGnOxn6GhTEHx3SjRrZEoU+j04prX1ktg==} - minimatch@10.2.4: resolution: {integrity: sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==} engines: {node: 18 || 20 || >=22} @@ -12015,8 +11994,6 @@ snapshots: bluebird@3.7.2: {} - bn.js@4.12.3: {} - body-parser@1.20.4: dependencies: bytes: 3.1.2 @@ -12075,8 +12052,6 @@ snapshots: dependencies: fill-range: 7.1.1 - brorand@1.1.0: {} - browserslist@3.2.8: dependencies: caniuse-lite: 1.0.30001775 @@ -13012,16 +12987,6 @@ snapshots: dependencies: strongly-connected-components: 1.0.1 - elliptic@6.6.1: - dependencies: - bn.js: 4.12.3 - brorand: 1.1.0 - hash.js: 1.1.7 - hmac-drbg: 1.0.1 - inherits: 2.0.4 - minimalistic-assert: 1.0.1 - minimalistic-crypto-utils: 1.0.1 - emittery@0.13.1: {} emoji-regex@7.0.3: {} @@ -14344,11 +14309,6 @@ snapshots: has@1.0.4: {} - hash.js@1.1.7: - dependencies: - inherits: 2.0.4 - minimalistic-assert: 1.0.1 - hasha@5.2.2: dependencies: is-stream: 2.0.1 @@ -14369,12 +14329,6 @@ snapshots: tiny-warning: 1.0.3 value-equal: 1.0.1 - hmac-drbg@1.0.1: - dependencies: - hash.js: 1.1.7 - minimalistic-assert: 1.0.1 - minimalistic-crypto-utils: 1.0.1 - hoist-non-react-statics@3.3.2: dependencies: react-is: 16.13.1 @@ -15834,8 +15788,6 @@ snapshots: minimalistic-assert@1.0.1: {} - minimalistic-crypto-utils@1.0.1: {} - minimatch@10.2.4: dependencies: brace-expansion: 5.0.4