renproject · snyk-bot · Aug 23, 2021
diff --git a/.snyk b/.snyk
@@ -0,0 +1,8 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.21.5
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  SNYK-JS-LODASH-567746:
+    - '@openzeppelin/upgrades > lodash':
+        patched: '2021-08-23T23:04:45.987Z'
diff --git a/package.json b/package.json
@@ -1,73 +1,76 @@
 {
-    "name": "@renproject/sol",
-    "version": "1.1.0",
-    "repository": "https://github.io/renproject/darknode-sol",
-    "public": true,
-    "scripts": {
-        "generate": "truffle compile && typechain --target truffle-v5 './build/development/*.json'",
-        "coverage": "yarn run generate && truffle run coverage",
-        "build": "yarn run generate && truffle build",
-        "test": "yarn run generate && truffle test",
-        "bindings:ts": "truffle compile && typechain --target web3-v1 \"./build/chaosnet/*.json\"",
-        "bindings:go": "solc --optimize darknode-sol=`pwd`/node_modules/darknode-sol @openzeppelin/upgrades=`pwd`/node_modules/@openzeppelin/upgrades @openzeppelin/contracts=`pwd`/node_modules/@openzeppelin/contracts --combined-json bin,abi,userdoc,devdoc,metadata $(find contracts -type f -name '*.sol') > go-abi.json && abigen -pkg bindings --out bindings.go --combined-json go-abi.json; rm go-abi.json",
-        "coveralls": "cat ./coverage/lcov.info | coveralls",
-        "prepare": "patch-package",
-        "deploy": "truffle migrate --network $NETWORK 2>&1 | tee $NETWORK-output.log",
-        "deploy-skipDryRun": "truffle migrate --network $NETWORK --skipDryRun 2>&1 | tee $NETWORK-output.log",
-        "clean-build": "echo  \"Have all contracts been verified on Etherscan? Continuing in 10 seconds...\" && sleep 10 && grep -R -l 'networks\": {}' build --exclude-dir=development | xargs rm; node build/clean.js",
-        "verify": "truffle run verify --network $NETWORK",
-        "docs": "solidity-docgen --exclude contracts/migrations,contracts/test --solc-module solc --templates ./templates --helpers ./templates/helpers.js --extension=mdx",
-        "prepare-release": "npmignore"
-    },
-    "dependencies": {
-        "@openzeppelin/contracts": "^2.5.1",
-        "@openzeppelin/contracts-ethereum-package": "^2.5.0",
-        "@openzeppelin/upgrades": "^2.8.0"
-    },
-    "devDependencies": {
-        "@typechain/truffle-v5": "^5.0.0",
-        "@typechain/web3-v1": "^3.0.0",
-        "@types/chai": "^4.2.21",
-        "@types/chai-as-promised": "^7.1.4",
-        "@types/ethereumjs-abi": "^0.6.3",
-        "@types/mocha": "^9.0.0",
-        "@types/node": "^16.7.1",
-        "@types/seedrandom": "^3.0.1",
-        "bignumber.js": "^9.0.1",
-        "bn.js": "^5.2.0",
-        "chai": "^4.3.4",
-        "chai-as-promised": "^7.1.1",
-        "chai-bignumber": "github:ren-forks/chai-bignumber.git#afa6f46dcbef0b7e622dc27b9b3354fc67afafbc",
-        "coveralls": "^3.1.1",
-        "dotenv": "^10.0.0",
-        "eth-gas-reporter": "^0.2.22",
-        "ethereumjs-abi": "^0.6.8",
-        "ganache-cli": "^6.12.2",
-        "hash.js": "^1.1.7",
-        "immutable": "^4.0.0-rc.14",
-        "moment": "^2.29.1",
-        "npmignore": "^0.2.0",
-        "patch-package": "^6.4.7",
-        "seedrandom": "^3.0.5",
-        "solc": "^0.5.17",
-        "solidity-coverage": "^0.7.16",
-        "truffle": "^5.4.7",
-        "truffle-hdwallet-provider": "^1.0.17",
-        "truffle-plugin-verify": "0.5.11",
-        "truffle-typings": "^1.0.8",
-        "ts-node": "^10.2.1",
-        "tslint": "^6.1.3",
-        "typechain": "^5.1.2",
-        "typescript": "^4.3.5",
-        "web3": "^2.0.0-alpha",
-        "web3-core": "^1.5.2",
-        "web3-utils": "^2.0.0-alpha"
-    },
-    "resolutions": {
-        "solc": "0.5.17",
-        "sol-merger": "1.1.1"
-    },
-    "prettier": {
-        "tabWidth": 4
-    }
+  "name": "@renproject/sol",
+  "version": "1.1.0",
+  "repository": "https://github.io/renproject/darknode-sol",
+  "public": true,
+  "scripts": {
+    "generate": "truffle compile && typechain --target truffle-v5 './build/development/*.json'",
+    "coverage": "yarn run generate && truffle run coverage",
+    "build": "yarn run generate && truffle build",
+    "test": "yarn run generate && truffle test",
+    "bindings:ts": "truffle compile && typechain --target web3-v1 \"./build/chaosnet/*.json\"",
+    "bindings:go": "solc --optimize darknode-sol=`pwd`/node_modules/darknode-sol @openzeppelin/upgrades=`pwd`/node_modules/@openzeppelin/upgrades @openzeppelin/contracts=`pwd`/node_modules/@openzeppelin/contracts --combined-json bin,abi,userdoc,devdoc,metadata $(find contracts -type f -name '*.sol') > go-abi.json && abigen -pkg bindings --out bindings.go --combined-json go-abi.json; rm go-abi.json",
+    "coveralls": "cat ./coverage/lcov.info | coveralls",
+    "prepare": "yarn run snyk-protect && patch-package",
+    "deploy": "truffle migrate --network $NETWORK 2>&1 | tee $NETWORK-output.log",
+    "deploy-skipDryRun": "truffle migrate --network $NETWORK --skipDryRun 2>&1 | tee $NETWORK-output.log",
+    "clean-build": "echo  \"Have all contracts been verified on Etherscan? Continuing in 10 seconds...\" && sleep 10 && grep -R -l 'networks\": {}' build --exclude-dir=development | xargs rm; node build/clean.js",
+    "verify": "truffle run verify --network $NETWORK",
+    "docs": "solidity-docgen --exclude contracts/migrations,contracts/test --solc-module solc --templates ./templates --helpers ./templates/helpers.js --extension=mdx",
+    "prepare-release": "npmignore",
+    "snyk-protect": "snyk-protect"
+  },
+  "dependencies": {
+    "@openzeppelin/contracts": "^3.4.0",
+    "@openzeppelin/contracts-ethereum-package": "^2.5.0",
+    "@openzeppelin/upgrades": "^2.8.0",
+    "@snyk/protect": "latest"
+  },
+  "devDependencies": {
+    "@typechain/truffle-v5": "^5.0.0",
+    "@typechain/web3-v1": "^3.0.0",
+    "@types/chai": "^4.2.21",
+    "@types/chai-as-promised": "^7.1.4",
+    "@types/ethereumjs-abi": "^0.6.3",
+    "@types/mocha": "^9.0.0",
+    "@types/node": "^16.7.1",
+    "@types/seedrandom": "^3.0.1",
+    "bignumber.js": "^9.0.1",
+    "bn.js": "^5.2.0",
+    "chai": "^4.3.4",
+    "chai-as-promised": "^7.1.1",
+    "chai-bignumber": "github:ren-forks/chai-bignumber.git#afa6f46dcbef0b7e622dc27b9b3354fc67afafbc",
+    "coveralls": "^3.1.1",
+    "dotenv": "^10.0.0",
+    "eth-gas-reporter": "^0.2.22",
+    "ethereumjs-abi": "^0.6.8",
+    "ganache-cli": "^6.12.2",
+    "hash.js": "^1.1.7",
+    "immutable": "^4.0.0-rc.14",
+    "moment": "^2.29.1",
+    "npmignore": "^0.2.0",
+    "patch-package": "^6.4.7",
+    "seedrandom": "^3.0.5",
+    "solc": "^0.5.17",
+    "solidity-coverage": "^0.7.16",
+    "truffle": "^5.4.7",
+    "truffle-hdwallet-provider": "^1.0.17",
+    "truffle-plugin-verify": "0.5.11",
+    "truffle-typings": "^1.0.8",
+    "ts-node": "^10.2.1",
+    "tslint": "^6.1.3",
+    "typechain": "^5.1.2",
+    "typescript": "^4.3.5",
+    "web3": "^2.0.0-alpha",
+    "web3-core": "^1.5.2",
+    "web3-utils": "^2.0.0-alpha"
+  },
+  "resolutions": {
+    "solc": "0.5.17",
+    "sol-merger": "1.1.1"
+  },
+  "prettier": {
+    "tabWidth": 4
+  },
+  "snyk": true
 }
diff --git a/yarn.lock b/yarn.lock
@@ -1496,10 +1496,10 @@
   resolved "https://registry.yarnpkg.com/@openzeppelin/contracts-ethereum-package/-/contracts-ethereum-package-2.5.0.tgz#cfb4b91f8132edde7e04bcd032575d4c6b544f4a"
   integrity sha512-14CijdTyy4Y/3D3UUeFC2oW12nt1Yq1M8gFOtkuODEvSYPe3YSAKnKyhUeGf0UDNCZzwfGr15KdiFK6AoJjoSQ==
 
-"@openzeppelin/contracts@^2.5.1":
-  version "2.5.1"
-  resolved "https://registry.yarnpkg.com/@openzeppelin/contracts/-/contracts-2.5.1.tgz#c76e3fc57aa224da3718ec351812a4251289db31"
-  integrity sha512-qIy6tLx8rtybEsIOAlrM4J/85s2q2nPkDqj/Rx46VakBZ0LwtFhXIVub96LXHczQX0vaqmAueDqNPXtbSXSaYQ==
+"@openzeppelin/contracts@^3.4.0":
+  version "3.4.1"
+  resolved "https://registry.yarnpkg.com/@openzeppelin/contracts/-/contracts-3.4.1.tgz#03c891fec7f93be0ae44ed74e57a122a38732ce7"
+  integrity sha512-cUriqMauq1ylzP2TxePNdPqkwI7Le3Annh4K9rrpvKfSBB/bdW+Iu1ihBaTIABTAAJ85LmKL5SSPPL9ry8d1gQ==
 
 "@openzeppelin/upgrades@^2.8.0":
   version "2.8.0"
@@ -1663,6 +1663,11 @@
   resolved "https://registry.yarnpkg.com/@sindresorhus/is/-/is-0.14.0.tgz#9fb3a3cf3132328151f353de4632e01e52102bea"
   integrity sha512-9NET910DNaIPngYnLLPeg+Ogzqsi9uM4mSboU5y6p8S5DzMTVEsJZrawi+BoDNUVBa2DhJqQYUFvMDfgU062LQ==
 
+"@snyk/protect@^1.687.0":
+  version "1.687.0"
+  resolved "https://registry.yarnpkg.com/@snyk/protect/-/protect-1.687.0.tgz#fc6792e60c28168f5d11ab29ef67e396d2b75ff0"
+  integrity sha512-mJo6RpfLo5W7vGcvPjftUJCppOjbdCS3BQN7VExAx1Rvl08WXzYQ6mH0zG+8FFts3iubCdJU4CRWoRP5xTaipA==
+
 "@solidity-parser/parser@^0.12.0":
   version "0.12.2"
   resolved "https://registry.yarnpkg.com/@solidity-parser/parser/-/parser-0.12.2.tgz#1afad367cb29a2ed8cdd4a3a62701c2821fb578f"