Skip to content

Bump elliptic and ic-mops in /frontend#361

Merged
Kamirus merged 1 commit intomainfrom
dependabot/npm_and_yarn/frontend/multi-502fa5ddc3
Mar 23, 2026
Merged

Bump elliptic and ic-mops in /frontend#361
Kamirus merged 1 commit intomainfrom
dependabot/npm_and_yarn/frontend/multi-502fa5ddc3

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Jan 9, 2026

Removes elliptic. It's no longer used after updating ancestor dependency ic-mops. These dependencies need to be updated together.

Removes elliptic

Updates ic-mops from 0.40.0 to 2.0.0

Commits
Maintainer changes

This version was pushed to npm by rvanasa, a new releaser for ic-mops since your current version.


You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 9, 2026
@dependabot dependabot Bot requested a review from a team as a code owner January 9, 2026 21:07
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Jan 9, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jan 9, 2026

Benchmark Results

bench/1-buffer-vector-add.bench.mo $({\color{green}-8.22\%})$

Add (second)

Add items one-by-one (second)

Instructions: ${\color{green}-8.22\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

10 10000 1000000
Buffer 9_557 $({\color{green}-29.67\%})$ 5_687_594 $({\color{green}-8.33\%})$ 525_783_888 $({\color{green}-8.25\%})$
Vector 13_525 $({\color{red}+18.47\%})$ 4_378_612 $({\color{green}-10.82\%})$ 417_864_498 $({\color{green}-10.74\%})$

Heap

10 10000 1000000
Buffer 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$
Vector 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$

Garbage Collection

10 10000 1000000
Buffer 1.09 KiB $({\color{gray}0\%})$ 143.28 KiB $({\color{gray}0\%})$ 12.02 MiB $({\color{gray}0\%})$
Vector 1.09 KiB $({\color{gray}0\%})$ 45.65 KiB $({\color{gray}0\%})$ 3.86 MiB $({\color{gray}0\%})$
bench/2-vector-buffer-add.bench.mo $({\color{green}-10.02\%})$

Add

Add items one-by-one

Instructions: ${\color{green}-10.02\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

10 10000 1000000
Vector 13_525 $({\color{green}-12.27\%})$ 4_378_966 $({\color{green}-10.82\%})$ 417_886_092 $({\color{green}-10.74\%})$
Buffer 9_557 $({\color{green}-9.75\%})$ 5_686_886 $({\color{green}-8.33\%})$ 525_781_056 $({\color{green}-8.25\%})$

Heap

10 10000 1000000
Vector 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$
Buffer 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$

Garbage Collection

10 10000 1000000
Vector 1.09 KiB $({\color{gray}0\%})$ 45.65 KiB $({\color{gray}0\%})$ 3.86 MiB $({\color{gray}0\%})$
Buffer 1.09 KiB $({\color{gray}0\%})$ 143.28 KiB $({\color{gray}0\%})$ 12.02 MiB $({\color{gray}0\%})$
bench/array.bench.mo $({\color{green}-17.47\%})$

Array

arr arr

Instructions: ${\color{green}-17.47\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

100k x1 reset1 100k x3 reset2 100k x4 reset3
Array 13_502_096 $({\color{green}-10.00\%})$ 3_335 $({\color{green}-25.14\%})$ 27_003_270 $({\color{green}-10.00\%})$ 3_809 $({\color{green}-24.92\%})$ 54_004_127 $({\color{green}-10.00\%})$ 4_283 $({\color{green}-24.74\%})$

Heap

100k x1 reset1 100k x3 reset2 100k x4 reset3
Array 390.9 KiB $({\color{gray}0\%})$ -390.37 KiB $({\color{gray}0\%})$ 390.9 KiB $({\color{gray}0\%})$ -390.37 KiB $({\color{gray}0\%})$ 390.9 KiB $({\color{gray}0\%})$ -390.37 KiB $({\color{gray}0\%})$

Garbage Collection

100k x1 reset1 100k x3 reset2 100k x4 reset3
Array 360 B $({\color{gray}0\%})$ 390.97 KiB $({\color{gray}0\%})$ 391 KiB $({\color{gray}0\%})$ 390.97 KiB $({\color{gray}0\%})$ 1.14 MiB $({\color{gray}0\%})$ 390.97 KiB $({\color{gray}0\%})$
No previous results found "/home/runner/work/mops/mops/.bench/prng.bench.json"
bench/prng.bench.mo $({\color{gray}0\%})$

Prng

Benchmark N next calls for different PRNGs

Instructions: ${\color{gray}0\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

10 100 1000 10000
Seiran128 1_694 15_194 150_194 1_500_194
SFC64 2_802 28_962 288_557 2_882_655
SFC32 2_383 23_825 237_026 2_379_333

Heap

10 100 1000 10000
Seiran128 272 B 272 B 272 B 272 B
SFC64 308 B 272 B 272 B 272 B
SFC32 280 B 280 B 272 B 272 B

Garbage Collection

10 100 1000 10000
Seiran128 296 B 296 B 296 B 296 B
SFC64 536 B 4.98 KiB 47.16 KiB 469.04 KiB
SFC32 376 B 1.78 KiB 15.39 KiB 156.11 KiB
bench/removeLast.bench.mo $({\color{green}-10.90\%})$

Remove items using removeLast

Vector and buffer are initialized with 100k items and then 70k items are removed one-by-one.

Instructions: ${\color{green}-10.90\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

remove 70k
Vector 27_707_716 $({\color{green}-13.98\%})$
Buffer 29_236_977 $({\color{green}-7.82\%})$

Heap

remove 70k
Vector -136.8 KiB $({\color{gray}0\%})$
Buffer -269.76 KiB $({\color{gray}0\%})$

Garbage Collection

remove 70k
Vector 139.45 KiB $({\color{gray}0\%})$
Buffer 540.43 KiB $({\color{gray}0\%})$
bench/stable-memory.bench.mo $({\color{green}-134.03\%})$

Stable Memory and Region

Grow Region and store blobs in it

Instructions: ${\color{green}-66.97\%}$
Heap: ${\color{green}-6.10\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{green}-60.97\%}$

Instructions

Region (fill 1/100) Region (fill 1/50) StableMemory
10 pages 2_627_013 $({\color{green}-95.97\%})$ 10_496_302 $({\color{green}-95.97\%})$ 2_693 $({\color{green}-5.87\%})$
100 pages 52_466_913 $({\color{green}-95.97\%})$ 104_914_602 $({\color{green}-95.97\%})$ 2_698 $({\color{green}-8.67\%})$
256 pages 134_273_942 $({\color{green}-95.97\%})$ 268_574_999 $({\color{green}-95.97\%})$ 3_246 $({\color{green}-12.37\%})$

Heap

Region (fill 1/100) Region (fill 1/50) StableMemory
10 pages 272 B $({\color{green}-8.11\%})$ 272 B $({\color{gray}0\%})$ 276 B $({\color{gray}0\%})$
100 pages 272 B $({\color{green}-11.69\%})$ 272 B $({\color{green}-11.69\%})$ 272 B $({\color{gray}0\%})$
256 pages 272 B $({\color{green}-11.69\%})$ 272 B $({\color{green}-11.69\%})$ 276 B $({\color{gray}0\%})$

Garbage Collection

Region (fill 1/100) Region (fill 1/50) StableMemory
10 pages 208.34 KiB $({\color{green}-91.44\%})$ 832.38 KiB $({\color{green}-91.45\%})$ 336 B $({\color{gray}0\%})$
100 pages 4.06 MiB $({\color{green}-91.46\%})$ 8.13 MiB $({\color{green}-91.46\%})$ 340 B $({\color{gray}0\%})$
256 pages 10.4 MiB $({\color{green}-91.46\%})$ 20.8 MiB $({\color{green}-91.46\%})$ 340 B $({\color{gray}0\%})$

Stable Memory

Region (fill 1/100) Region (fill 1/50) StableMemory
10 pages 8 MiB $({\color{gray}0\%})$ 8 MiB $({\color{gray}0\%})$ 8 MiB $({\color{gray}0\%})$
100 pages 8 MiB $({\color{gray}0\%})$ 8 MiB $({\color{gray}0\%})$ 0 B $({\color{gray}0\%})$
256 pages 16 MiB $({\color{gray}0\%})$ 16 MiB $({\color{gray}0\%})$ 16 MiB $({\color{gray}0\%})$

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/multi-502fa5ddc3 branch from a5a4d3b to ccbf262 Compare January 21, 2026 22:01
@Kamirus Kamirus enabled auto-merge (squash) March 19, 2026 09:02
@Kamirus Kamirus disabled auto-merge March 19, 2026 09:08
Kamirus added a commit that referenced this pull request Mar 23, 2026
## Summary
- Bumped `tar` (7.5.9 → 7.5.11) and `minimatch` (10.0.1 → 10.2.4) in
`cli/package.json` — security fixes for path traversal and ReDoS
- Updated `cli/package-lock.json` and `docs/package-lock.json`
transitive deps in-place to pick up security patches (lodash, js-yaml,
node-forge, jws, undici, flatted, ajv, etc.)
- `cli-releases/frontend` changes come from merged PR #340 (vite 5.2.6 →
5.4.21)
- `frontend/package-lock.json` reverted to main — `npm update
--legacy-peer-deps` introduced a `@dfinity/agent` ↔ `@dfinity/candid`
peer dep conflict that broke CI
- `blog/package-lock.json` was already up to date (no changes needed)

### What was NOT included and why
- **`frontend/package-lock.json`** — peer dep conflict between
`@dfinity/agent@1.0.1` and `@dfinity/candid@0.19.3` prevents a clean
lockfile update. Needs a coordinated `@dfinity/*` dependency bump in a
separate PR.
- **Unfixable transitive vulns in CLI** — `axios` (via `wasm-pack` →
`binary-install`) and `esbuild` (via `tsx`) can't be updated without
breaking upstream. Pre-existing on main.

### Closed dependabot PRs (replaced by this PR)
#368, #341, #344, #338, #345, #346, #349, #323, #328, #382, #353, #359,
#357, #348, #325, #324, #421, #419, #379, #377

## Test plan
- [x] Benchmarks pass
- [x] mops test passes (node 20 + node 24, all install methods)
- [ ] CI workflow passes
- [ ] Code quality (lint, format) passes

## Verification
Ran findings-verifier on both direct dependency bumps:
- **minimatch 10.0.1 → 10.2.4**: All changes are additive (new options,
perf/security hardening). CLI uses a simple glob pattern unaffected by
any changes.
- **tar 7.5.9 → 7.5.11**: Pure security fixes in extraction path
validation. No API surface changes. CLI's tar usage (create + extract)
is standard and unaffected.
- **No new peer deps**, no engine requirement changes, no breaking API
changes.

---

## Remaining Open PRs — TODO

### Review & Merge (real package.json bumps, security fixes)
| PR | What | Status |
|---|---|---|
| #336 | Vite 5.2.6 → 5.4.21 in `/frontend` | Multiple CVEs fixed |
| #361 | Elliptic + ic-mops in `/frontend` | Critical crypto
vulnerability |
| #367 | Tar + ic-mops in `/frontend` | Tar path traversal fix |
| #420 | Devalue + @sveltejs/kit in `/cli-releases/frontend` | Real
package.json bump |

### Need @dependabot rebase (merge conflict with main)
| PR | What | Status |
|---|---|---|
| #372 | Tar 7.5.6 → 7.5.7 in `/cli` | Now superseded — tar bumped to
7.5.11 in this PR |
| #342 | Glob 11.0.1 → 11.1.0 in `/cli` | Security fix —
GHSA-5j98-mcp5-4vw2 |

### Need Careful Review (major version bumps, risk of breakage)
| PR | What | Status |
|---|---|---|
| #380 | Docusaurus 2.4.3 → 3.9.2 in `/docs` | Major v2 → v3. Test docs
locally. |
| #329 | vite-plugin-static-copy 1.0.2 → 2.3.2 in `/frontend` | Major v1
→ v2. Has security fix but API may differ. |

### Non-Dependabot PRs
| PR | Author | What |
|---|---|---|
| #411 | rvanasa | Test global Mops installation in CI |
| #363 | codecustard | Fix code page scroll naturally like docs page |
@Kamirus
Copy link
Copy Markdown
Collaborator

Kamirus commented Mar 23, 2026

@dependabot rebase

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Mar 23, 2026

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@Kamirus
Copy link
Copy Markdown
Collaborator

Kamirus commented Mar 23, 2026

@dependabot recreate

Removes [elliptic](https://github.com/indutny/elliptic). It's no longer used after updating ancestor dependency [ic-mops](https://github.com/caffeinelabs/mops). These dependencies need to be updated together.


Removes `elliptic`

Updates `ic-mops` from 0.40.0 to 2.0.0
- [Commits](https://github.com/caffeinelabs/mops/commits)

---
updated-dependencies:
- dependency-name: elliptic
  dependency-version: 
  dependency-type: indirect
- dependency-name: ic-mops
  dependency-version: 2.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/multi-502fa5ddc3 branch from 80d1f21 to 0ea5359 Compare March 23, 2026 19:00
@Kamirus Kamirus merged commit 401aaa5 into main Mar 23, 2026
21 checks passed
@Kamirus Kamirus deleted the dependabot/npm_and_yarn/frontend/multi-502fa5ddc3 branch March 23, 2026 19:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant