[jackchuma]

What changed? Why?

npm audit reported 25 vulnerabilities (3 critical, 12 high, 4 moderate, 6 low). This bumps dependencies so it reports found 0 vulnerabilities.

Direct dependencies (all still exact-pinned):

Package	Old → new
next, eslint-config-next, @next/eslint-plugin-next	16.3.1 → 16.4.3
shell-quote	1.10.0 → 1.12.0
node-forge	1.4.0 → 1.4.2
zod	3.22.4 → 4.6.7 (every zod <4.6.6 is affected)
jest	30.2.0 → 30.5.2 (its coverage plugin now pulls test-exclude@7, so glob 7 / inflight are gone without an override)
@eslint/eslintrc	3.3.6 → 3.3.7
eslint-plugin-react-hooks	7.0.1 → 7.1.1 (drops its nested vulnerable zod)

The rest (sharp, handlebars, js-yaml, browserslist, source-map-js, ip-address, brace-expansion, …) clear through the regenerated lockfile. ESLint stays on 9.

Overrides:

• Removed all nine old overrides. brace-expansion, both js-yaml pins and ip-address pinned vulnerable versions; babel-plugin-istanbul/test-exclude/glob are no longer needed with Jest 30.5; postcss and nanoid resolve the same versions without them.
• Added jest-config > deepmerge: 4.1.1. GHSA-gcqx-w48m-w2h4 affects deepmerge >=4.2.0 <=4.3.1, and 4.3.1 is the latest release, so the override selects 4.1.1, the newest release outside the reported range. DEPENDENCY-OVERRIDES.md documents it, and npm run check-overrides (now unit-tested) reports when it can be removed.
• Browserslist data packages (node-releases, electron-to-chromium, caniuse-lite) are pinned in the lockfile to the releases just before the StepSecurity 2-day cooldown window.

zod 4 migration: no schema code changes. zod 4's .int() also rejects integers above Number.MAX_SAFE_INTEGER, which zod 3 accepted; ledgerId (Ledger account index) and the gas buffer (0–100 percent) never need such values, and JSON.parse already rounds them. A parser test pins that 2^53 is rejected.

Notes to reviewers

• The deepmerge override clears npm audit but is not safer: 4.1.1 predates the prototype-pollution guard that 4.2.0 added. It is accepted because jest-config's only call merges trusted repo config (preset.globals with options.globals). The alternative is keeping 4.3.1 and accepting one dev-only audit finding.
• zod 4 rewords its built-in messages (e.g. "Required" → "Invalid input: expected string, received undefined"). Same meaning; the only user-facing place is /api/sign's 400 error text, and nothing matches on it. zod 4 also trims whitespace around rpcUrl in the parsed value; which inputs pass is unchanged.
• Jest 30.5 warns that importing JSON without with { type: 'json' } is deprecated (trusted-root.json, contracts.json); it becomes an error only in the next Jest major.
• Jest 30.5 pulls in @parcel/watcher (has an install script; prebuilt binaries are optional deps).

How has it been tested?

On the committed HEAD after rm -rf node_modules && npm ci (no deprecation warnings):

• npm audit: found 0 vulnerabilities
• npm run build, npm run lint, npm run format:check, npx tsc --noEmit: pass
• npm test and npm run test:coverage: 16 suites, 171 tests pass
• npm run check-overrides: exits 1 (deepmerge override still needed)

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[jackchuma]

Review round 1

Reviewers: cbhq-openai/gpt-6.1-sol, anthropic/claude-opus-5-5

• Fixed: [P2] Correct the deepmerge 4.1.1 override's security claim — DEPENDENCY-OVERRIDES.md:22 (824cab4); PR description updated to match
• Fixed: [P2] Move the "Removed overrides" table out of the doc — DEPENDENCY-OVERRIDES.md:35 (824cab4)
• Dropped in triage: [P2] Test the rewritten override-checker outcomes — scripts/check-overrides.ts:24 — manual maintenance script that queries the live npm registry; tests would only mock npm view responses, and the script it replaces was untested
  Synced with main: 2addf67 (already current)
  Validation: npm run format:check, npm run lint pass (docs-only fix); full suite passed on a9f613d

🤖 Reply generated with Toshi

[jackchuma]

Review round 2

Reviewers: cbhq-openai/gpt-6.1-sol, anthropic/claude-opus-5-5

• Fixed: [P2] Test the rewritten override-checker outcomes — scripts/check-overrides.ts:24 (1453f97). Raised again after the round 1 drop; kept because the fix is small and stays in a file this PR rewrites.
  Synced with main: 2addf67 (already current)
  Validation: npm test (171 passed), lint, format:check, tsc --noEmit, build pass; npm run check-overrides exits 1 as documented

🤖 Reply generated with Toshi

[jackchuma]

Review round 3

Reviewers: cbhq-openai/gpt-6.1-sol, anthropic/claude-opus-5-5
Both reviewers: no findings. Spec check (anthropic/claude-opus-5-5): all criteria met.

• Fixed: [P3] Pin the preserved "Expected integer, received float" text — src/lib/tests/parser.test.ts:44 (a8ec58c). Promoted spec-check note, also a round 1 residual.
• Dropped in triage: [P2] deepmerge 4.1.1 clears the advisory range without fixing the weakness — settled trade-off for the zero-audit requirement; documented in DEPENDENCY-OVERRIDES.md
• Dropped in triage: [P3] zod 4 default error wording reaches users — same meaning; no caller or test matches message text
• Dropped in triage: [P3] zod 4 .url() trims rpcUrl whitespace — URL parsing at the RPC consumer reads it the same way (verified in round 1)
• CI fix: StepSecurity npm cooldown check flagged node-releases, electron-to-chromium, caniuse-lite (released < 2 days ago); lockfile pinned to the prior releases (07cd13a)
  Synced with main: 2addf67 (already current)
  Validation: fresh npm ci, npm audit (0 vulnerabilities), build, lint, format:check, tsc --noEmit, npm test (171 passed)

🤖 Reply generated with Toshi

[jackchuma]

Review round 4

Reviewers: cbhq-openai/gpt-6.1-sol, anthropic/claude-opus-5-5

• Fixed: [P3] Keep a scoped test-exclude override, or record why it was dropped — package.json:58 (99d48d1). Restored babel-plugin-istanbul > test-exclude@7.0.1; glob 7 and inflight are gone; documented in DEPENDENCY-OVERRIDES.md
  Synced with main: 2addf67 (already current)
  Validation: fresh npm ci (no deprecation warnings), npm audit (0 vulnerabilities), build, lint, format:check, tsc --noEmit, npm test and npm run test:coverage (171 passed)
  Nit-only decision: verified
  Out-of-cite hunks: package-lock.json (test-exclude subtree); follows from package.json:58 override; dependency: npm lockfile resolution of the new override; result: pass. DEPENDENCY-OVERRIDES.md:3,33,37-59; follows from package.json:58 override; dependency: the doc must describe every override (finding offered documenting as the alternative fix); result: pass

🤖 Reply generated with Toshi

[jackchuma]

Review round 5

Reviewers: cbhq-openai/gpt-6.1-sol, anthropic/claude-opus-5-5
Both reviewers: no findings. Spec check (anthropic/claude-opus-5-5): all criteria met.

• Fixed (round 4 spec check): [P1] Upgrade Jest instead of overriding test-exclude — package.json:59 (440b06a). jest 30.5.2 brings babel-plugin-istanbul 8 → test-exclude 7; override and doc section removed
  Synced with main: 2addf67 (already current)
  Validation: fresh npm ci (no deprecation warnings), npm audit (0 vulnerabilities), build, lint, format:check, tsc --noEmit, npm test (171 passed)

🤖 Reply generated with Toshi

[xenoliss]

This keeps accepting integers above Number.MAX_SAFE_INTEGER, which JSON.parse has already rounded (9007199254740993 parses as 9007199254740992). No valid config needs them: ledgerId is the hardened account index in m/44'/60'/${ledgerAccount}'/0/0 (at most 2^31 - 1) and buffer is a percentage (0 to 100 in genValidationFile.ts). Keep z.number().int().nonnegative(): zod 4's safe-integer bound is the stricter correct check, and NonnegativeIntegerSchema, its comment and the 2^53 test can go.

[jackchuma]

Fixed in 7867b57. ledgerId and buffer are back to z.number().int().nonnegative(), so config-schemas.ts matches main. Zod 4's safe-integer bound now rejects 2^53, and the parser test pins that. NonnegativeIntegerSchema, its comment, and the 2^53 acceptance test are gone. Checked: ledgerId only feeds the Ledger accountIndex (src/app/api/sign/route.ts:86), and --l2-gas-buffer is capped at 0–100 (scripts/genValidationFile.ts:137).

🤖 Reply generated with Toshi

[cb-heimdall]

Review Error for xenoliss @ 2026-10-31 08:29:12 UTC
User failed mfa authentication, see go/mfa-help