[Snyk] Fix for 1 vulnerabilities

[Kashuhackerone]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/cosmic-swingset/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	471/1000 Why? Recently disclosed, Has a fix available, CVSS 3.7	Improper Data Handling SNYK-JS-SES-3057928	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @agoric/install-ses

The new version differs by 250 commits.

• 6bf2266 chore(release): publish
• 2ec95eb Merge pull request fix: represent storage in same order in genesis state Agoric/agoric-sdk#4147 from Agoric/4134-swingset-genesis
• f584cd1 fix: represent storage in same order in genesis state
• 8002489 Merge pull request ci: reenable workflows that rely on pushes to $default-branch Agoric/agoric-sdk#4146 from Agoric/mfig-workflow-default-branch
• a9c70ca ci: reenable workflows that rely on pushes to `$default-branch`
• 78ba139 Merge pull request ci(dev-canary): publish a dev NPM dist tag on every push Agoric/agoric-sdk#4120 from Agoric/mfig-npm-cicd
• 20004f8 ci: ensure jobs run when the PR is merged to `master`
• e5e6e07 ci(dev-canary): publish a `dev` NPM dist tag on every push
• 6932ad0 Merge pull request fix(vats)!: migrate to use @agoric/far, remove deprecated REPL code Agoric/agoric-sdk#4145 from Agoric/mfig-demonstrate-agoric-far
• 3f41296 feat(repl)!: add `@ agoric/far` exports to REPL, remove `ui-agent`
• aa2c2de refactor(vats): use `@ agoric/far`
• 180149e feat(far): export `ERef<T>`
• 154da76 Merge pull request feat(far): new package @agoric/far Agoric/agoric-sdk#4144 from Agoric/mfig-agoric-remoting
• 8be558c feat(far): new package `@ agoric/far`
• a995a75 Merge pull request feat: tweak fictional BLD price to suggest early phase Agoric/agoric-sdk#4020 from Agoric/dc-bld-price-tweak
• 472912e feat: tweak fictional BLD price to suggest early phase
• 1b1ff8a Merge pull request ci: also run docker and deployment-test on main branch PR close Agoric/agoric-sdk#4139 from Agoric/mfig-deploy-on-pr
• f303696 ci: also run `docker` and `deployment-test` on main branch PR close
• 7de2b88 Merge pull request ci(deployment-test): run against default branch Agoric/agoric-sdk#4138 from Agoric/mfig-deploy-master
• a8f8d94 ci(deployment-test): run against default branch
• e18ad64 Merge pull request Beans per unit nondeterminism Agoric/agoric-sdk#4137 from Agoric/mfig-bean-entries
• fa96b9a fix(cosmos): make a repeated array of entries for `beans_per_unit`
• a1065c0 feat(deployment): add scripts to help find nondeterminism
• 6f888ba Merge pull request build: upgrade to Cosmos SDK v0.44.0-alpha.agoric.1 Agoric/agoric-sdk#4131 from Agoric/mfig-prepare-chain

See the full diff

Package name: @agoric/spawner

The new version differs by 143 commits.

• 20bc9a9 chore(release): publish
• cc7b518 Merge pull request fix: don't ever display a 404 for the wallet Agoric/agoric-sdk#1994 from Agoric/mfig/start-wallet-early
• 4fb3d48 fix: don't ever display a 404 for the wallet
• e4ea0c4 Merge pull request Report number of significant round trips Agoric/agoric-sdk#1954 from Agoric/mfig/optimize-trips
• e0b5040 fix: count the outbound dataful trips to a given target
• cce515f Merge pull request feat: simple volatile priceAuthority Agoric/agoric-sdk#1992 from Agoric/mfig/fake-prices
• d32f416 refactor: rename fake trades
• 4dea2f1 chore: fix the lint
• a7ec3d1 fix: don't create duplicate central price authority
• dceafd6 fix: allow priceRegistry to force-override an entry
• af76585 feat: simple volatile priceAuthority
• 40c27fd Merge pull request Edit of MarkM's original doc incorporating ChrisH comments Agoric/agoric-sdk#1969 from Agoric/tyg-patch-1
• a501a1b Merge branch 'master' into tyg-patch-1
• cd7ebd8 feat: convert the fakePriceAuthority to a PlayerPiano model (feat: convert the fakePriceAuthority to a PlayerPiano model Agoric/agoric-sdk#1985)
• c646bb6 Loan Contract (Loan Contract Agoric/agoric-sdk#1903)
• 36ce679 Merge pull request Wallet fixes Agoric/agoric-sdk#1991 from Agoric/mfig/wallet-fixes
• 4e007f7 chore: fix the lint
• 008b058 fix: don't overwrite existing files with `link-cli`
• 9c29e10 fix: make wallet more robust, and handle decimals fully
• 97c10d0 Merge pull request Add wallet support for decimal currencies and some examples Agoric/agoric-sdk#1984 from Agoric/mfig/more-currencies
• 204949a chore: fix the lint
• ca7db02 test: update to allow displayInfo
• 58ff9a3 fix: put all parsing and stringification into the wallet ui
• 0e7c896 fix: excise `conventionalDecimalPlaces` for now

See the full diff

Package name: @agoric/zoe

The new version differs by 250 commits.

• 05fed59 chore(release): publish
• d182e45 Merge pull request Distribute fees Agoric/agoric-sdk#3030 from Agoric/mfig-distribute-fees
• 334a253 fix: polishing touches
• 8390512 chore: remove some extraneous lines
• 0d1f22d fix: add brand to `depositMultiple` mock bank
• a7da714 fix: remove awaita from `depositMultiple`
• b16ae45 refactor: fix type lint
• f56ff7a fix: test and workaround for a reallocate issue in zoe
• 97ce4dd chore: revert ERTP types, change from numbers to bigints where linting fails (chore: revert ERTP types, change from numbers to bigints Agoric/agoric-sdk#3031)
• d210bcf fix: default and propagate the poolFee and protocolFee in treasury
• ed6b84a fix: have the treasury use the newSwap AMM implementation
• 9e16332 feat: wire up vats.distributeFees
• b42da66 style: enable ts-check for treasury tests
• dc67e67 fix(newSwap): move guard out of conditional; tests pass
• 8970dca refactor: use a Store instead of a Map to assert brands exist
• 38b8dcc Use seat.fail(error) to report a problem (Use seat.fail(error) to report a problem Agoric/agoric-sdk#3028)
• 7ebb5d8 feat: default to xs-worker in chain (feat: default to xs-worker in chain Agoric/agoric-sdk#2995)
• f052169 feat(xsnap): performance monitoring / metering feat(xsnap): performance monitoring / metering Agoric/agoric-sdk#3023
• 5922cbd feat(xsnap): increase allocation limit to 2GB
• 10940f9 feat(xsnap): high resolution timer: performance.now()
• eff98b4 feat(xsnap): meter maxBucketSize
• 327062f feat(xsnap): meter add/remove on map, set
• f649ff7 feat(xsnap): meter garbageCollectionCount
• 5a35842 feat(xsnap): meter calls to allocateChunks, allocateSlots

See the full diff

Package name: agoric

The new version differs by 86 commits.

• f9fab94 chore: update yarn.lock
• ade5735 ci: build docker images tagged with the SDK version
• f197085 chore(release): publish
• 2fea6ce Merge pull request Stargate-rc4 upgrade Agoric/agoric-sdk#2072 from Agoric/mfig/stargate-rc4
• a11fd5b fix: only run the kernel at the end of each block
• 2a549e4 fix: upgrade to stargate rc4
• 6ba739e fix: don't reset x/capability state on new chains; it's sensitive
• f9441f4 OfferTo as a Zoe Helper - ready for design review (OfferTo as a Zoe Helper - ready for design review Agoric/agoric-sdk#2016)
• e974022 Merge pull request Update IBC to match relayer v1.0.0-rc1 Agoric/agoric-sdk#2068 from Agoric/mfig/robust-chain-params
• bea1021 fix: update to IBC relayer v1.0.0-rc1
• 6fac324 fix(chain-params): 5s blocks to account for global round-trip time
• f836802 style: Apply prettier config consistently (style: Apply prettier config consistently Agoric/agoric-sdk#2063)
• 41b51b4 Merge pull request Create golang/cosmos Agoric/agoric-sdk#2062 from Agoric/mfig/golang-rename
• f58df9c fix: use nodejs instead of sed for parsing package.json
• 7c7379d fix: update Docker build steps
• 3191216 chore: rename more files
• f9982a3 fix: update paths and make rules
• 5121c35 chore: rename many Golang files to /golang
• 1131f8e Merge pull request fix!: separate wallet into User, Bridge, and Internal Agoric/agoric-sdk#2032 from Agoric/mfig/separate-wallet-apis
• 815a876 refactor: more clarity and contextual comments
• 8f81091 fix: add more types and refactor naming of facets
• 111d238 fix!: separate wallet into User, Bridge, and Internal
• 58e0eb1 Merge pull request Factor out x/dibc Agoric/agoric-sdk#2054 from Agoric/mfig/refactor-x-dibc
• 0653c03 fix: localhost IBC client wishful thinking

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.