Merge pull request #1723 from input-output-hk/chore/dep-bumps

chore(deps): dependency modernization — WebdriverIO 9, express 5, resolutions →5

Author: rhyslbw

.yarn/constraints.pro

@@ -1,19 +1,12 @@
-gen_enforced_dependency ForbidMaliciousReleases:
-  backslash "!=0.2.1"
-  chalk-template "!=1.1.1"
-  supports-hyperlinks "!=4.1.1"
-  has-ansi "!=6.0.1"
-  simple-swizzle "!=0.2.3"
-  color-string "!=2.1.1"
-  error-ex "!=1.3.3"
-  color-name "!=2.0.1"
-  is-arrayish "!=0.3.3"
-  slice-ansi "!=7.1.1"
-  color-convert "!=3.1.1"
-  wrap-ansi "!=9.0.1"
-  ansi-regex "!=6.2.1"
-  supports-color "!=10.2.1"
-  strip-ansi "!=7.1.1"
-  chalk "!=5.6.1"
-  debug "!=4.4.2"
-  ansi-styles "!=6.2.2"
+% Yarn constraints for supply-chain enforcement (`yarn constraints`).
+%
+% The Sept-2025 qix-hack malicious-version blocklist that previously lived
+% here has been removed: those releases are unpublished from npm (404) and
+% the affected packages now resolve to clean current versions, so the
+% blocklist no longer matches anything.
+%
+% Add `gen_enforced_dependency` rules below to block future malicious
+% releases or pin known-good versions, e.g.:
+%
+%   gen_enforced_dependency ForbidMaliciousReleases:
+%     some-package "!=1.2.3"

docs/security/dependency-vulnerability-audit-2026-06-19.md

@@ -464,6 +464,59 @@ Moved only because an in-range relock re-resolved a shared sub-tree. Listed for
 | `webpack-sources` | 3.3.3 → 3.5.0 | transitive · dev-only · consumer:no | MIT | 7 / 3.5.0 |
 | `yargs` | 14.2.3, 16.2.0, 17.7.1 → 14.2.3, 16.2.0, 17.7.1, 17.7.3 | transitive · dev-only · consumer:no | MIT | 2 / 18.0.0 |
 
+## Follow-up wave — direct bumps on the Node 22 baseline (2026-06-20)
+
+The four deferred direct-dependency bumps that required the Node 22 runtime (or a major parent bump) as a prerequisite, now actioned together. Each clears a consumer-facing or build-context alert that the in-range relock could not reach; this resolves the interim PARTIAL on `uuid` from §A (its direct lines now all sit on the patched major; the residual `8.3.2`/`9.0.0` copies are transitive-only — pinned by `pg-boss`, `typeorm-extension` and the Trezor stack — and stay tracked).
+
+| Package | Version (→ updated) | Status (severity) | Scope | License | Provenance / publisher |
+|---|---|---|---|---|---|
+| `uuid` | direct 10.0.0 → **11.1.1** (transitive 8.3.2, 9.0.0 remain) | CLOSED direct · PARTIAL transitive (medium) | direct · prod · consumer:yes | MIT | signed + SLSA; publisher `ctavan` → GitHub Actions OIDC (provenance adoption, benign) |
+| `ip-address` | 9.0.5 → **10.2.0** | CLOSED (medium) | direct · prod · consumer:yes | MIT | signed; publisher `beaugunderson` unchanged |
+| `axios` | 1.11.0 → **1.18.0** (in-range relock, ^1.7.4) | CLOSED (high) | direct · prod · consumer:yes | MIT | signed + SLSA; publisher `jasonsaayman` → GitHub Actions OIDC trusted-publisher (approver `jasonsaayman`), benign |
+| `express-openapi-validator` | 4.13.8 → **5.6.2** | CLOSED (high) | direct · prod · consumer:yes | MIT | signed; publisher `cdimascio` unchanged |
+| `multer` | 1.4.5-lts.2 → **2.2.0** | CLOSED (high) | transitive (via `express-openapi-validator`) · prod · consumer:yes | MIT | signed; publisher `linusu` → `ulisesgascon` — **human→human**, a known maintenance handoff to the Express/OpenJS maintainer; benign |
+
+### Dependencies modified in this wave
+
+Only the direct `package.json` edges this PR touches: each arrow is a package whose manifest bumps the dependency it points to (sinks coloured by advisory severity — 🟡 medium · 🟠 high). `axios` is an in-range relock (same `^1.7.4` range, new resolution). Everything downstream inherits these transitively and is **not** itself modified, so it is not shown.
+
+```mermaid
+flowchart LR
+  classDef pkg fill:#eef2ff,stroke:#6366f1,color:#111;
+  classDef med fill:#fde68a,stroke:#a16207,color:#111;
+  classDef high fill:#fdba74,stroke:#c2410c,color:#111;
+
+  p_core["core"]:::pkg
+  p_cardano_services["cardano-services"]:::pkg
+  p_cardano_services_client["cardano-services-client"]:::pkg
+  p_e2e["e2e"]:::pkg
+  p_util_dev["util-dev"]:::pkg
+  p_projection_typeorm["projection-typeorm"]:::pkg
+  p_wallet["wallet"]:::pkg
+  p_web_extension["web-extension"]:::pkg
+
+  d_ip("ip-address<br/>medium"):::med
+  d_axios("axios<br/>high · relock"):::high
+  d_eov("express-openapi-validator → multer<br/>high"):::high
+  d_uuid("uuid<br/>medium"):::med
+
+  p_core --> d_ip
+  p_cardano_services --> d_axios
+  p_cardano_services --> d_eov
+  p_cardano_services --> d_uuid
+  p_cardano_services_client --> d_axios
+  p_e2e --> d_axios
+  p_e2e --> d_uuid
+  p_util_dev --> d_axios
+  p_projection_typeorm --> d_uuid
+  p_wallet --> d_uuid
+  p_web_extension --> d_uuid
+```
+
+- **Cross-referenced databases:** OSV.dev returns **0** records for every resolved version above (`uuid@11.1.1`, `ip-address@10.2.0`, `axios@1.18.0`, `multer@2.2.0`, `express-openapi-validator@5.6.2`). **0** of the residual transitive advisories (`uuid<11.1.1`, `ws 8.5.0`, `yaml 2.6.1`) intersect the CISA KEV catalogue (1623 entries) — none are under active exploitation, so deferral remains appropriate.
+- **Production closure:** `yarn npm audit --environment production` is clean (exit 0) on this baseline — no advisory reaches a published package's production tree.
+- **Regression check:** lockfile diff vs the Node 22 baseline shows only upgrades and removals consistent with these bumps (e.g. `express-openapi-validator` v5 swaps `json-schema-ref-parser`→`@apidevtools/json-schema-ref-parser` 14.x, drops `lodash.uniq`/`lodash.zipobject`/`call-me-maybe`/`concat-stream@1.x`; `multer` 1.x removed). No shared transitive was silently downgraded.
+
 ## Method & limitations
 
 - **Vulnerability status** tests each resolved version against the advisory's vulnerable range (semver). PARTIAL = the manifest range moved to a patched version but another consumer pins an older, still-vulnerable copy — enumerated in the deferred-work issues (#1701–#1708).

package.json

@@ -90,32 +90,17 @@
     "ts-node": "^10.0.0",
     "ts-node-dev": "^1.1.8",
     "tsc-alias": "^1.8.10",
-    "tsx": "^4.15.6",
+    "tsx": "^4.22.4",
     "typedoc": "^0.23.24",
     "typedoc-plugin-missing-exports": "^1.0.0",
     "typescript": "^4.7.4"
   },
   "packageManager": "yarn@3.2.1",
   "resolutions": {
-    "color": "4.2.3",
-    "color-string": "1.9.1",
-    "color-convert": "2.0.1",
-    "color-name": "1.1.4",
-    "chalk": "4.1.2",
-    "chalk-template": "1.1.0",
-    "wrap-ansi": "7.0.0",
-    "slice-ansi": "7.1.0",
-    "strip-ansi": "6.0.1",
-    "ansi-styles": "4.3.0",
-    "ansi-regex": "5.0.1",
-    "supports-color": "7.2.0",
-    "supports-hyperlinks": "3.0.0",
-    "debug": "4.3.4",
-    "is-arrayish": "0.3.2",
-    "simple-swizzle": "0.2.2",
-    "error-ex": "1.3.2",
-    "has-ansi": "5.0.1",
-    "backslash": "0.2.0",
-    "protobufjs": "7.6.4"
+    "@opentelemetry/core": "^2.8.0",
+    "js-yaml": "^4.2.0",
+    "tar": "^7.5.16",
+    "tmp": "^0.2.6",
+    "uuid": "^11.1.1"
   }
 }

packages/cardano-services-client/package.json

@@ -46,7 +46,7 @@
     "@types/validator": "^13.7.1",
     "axios-mock-adapter": "^2.0.0",
     "eslint": "^7.32.0",
-    "express": "^4.20.0",
+    "express": "^5.2.1",
     "get-port-please": "^2.5.0",
     "jest": "^28.1.3",
     "madge": "^5.0.1",

packages/cardano-services/package.json

@@ -65,17 +65,16 @@
     "@types/cors": "^2.8.13",
     "@types/death": "^1.1.2",
     "@types/dockerode": "^3.3.8",
-    "@types/express": "^4.17.13",
+    "@types/express": "^5.0.6",
     "@types/express-prometheus-middleware": "^1.2.1",
     "@types/lodash": "^4.14.182",
     "@types/pg": "^8.6.5",
-    "@types/uuid": "^8.3.4",
     "@types/wait-on": "^5.3.1",
     "@types/ws": "^8.5.10",
     "axios-mock-adapter": "^2.0.0",
     "cbor": "^8.1.0",
     "delay": "^5.0.0",
-    "dockerode": "^3.3.1",
+    "dockerode": "^4.0.7",
     "dockerode-utils": "^0.0.7",
     "eslint": "^7.32.0",
     "get-port-please": "^2.5.0",
@@ -88,7 +87,7 @@
     "ts-node": "^10.0.0",
     "typeorm-extension": "^2.7.0",
     "typescript": "^4.7.4",
-    "wait-on": "^6.0.1"
+    "wait-on": "^9.0.0"
   },
   "dependencies": {
     "@blockfrost/blockfrost-js": "^5.7.0",
@@ -104,7 +103,7 @@
     "axios": "^1.7.4",
     "backoff-rxjs": "^7.0.0",
     "bignumber.js": "^9.1.0",
-    "body-parser": "^1.20.3",
+    "body-parser": "^2.3.0",
     "bottleneck": "^2.19.5",
     "bunyan": "^1.8.15",
     "commander": "^9.1.0",
@@ -113,9 +112,9 @@
     "debug": "^4.3.4",
     "dotenv": "^16.0.0",
     "envalid": "^7.3.1",
-    "express": "^4.20.0",
-    "express-openapi-validator": "^4.13.8",
-    "express-prom-bundle": "^6.4.1",
+    "express": "^5.2.1",
+    "express-openapi-validator": "^5.6.2",
+    "express-prom-bundle": "^8.0.0",
     "fraction.js": "^4.2.0",
     "fuse.js": "^7.0.0",
     "json-bigint": "^1.0.0",
@@ -126,13 +125,13 @@
     "pg": "^8.7.3",
     "pg-boss": "8.4.2",
     "pg-connection-string": "^2.5.0",
-    "prom-client": "^14.0.1",
+    "prom-client": "^15.1.3",
     "reflect-metadata": "~0.1.13",
     "rxjs": "^7.4.0",
     "ts-custom-error": "^3.2.0",
     "ts-log": "^2.2.4",
     "typeorm": "^0.3.15",
-    "uuid": "^10.0.0",
+    "uuid": "^11.1.1",
     "ws": "^8.17.1"
   },
   "files": [

packages/cardano-services/src/Http/HttpServer.ts

@@ -275,7 +275,10 @@ export class HttpServer extends RunnableModule {
         metricsPath: path
           .join(versionPath, this.#config.metrics?.options?.metricsPath || '/metrics')
           .replaceAll(path.sep, '/')
-      })
+        // express-prom-bundle v8 types Opts as a discriminated (summary|histogram) union;
+        // spreading the optional config options into the literal can't be narrowed, so assert
+        // the (runtime-valid, histogram) shape explicitly.
+      } as expressPromBundle.Opts)
     );
     this.logger.info(
       `Prometheus metrics: ${(await promRegistry.getMetricsAsArray()).map(({ name }) => name)} configured at ${

packages/cardano-services/src/util/http.ts

@@ -7,7 +7,12 @@ export const listenPromise = (
   listenOptions: ListenOptions = {}
 ): Promise<http.Server> =>
   new Promise((resolve, reject) => {
-    const server = serverLike.listen(listenOptions, () => resolve(server)) as http.Server;
+    // express 5's `app.listen` forwards bind errors to the listen callback (error-first),
+    // whereas raw http.Server.listen signals them via the 'error' event — handle both so a
+    // failed bind (e.g. EADDRINUSE) rejects instead of resolving with an unbound server.
+    const server = serverLike.listen(listenOptions, (error?: Error) =>
+      error ? reject(error) : resolve(server)
+    ) as http.Server;
     server.on('error', reject);
   });
 

packages/cardano-services/src/util/openApi.ts

@@ -2,7 +2,7 @@ import { OpenAPIV3 } from 'express-openapi-validator/dist/framework/types';
 
 export const versionPathFromSpec = (specPath: string) => {
   try {
-    const apiDoc = require(specPath) as OpenAPIV3.Document;
+    const apiDoc = require(specPath) as OpenAPIV3.DocumentV3;
 
     return `/v${apiDoc.info.version}`;
   } catch (error) {

packages/cardano-services/test/Http/HttpServer.test.ts

@@ -184,7 +184,8 @@ describe('HttpServer', () => {
           .filter(({ level, message }) => level === 'debug' && message[0] === '[HttpServer|request]')
           .map(({ message: [, requestDetails] }) => requestDetails)
       ).toEqual([
-        { body: {}, method: 'HEAD', path: baseVersionPath, query: {} },
+        // body-parser v2 leaves req.body undefined for bodyless requests (v1 set it to {})
+        { body: undefined, method: 'HEAD', path: baseVersionPath, query: {} },
         {
           body: { bigint: 23n, check: 'ok', test: 42 },
           method: 'POST',
@@ -193,7 +194,7 @@ describe('HttpServer', () => {
           query: {}
         },
         {
-          body: {},
+          body: undefined,
           method: 'GET',
           // Note: `.replaceAll(path.sep, '/')` is needed on Windows:
           path: path.join(someServiceVersionPath, 'stake-pool', 'echo').replaceAll(path.sep, '/'),

packages/cardano-services/test/util/openApi.test.ts

@@ -8,7 +8,7 @@ describe('openApi utils', () => {
       const apiSpecPath = path.join(__dirname, '..', '..', 'src', 'Http', 'openApi.json');
       const {
         info: { version }
-      } = require(apiSpecPath) as OpenAPIV3.Document;
+      } = require(apiSpecPath) as OpenAPIV3.DocumentV3;
       expect(version).not.toBeUndefined();
       expect(versionPathFromSpec(apiSpecPath)).toBe(`/v${version}`);
     });