[Snyk] Fix for 2 vulnerabilities

[davidevernizzi]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • relayer/spy_relayer/package.json
  • relayer/spy_relayer/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	601/1000 Why? Recently disclosed, Has a fix available, CVSS 6.3	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	No	No Known Exploit
	701/1000 Why? Recently disclosed, Has a fix available, CVSS 8.3	Improper Verification of Cryptographic Signature SNYK-JS-ELLIPTIC-8172694	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @certusone/wormhole-sdk

The new version differs by 250 commits.

• 83e0f05 remove explorer related code
• 24d3818 docs: add proto generation info
• 517bfaf docs: add comment conventions
• f60e666 node: commit proto and matching test fixes Provide generated proto files for go wormhole-foundation/wormhole#1769
• 9fa943e node: support for heartbeat spying fixes Provide heartbeat update subscription mechanism wormhole-foundation/wormhole#1768
• 61454a3 Node: remove support for Ropsten (Node: remove support for Ropsten wormhole-foundation/wormhole#1818)
• 3b8683f solana/tilt: run registrations in parallel (Make Solana ready faster by improving chain registration submissions wormhole-foundation/wormhole#1826)
• 0e643cd Revert SDK version bump
• 4ca4220 SDK: Remove support for Ropsten
• e409629 add BatchVAA structs to Go sdk(go sdk - BatchVAA structs wormhole-foundation/wormhole#1700)
• 346b685 Node: Just delete the PYTHNET messages
• 391781d Node: Disable PYTHNET log messages
• e7554f8 rust: Run rustfmt and clippy in CI
• 676d729 sdk/rust: Fix clippy warnings
• cb20d47 sdk/rust: Fix formatting
• f7cc16a terra: Fix clippy warnings
• 68ae3ff terra: Fix formatting
• 8d6bf74 cosmwasm: Fix clippy warnings
• dedcea3 cosmwasm: Fix formatting
• bac99e9 evm: add token and nft bridge interface (evm: add token and nft bridge interface wormhole-foundation/wormhole#1710)
• ddb2afd WH-1816: add new .gitignore @ Closes algorand tests are leaving debris in the local repo wormhole-foundation/wormhole#1816
• 25d2f24 ethereum: deploy test token nonce race condition fix
• 914aa99 node: arbitrum watcher fix (node: arbitrum watcher fix wormhole-foundation/wormhole#1812)
• af633ce wormchain: add back protobuf

See the full diff

Package name: @solana/web3.js

The new version differs by 216 commits.

• 7141986 fix: replace tweetnacl impl
• ef5a6da Update rollup script to exclude new secp256k1 and hmac/sha256 dependencies (#27428)
• f8b5608 [web3.js] Replace sha256 and secp256k1 impls (#27390)
• 8e30e66 feat: add support for creating version 0 transactions (#27142)
• 4f2d052 [web3.js] Eliminate dependency on `URL` class (#27349)
• 8d5e263 chore: bump eslint-plugin-mocha from 10.0.4 to 10.1.0 in /web3.js (#27332)
• 40022a3 chore: bump @ commitlint/travis-cli from 17.0.0 to 17.0.3 in /web3.js (#27331)
• eaa318d chore: bump @ babel/register from 7.17.7 to 7.18.9 in /web3.js (#27330)
• 9abf36c chore: bump @ babel/core from 7.18.0 to 7.18.13 in /web3.js (#27329)
• 2cc39ab VoteProgram.safeWithdraw function to safeguard against accidental vote account closures (#26586)
• 55652a0 chore: bump @ babel/preset-env from 7.18.0 to 7.18.10 in /web3.js (#27138)
• 659067b chore: add constant for pubkey byte length (#27134)
• 895de4c feat: add getAddressLookupTable method to Connection (#27127)
• 732f8aa chore: restructure utils code
• 81a1d2c chore: restructure program files
• 53dd609 chore: restucture message files
• 9823da7 chore: restructure transaction files
• 7d05857 feat: support minContextSlot in getParsedAccountInfo method (#27084)
• d7ed86a chore: annotate more types as deprecated (#27067)
• bbfd5d3 feat: handle `loadedAddresses` field in tx meta responses (#27065)
• 3708ea1 chore: update `tweetnacl` dependency to 1.0.3 explicitly (#26907)
• 2dc0551 chore: Update web3.js README to ask that contributions and issues regarding web3.js be filed against the monorepo and not the mirror
• 091faf5 fix: (web3.js) clear the idle timer whenever the websocket closes (#26734)
• 85a6a3f feat(web3.js): add support for get stake minimum delegation (#26682)

See the full diff

Package name: express

The new version differs by 250 commits.

• 8e229f9 4.21.1
• a024c8a fix(deps): [email protected]
• 7e562c6 4.21.0
• 1bcde96 fix(deps): [email protected] (#5946)
• 7d36477 fix(deps): [email protected] (#5951)
• 40d2d8f fix(deps): [email protected]
• 77ada90 Deprecate `"back"` magic string in redirects (#5935)
• 21df421 4.20.0
• 4c9ddc1 feat: upgrade to [email protected]
• 9ebe5d5 feat: upgrade to [email protected] (#5928)
• ec4a01b feat: upgrade to [email protected] (#5926)
• 54271f6 fix: don't render redirect values in anchor href
• 125bb74 [email protected] (#5902)
• 2a980ad [email protected] (#5781)
• a3e7e05 docs: specify new instructions for `question` and `discuss`
• c5addb9 deps: [email protected] (#5603)
• e35380a docs: add @ IamLizu to the triage team (#5836)
• f5b6e67 docs: update scorecard link (#5814)
• 2177f67 docs: add OSSF Scorecard badge (#5436)
• f4bd86e Replace Appveyor windows testing with GHA (#5599)
• 2ec589c Fix Contributor Covenant link definition reference in attribution section (#5762)
• 4cf7eed remove minor version pinning from ci (#5722)
• 6d08471 📝 update people, add ctcpip to TC (#5683)
• 61421a8 skip QUERY tests for Node 21 only, still not supported (#5695)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)