Skip to content

v0.4.1 — security patch

Choose a tag to compare

View all tags
@szhygulin szhygulin released this 14 Apr 09:37
· 961 commits to main since this release
v0.4.1
7c3a3a5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security patch release. No API changes, no breaking behaviour.

Security fixes

  • TRON rawDataHex verification before signing. Every TronGrid builder now decodes the returned Transaction.raw protobuf and asserts the inner contract matches caller intent (owner/to/amount/contract/calldata/vote_count/resource/fee_limit) byte-for-byte before issuing a signing handle. Closes the MITM window where a compromised TronGrid response could swap destination or amount between the JSON preview shown to the user and the hex the Ledger actually signs.
  • Feedback issue titles neutralize @-mentions. GitHub parses @-mentions in issue titles, not just bodies; prompt-injected summaries could have pinged arbitrary users when an issue was opened.
  • RPC config errors redact URLs. Configured RPC URLs commonly embed a provider API key in the path; RpcConfigError no longer interpolates the URL into its message, so malformed URLs can't leak keys into logs/stderr.
  • vitest ^2.1.0 → ^4.1.4. Pulls a vite/esbuild chain that resolves GHSA-67mh-4wv8-2f99 (dev-only). 341/341 tests pass unchanged on the new major. npm audit → 0 vulnerabilities.

Socket.dev supply-chain triage

Triaged but not actionable in our deployment:

  • picomatch@2.3.2 ReDoS (via @walletconnect/keyvaluestorage → unstorage → anymatch) — glob patterns are WC-internal storage keys, never user-controlled. picomatch@4 is ESM-only and breaks anymatch@3's CJS usage.
  • @0no-co/graphqlsp / @gql.tada/cli-utils — dev-only GraphQL LSP + CLI transitively via @lifi/sdk → @mysten/sui, never invoked at runtime.
  • node-mock-http / parseurl "typosquat" flags — false positives on legitimate UnJS / jshttp packages.

See PR #30 for full technical detail.

Verification

  • npx vitest run — 341/341 pass
  • npx tsc --noEmit — clean
  • npm audit — 0 vulnerabilities

Install

npm install vaultpilot-mcp@0.4.1

Also published to the MCP Registry as io.github.szhygulin/vaultpilot-mcp@0.4.1.

Assets 2
Loading