Heka Wallet security updates

[AlexanderShenshin]

Description:

Dependencies upgrade for Heka Wallet, based on lockfile audit.

Checklist

• Documented (Code comments, README, etc.)
• Tested (unit, integration, etc.)

[lfdt-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1674242f-083d-4d9b-8fc8-00133beebcdb

📥 Commits

Reviewing files that changed from the base of the PR and between c0833a8 and 1322e32.

⛔ Files ignored due to path filters (1)

• heka-wallet/yarn.lock is excluded by !**/yarn.lock, !**/*.lock, !**/*.lock, !**/yarn.lock

📒 Files selected for processing (3)

• heka-wallet/app/package.json
• heka-wallet/package.json
• heka-wallet/packages/shared/package.json

---

Walkthrough

Three package.json files are updated: lodash is bumped to ^4.18.1 in app and packages/shared; semver is bumped to ^7.5.2 in app; and the root heka-wallet/package.json gains yarn resolution overrides pinning protobufjs, @grpc/grpc-js, bn.js, and elliptic to specific versions.

Changes

Dependency Version Updates

Layer / File(s)	Summary
Direct dependency bumps: lodash and semver heka-wallet/app/package.json, heka-wallet/packages/shared/package.json	lodash bumped from 4.17.21 to ^4.18.1 in both locations; semver bumped from 7.3.8 to ^7.5.2 in app.
Root resolution overrides for transitive deps heka-wallet/package.json	Adds resolutions entries for protobufjs (two version selectors), @grpc/grpc-js, bn.js (two version selectors), and elliptic, pinning each to a specific newer version alongside the existing @credo-ts/didcomm patch entry.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly addresses the main change: security updates for Heka Wallet through dependency version bumps.
Description check	✅ Passed	The description is related to the changeset, explaining that dependencies were upgraded based on a lockfile audit for security concerns.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/heka-wallet-security-updates

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}