Upstream guardian contract#296
Open
zeljkoX wants to merge 37 commits into
Open
Conversation
…291) The wallet-embedded 0.15 SDK exposes Word.toFelts() but not toU64s() on storage-read Words (a published-0.15 .d.ts/glue gap), which crashed AccountInspector.fromAccount during MultisigClient.load with 'word.toU64s is not a function'. Prefer toU64s when present, else toFelts (same element order, so indices are unchanged).
# Conflicts: # Cargo.lock
* feat(server): generate OpenAPI spec with utoipa (#241) Integrate utoipa to auto-generate an OpenAPI 3.1 spec from the HTTP handlers and wire models, so API docs stay in sync with the code. - Annotate every HTTP handler (client, dashboard, and feature-gated EVM surfaces) with `#[utoipa::path]` and derive `ToSchema` / `IntoParams` on the request/response/query/model types. - Add `openapi::openapi()` which assembles the document and merges the EVM routes only when the `evm` feature is compiled in. - Serve the spec at `GET /api-docs/openapi.json` (unauthenticated, read-only) and add a `gen-openapi` binary to write it to a file. - Commit the generated `docs/openapi.json` (built with `evm`) and document it in `docs/OPENAPI.md`. 36 operations / 82 schemas. Purely additive: no wire-shape changes, so the Rust/TS clients need no updates. * feat(server): address OpenAPI review — auth, errors, granular specs, CI drift Addresses review feedback on #271: - Document auth: add OpenAPI security schemes for the signed client headers (x-pubkey/x-signature/x-timestamp) and the operator/EVM session cookies, and apply `security(...)` per operation. Challenge/verify/pubkey stay public. - Fill missing error responses: cross-cutting 429/413 injected into every operation via a Modify addon; dashboard 404/503 gaps (detail/snapshot), unpause 400, EVM 403 signer-authorization, lookup 400/500. - Generate granular specs alongside the combined one: openapi-client.json, openapi-dashboard.json, openapi-evm.json (map to the TS client packages, scope SDK generation). gen-openapi now emits all four and gained a `--check` drift mode. - CI: new "OpenAPI Spec Drift" job fails when committed specs are stale. - Reduce duplication: replace the per-endpoint shape catalog in spec/api.md with an endpoint index + behavioral notes pointing at the OpenAPI specs as the source of truth (804 -> 479 lines). - Contributor guidance: AGENTS.md contract-change workflow + server layer guidance now require updating utoipa annotations and regenerating specs. * docs(server): fix configure handler doc to name the real auth headers The doc comment (and the OpenAPI description generated from it) said `X-Guardian-*`, but the headers parsed by `AuthHeader` are `x-pubkey`, `x-signature`, and `x-timestamp`. --------- (cherry picked from commit 61260a0)
* feat(server): add native Prometheus metrics endpoint * feat(server): address PR review — RPC/pool/lifecycle metrics, bounded gRPC labels, label enums * feat(server): instrument the metadata DB pool too, via a pool label (cherry picked from commit 89e7f3a)
Keep the upstream guarded-multisig contract throughout; discard every local-contract reintroduction the merge tried to bring back. Conflict resolution policy: - Removed reintroduced local contracts: crates/contracts/masm/**, packages/miden-multisig-client/masm/auth/*.masm and src/account/masm/auth.ts. - Kept ours (upstream) for contract-identity/coupled files: multisig_guardian.rs, contracts auth tests, procedures.rs/ts (procedure roots), transaction/mod.rs, updateSigners.ts, network/miden/mod.rs (replay-protection), account_inspector.rs, docs/PRODUCTION.md (0.15 cutover section). - Took the non-contract improvements: canonicalization orphan-on-discard fix, smoke-web vite config, and the auto-merged TS client utilities. - Regenerated Cargo.lock. Verified: cargo build --workspace clean; TS build clean; 303/304 TS tests pass. The single failure (procedure-roots auth_tx) is pre-existing SDK drift on this branch, unrelated to the merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The auth_tx procedure root was stale against the installed miden-sdk 0.15.0 compiled AuthGuardedMultisig component (the five custom/wallet roots already matched). Recomputed via `cargo run --example procedure_roots -- --json` and updated the canonical (typescript_hex) value in both the Rust and TS clients: auth_tx: 0xd7b760e2… -> 0x08f59357487cebf34c4557dd9fc32cecb82d9f7b3d3bba213a68a9729e463260 Verified: Rust procedure_roots_match_upstream_component passes; TS 304/304 pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThe PR migrates guarded multisig accounts from custom OpenZeppelin MASM to Miden Standards, removes guardian selector state, updates Rust and TypeScript SDK transaction flows, adds contract-version pinning, refreshes server fixtures, and introduces browser-based cross-SDK determinism checks. ChangesGuarded multisig contract migration
TypeScript SDK migration
Documentation and examples
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested labels: Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
All contributors have signed the CLA ✍️ ✅ |
![semgrep-code-openzeppelin[bot]](https://avatars.githubusercontent.com/u/20820676?s=60&v=4){kind=small}
| @@ -12128,36 +12226,148 @@ | |||
| } | |||
| }, | |||
| "node_modules/axios": { | |||
There was a problem hiding this comment.
Medium severity vulnerability introduced by a package you're using:
Line 12228 lists a dependency (axios) with a known Medium severity vulnerability. Fixing requires upgrading or replacing the dependency.
ℹ️ Why this matters
Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise.
To resolve this comment:
Upgrade this dependency to at least version 1.15.0 at examples/smoke-web/package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| @@ -14174,38 +14871,169 @@ | |||
| } | |||
| }, | |||
| "node_modules/axios": { | |||
There was a problem hiding this comment.
Medium severity vulnerability introduced by a package you're using:
Line 14873 lists a dependency (axios) with a known Medium severity vulnerability. Fixing requires upgrading or replacing the dependency.
ℹ️ Why this matters
Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise.
To resolve this comment:
Upgrade this dependency to at least version 1.15.0 at examples/web/package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| @@ -12128,36 +12226,148 @@ | |||
| } | |||
| }, | |||
| "node_modules/axios": { | |||
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 12228 lists a dependency (axios) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying NO_PROXY, so requests to loopback or internal hosts such as localhost. or [::1] can be sent through a configured proxy instead of bypassing it. If an attacker can influence request URLs, they may force local/internal Axios traffic through an attacker-controlled proxy, undermining SSRF protections and exposing sensitive responses.
To resolve this comment:
Check if you have NO_PROXY configured in your environment.
- If you're affected, upgrade this dependency to at least version 1.15.0 at examples/smoke-web/package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| @@ -14174,38 +14871,169 @@ | |||
| } | |||
| }, | |||
| "node_modules/axios": { | |||
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 14873 lists a dependency (axios) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying NO_PROXY, so requests to loopback or internal hosts such as localhost. or [::1] can be sent through a configured proxy instead of bypassing it. If an attacker can influence request URLs, they may force local/internal Axios traffic through an attacker-controlled proxy, undermining SSRF protections and exposing sensitive responses.
To resolve this comment:
Check if you have NO_PROXY configured in your environment.
- If you're affected, upgrade this dependency to at least version 1.15.0 at examples/web/package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| @@ -12128,36 +12226,148 @@ | |||
| } | |||
| }, | |||
| "node_modules/axios": { | |||
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 12228 lists a dependency (axios) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of axios are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. axios is vulnerable to a regular expression denial of service (ReDoS). The internal cookies.read() helper in lib/helpers/cookies.js builds a regular expression by concatenating the cookie name directly into the pattern without escaping regex metacharacters. When the cookie name flowing into the XSRF cookie read (e.g. via xsrfCookieName) contains a catastrophic-backtracking payload, evaluating the regex against document.cookie can freeze the JavaScript event loop, causing a denial of service in the browser tab or in Node.js/SSR applications. The affected code path is reached during ordinary axios request processing, so any importer of an affected version is exposed. Upgrade to a patched version (0.32.0 or 1.16.0), or set xsrfCookieName: null to disable XSRF cookie reading.
References: GHSA
To resolve this comment:
Check if you are using axios in browser with untrusted xsrfCookieName value.
- If you're affected, upgrade this dependency to at least version 1.16.0 at examples/smoke-web/package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| @@ -14174,38 +14871,169 @@ | |||
| } | |||
| }, | |||
| "node_modules/axios": { | |||
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 14873 lists a dependency (axios) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of axios are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. axios is vulnerable to a regular expression denial of service (ReDoS). The internal cookies.read() helper in lib/helpers/cookies.js builds a regular expression by concatenating the cookie name directly into the pattern without escaping regex metacharacters. When the cookie name flowing into the XSRF cookie read (e.g. via xsrfCookieName) contains a catastrophic-backtracking payload, evaluating the regex against document.cookie can freeze the JavaScript event loop, causing a denial of service in the browser tab or in Node.js/SSR applications. The affected code path is reached during ordinary axios request processing, so any importer of an affected version is exposed. Upgrade to a patched version (0.32.0 or 1.16.0), or set xsrfCookieName: null to disable XSRF cookie reading.
References: GHSA
To resolve this comment:
Check if you are using axios in browser with untrusted xsrfCookieName value.
- If you're affected, upgrade this dependency to at least version 1.16.0 at examples/web/package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| @@ -12128,36 +12226,148 @@ | |||
| } | |||
| }, | |||
| "node_modules/axios": { | |||
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 12228 lists a dependency (axios) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Unintended Proxy or Intermediary ('Confused Deputy'). axios reads config.proxy via prototype-chain property access, so any Object.prototype pollution elsewhere in the dependency tree silently routes all HTTP requests through an attacker-controlled proxy, yielding a full man-in-the-middle. The vulnerability fires on ordinary axios usage with no specific API call or configuration required; upgrade to axios 1.16.0 or later.
To resolve this comment:
Check if you use axios to make HTTP requests.
- If you're affected, upgrade this dependency to at least version 1.16.0 at examples/smoke-web/package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| @@ -14174,38 +14871,169 @@ | |||
| } | |||
| }, | |||
| "node_modules/axios": { | |||
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 14873 lists a dependency (axios) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Unintended Proxy or Intermediary ('Confused Deputy'). axios reads config.proxy via prototype-chain property access, so any Object.prototype pollution elsewhere in the dependency tree silently routes all HTTP requests through an attacker-controlled proxy, yielding a full man-in-the-middle. The vulnerability fires on ordinary axios usage with no specific API call or configuration required; upgrade to axios 1.16.0 or later.
To resolve this comment:
Check if you use axios to make HTTP requests.
- If you're affected, upgrade this dependency to at least version 1.16.0 at examples/web/package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
Codecov Report❌ Patch coverage is ❌ Your patch status has failed because the patch coverage (68.42%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #296 +/- ##
==========================================
+ Coverage 77.56% 77.63% +0.06%
==========================================
Files 162 162
Lines 29603 29528 -75
==========================================
- Hits 22963 22923 -40
+ Misses 6640 6605 -35 Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
![boostsecurity-io[bot]](https://avatars.githubusercontent.com/in/192984?s=60&v=4){kind=small}
There was a problem hiding this comment.
🚀 2 New Security Fixes
You just committed 2 security fixes. 😎 Keep up the great work!
🎯 Take a look at what findings you fixed.
| Findings | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Dependency: npm / protobufjs@ 6.11.6 SUMMARY Direct Dependency: protobufjs Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.20.1 SUMMARY Direct Dependency: ws Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
⚠️ 27 New Security Findings
The latest commit contains 27 new security findings.
| Findings | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Dependency: npm / axios@ 1.13.6 SUMMARY Direct Dependency: axios Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / axios@ 1.13.6 SUMMARY Direct Dependency: axios Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / brace-expansion@ 1.1.12 SUMMARY Direct Dependency: brace-expansion Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / brace-expansion@ 1.1.12 SUMMARY Direct Dependency: brace-expansion Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / follow-redirects@ 1.15.11 SUMMARY Direct Dependency: follow-redirects Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / follow-redirects@ 1.15.11 SUMMARY Direct Dependency: follow-redirects Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / form-data@ 2.5.5 SUMMARY Direct Dependency: form-data Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / form-data@ 2.5.5 SUMMARY Direct Dependency: form-data Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / hono@ 4.12.8 SUMMARY Direct Dependency: hono Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / hono@ 4.12.8 SUMMARY Direct Dependency: hono Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / js-yaml@ 3.14.2 SUMMARY Direct Dependency: js-yaml Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / js-yaml@ 3.14.2 SUMMARY Direct Dependency: js-yaml Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / lodash@ 4.17.23 SUMMARY Direct Dependency: lodash Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 2.3.1 SUMMARY Direct Dependency: picomatch Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 4.0.3 SUMMARY Direct Dependency: picomatch Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 2.3.1 SUMMARY Direct Dependency: picomatch Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 4.0.3 SUMMARY Direct Dependency: picomatch Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / shell-quote@ 1.8.3 SUMMARY Direct Dependency: shell-quote Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / shell-quote@ 1.8.3 SUMMARY Direct Dependency: shell-quote Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ua-parser-js@ 2.0.9 SUMMARY Direct Dependency: ua-parser-js Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ua-parser-js@ 2.0.9 SUMMARY Direct Dependency: ua-parser-js Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 11.1.0 SUMMARY Direct Dependency: uuid Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 11.1.0 SUMMARY Direct Dependency: uuid Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.19.0 SUMMARY Direct Dependency: ws Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.19.0 SUMMARY Direct Dependency: ws Location : package-lock.json OCCURRENCES
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / yaml@ 2.8.2 SUMMARY Direct Dependency: yaml Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / yaml@ 2.8.2 SUMMARY Direct Dependency: yaml Location : package-lock.json OCCURRENCE
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
Scanner: boostsecurity - Trivy (Filesystem scanning)
There was a problem hiding this comment.
🚀 4 New Security Fixes
You just committed 4 security fixes. 😎 Keep up the great work!
🎯 Take a look at what findings you fixed.
| Findings | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Dependency: npm / node-forge@ 1.3.1 SUMMARY Dependency: node-forge Transitive through:
Location : examples/_shared/multisig-browser/package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / protobufjs@ 6.11.6 SUMMARY Dependency: protobufjs Transitive through:
Location : examples/_shared/multisig-browser/package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / underscore@ 1.12.1 SUMMARY Dependency: underscore Transitive through:
Location : examples/_shared/multisig-browser/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.20.1 SUMMARY Dependency: ws Transitive through:
Location : examples/_shared/multisig-browser/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
⚠️ 27 New Security Findings
The latest commit contains 27 new security findings.
| Findings | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Dependency: npm / axios@ 1.13.6 SUMMARY Dependency: axios Transitive through:
Location : examples/web/package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / axios@ 1.13.6 SUMMARY Dependency: axios Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / form-data@ 2.5.5 SUMMARY Dependency: form-data Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / form-data@ 2.5.5 SUMMARY Dependency: form-data Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / hono@ 4.12.8 SUMMARY Dependency: hono Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / hono@ 4.12.8 SUMMARY Dependency: hono Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / lodash@ 4.17.23 SUMMARY Dependency: lodash Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / lodash@ 4.17.21 SUMMARY Dependency: lodash Transitive through:
Location : examples/web/package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / lodash@ 4.17.21 SUMMARY Dependency: lodash Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 2.3.1 SUMMARY Dependency: picomatch Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 4.0.3 SUMMARY Dependency: picomatch Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 2.3.1 SUMMARY Dependency: picomatch Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 4.0.3 SUMMARY Dependency: picomatch Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ses@ 0.18.4 SUMMARY Dependency: ses Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ses@ 0.18.4 SUMMARY Dependency: ses Transitive through:
Location : examples/web/package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / shell-quote@ 1.8.3 SUMMARY Dependency: shell-quote Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / shell-quote@ 1.8.3 SUMMARY Dependency: shell-quote Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 11.1.0 SUMMARY Dependency: uuid Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 8.3.2 SUMMARY Dependency: uuid Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 11.1.0 SUMMARY Dependency: uuid Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 9.0.1 SUMMARY Dependency: uuid Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 9.0.1 SUMMARY Dependency: uuid Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 8.3.2 SUMMARY Dependency: uuid Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.19.0 SUMMARY Dependency: ws Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.19.0 SUMMARY Dependency: ws Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.18.0 SUMMARY Dependency: ws Transitive through:
Location : examples/web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.18.0 SUMMARY Dependency: ws Transitive through:
Location : examples/smoke-web/package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
Scanner: boostsecurity - BoostSecurity SCA
There was a problem hiding this comment.
🚀 2 New Security Fixes
You just committed 2 security fixes. 😎 Keep up the great work!
🎯 Take a look at what findings you fixed.
| Findings | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Dependency: npm / protobufjs@ 6.11.6 SUMMARY Direct Dependency: protobufjs Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.20.1 SUMMARY Direct Dependency: ws Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
⚠️ 27 New Security Findings
The latest commit contains 27 new security findings.
| Findings | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Dependency: npm / axios@ 1.13.6 SUMMARY Direct Dependency: axios Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / axios@ 1.13.6 SUMMARY Direct Dependency: axios Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / brace-expansion@ 1.1.12 SUMMARY Direct Dependency: brace-expansion Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / brace-expansion@ 1.1.12 SUMMARY Direct Dependency: brace-expansion Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / follow-redirects@ 1.15.11 SUMMARY Direct Dependency: follow-redirects Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / follow-redirects@ 1.15.11 SUMMARY Direct Dependency: follow-redirects Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / form-data@ 2.5.5 SUMMARY Direct Dependency: form-data Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / form-data@ 2.5.5 SUMMARY Direct Dependency: form-data Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / hono@ 4.12.8 SUMMARY Direct Dependency: hono Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / hono@ 4.12.8 SUMMARY Direct Dependency: hono Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / js-yaml@ 3.14.2 SUMMARY Direct Dependency: js-yaml Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / js-yaml@ 3.14.2 SUMMARY Direct Dependency: js-yaml Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / lodash@ 4.17.23 SUMMARY Direct Dependency: lodash Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 2.3.1 SUMMARY Direct Dependency: picomatch Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 4.0.3 SUMMARY Direct Dependency: picomatch Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 2.3.1 SUMMARY Direct Dependency: picomatch Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / picomatch@ 4.0.3 SUMMARY Direct Dependency: picomatch Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / shell-quote@ 1.8.3 SUMMARY Direct Dependency: shell-quote Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / shell-quote@ 1.8.3 SUMMARY Direct Dependency: shell-quote Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ua-parser-js@ 2.0.9 SUMMARY Direct Dependency: ua-parser-js Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ua-parser-js@ 2.0.9 SUMMARY Direct Dependency: ua-parser-js Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 11.1.0 SUMMARY Direct Dependency: uuid Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / uuid@ 11.1.0 SUMMARY Direct Dependency: uuid Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.19.0 SUMMARY Direct Dependency: ws Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / ws@ 8.19.0 SUMMARY Direct Dependency: ws Location : package-lock.json OCCURRENCES
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / yaml@ 2.8.2 SUMMARY Direct Dependency: yaml Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dependency: npm / yaml@ 2.8.2 SUMMARY Direct Dependency: yaml Location : package-lock.json OCCURRENCE
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Remediation :
|
Scanner: boostsecurity - OSV-Scanner
zeljkoX
marked this pull request as ready for review
July 15, 2026 07:59
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
examples/rust/src/multisig.rs (1)
105-132: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
build_multisig_config_advicesilently assumes Falcon for every signer.Every approver's scheme-id felt is hardcoded to
SignatureScheme::Falcon.auth_scheme_id(), but the function takes no scheme parameter. Compare with the SDK's ownbuild_multisig_config_adviceincrates/miden-multisig-client/src/transaction/configuration/config.rs, which threads ascheme: SignatureSchemeargument through per-approver. If this example is copied for a mixed-scheme (e.g. ECDSA) cosigner set, the config hash/payload will be silently wrong.🛡️ Proposed fix
pub fn build_multisig_config_advice( threshold: u64, signer_commitments: &[Word], + scheme: SignatureScheme, ) -> (Word, Vec<Felt>) { ... for commitment in signer_commitments.iter().rev() { payload.extend_from_slice(commitment.as_elements()); payload.extend_from_slice(&[ - Felt::new_unchecked(SignatureScheme::Falcon.auth_scheme_id()), + Felt::new_unchecked(scheme.auth_scheme_id()), Felt::new_unchecked(0), Felt::new_unchecked(0), Felt::new_unchecked(0), ]); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/rust/src/multisig.rs` around lines 105 - 132, Update build_multisig_config_advice to accept a SignatureScheme parameter and use that parameter when emitting each approver’s scheme-id felt, matching the SDK’s per-approver scheme handling. Update all callers to pass the intended scheme instead of implicitly assuming Falcon.
🧹 Nitpick comments (9)
examples/smoke-web/miden-sdk-compat.mjs (1)
9-9: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRe-export from the package’s public specifier instead of
dist/
./node_modules/@miden-sdk/miden-sdk/dist/st/eager.jsreaches into the package’s internal layout. Use@miden-sdk/miden-sdkor a documented public subpath so this shim stays aligned with the packageexportsmap and doesn’t break on a dist reshuffle.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/smoke-web/miden-sdk-compat.mjs` at line 9, Update the module re-export in miden-sdk-compat.mjs to use the public `@miden-sdk/miden-sdk` package specifier or a documented public subpath instead of the internal dist/st/eager.js path, while preserving the shim’s exported API.packages/miden-multisig-client/src/inspector.ts (1)
10-10: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove inline
//comments from implementation code.These are new
//comments added alongside the version-guard and guardian-read changes. As per coding guidelines,packages/miden-multisig-client/src/**/*.tsmust not have inline comments (// ...) in implementation code in multisig SDKs.♻️ Proposed fix
-// `AuthGuardedMultisig` storage slot names (miden::standards::auth::*). const MULTISIG_SLOT_NAMES = {- // Reject accounts built from a different contract version before any - // procedure-root-keyed read: against such an account the reads below would - // silently miss its stored overrides (its `procedure_thresholds` map is - // keyed by *its* roots, not this SDK's) and report wrong thresholds. if (!account.code().hasProcedure(Word.fromHex(getProcedureRoot('auth_tx')))) {- // The guarded-multisig has no enable/disable selector; the guardian is always present. - // Read its public key directly from the guardian pub_key slot. let guardianCommitment: string | null = null;Also applies to: 72-75, 104-105
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/miden-multisig-client/src/inspector.ts` at line 10, Remove the newly added inline `//` comments in inspector.ts, including the storage-slot, version-guard, and guardian-read annotations at the referenced locations. Keep the surrounding implementation and behavior unchanged.Source: Coding guidelines
packages/miden-multisig-client/src/transaction/updateSigners.ts (1)
34-34: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove inline comments from implementation code.
These comments (interleave-order note at line 34, FeltArray-ownership note at lines 48-50) are disallowed for multisig SDK implementation code.
As per coding guidelines, "Do not add inline comments (
// ...) in implementation code in multisig SDKs."♻️ Proposed fix
- // Interleave [PUB_KEY, SCHEME_ID] per approver, in reverse index order. for (const commitment of [...signerCommitments].reverse()) {- // `Poseidon2.hashElements` consumes (frees) its `FeltArray` by value, so the advice payload - // must be a separately built array — reusing the hashed array surfaces as "null pointer - // passed to rust" at the later `advice.insert`. const configHash = Poseidon2.hashElements(Also applies to: 48-50
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/miden-multisig-client/src/transaction/updateSigners.ts` at line 34, Remove the inline comments in updateSigners.ts, including the interleave-order comment near the signer data construction and the FeltArray-ownership comment around lines 48–50, while leaving the implementation unchanged.Source: Coding guidelines
packages/miden-multisig-client/src/transaction/updateGuardian.ts (1)
17-19: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove inline comment block from implementation code.
This 3-line explanatory comment above
buildUpdateGuardianScriptis disallowed for multisig SDK implementation code.As per coding guidelines, "Do not add inline comments (
// ...) in implementation code in multisig SDKs."♻️ Proposed fix
-// `update_guardian_public_key(new_guardian_scheme_id, new_guardian_public_key)` takes its -// args on the operand stack: push the key word first, then the scheme id on top, and drop the -// five leftover elements after the call. Rotation needs only the multisig threshold signatures. async function buildUpdateGuardianScript(🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/miden-multisig-client/src/transaction/updateGuardian.ts` around lines 17 - 19, Remove the three-line inline comment immediately above buildUpdateGuardianScript, leaving the implementation unchanged.Source: Coding guidelines
crates/miden-multisig-client/src/transaction/configuration/config.rs (1)
21-50: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd/confirm unit test coverage for the new payload encoding.
build_multisig_config_advice's new interleaved layout is security/correctness-sensitive (it's the advice map the account's auth logic reads to authorize signer updates) and this batch shows no accompanying test asserting the exact byte layout. Codecov reports overall patch coverage below target for this PR; this function is a good candidate for a focused unit test pinning the expectedVec<Felt>output for a small fixed input.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/miden-multisig-client/src/transaction/configuration/config.rs` around lines 21 - 50, Add focused unit-test coverage for build_multisig_config_advice using a small fixed threshold, signer commitments, and signature scheme. Assert the returned Vec<Felt> exactly matches the expected header and reverse-order interleaved commitment/scheme fields, and verify the returned config hash matches the hash of that payload.examples/web/miden-sdk-compat.mjs (1)
9-9: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAvoid hard-coding the dependency’s
node_modulespath.This only works when the package exists at
examples/web/node_modules/@miden-sdk/miden-sdk. Hoisted or production installs can place it elsewhere and make the browser build fail. Resolve the package through its export/alias instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/web/miden-sdk-compat.mjs` at line 9, Update the module re-export in miden-sdk-compat.mjs to resolve `@miden-sdk/miden-sdk` through the package’s configured export or alias rather than a relative node_modules path, while preserving the existing eager.js entry point.crates/server/src/testing/generate_fixtures.rs (1)
17-20: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winStale comment: no longer matches
multisig_guardian.rs.The comment says these slot names match
multisig_guardian.rs, but that file (this PR) no longer defines local slot-name constants — it now builds storage viaAuthGuardedMultisigConfig/AuthGuardedMultisigdirectly. Hardcoding these literals here also risks drifting from the upstream-derived names with no compiler-enforced link.Consider updating the comment to point at the actual canonical source (e.g. wherever
multisig_threshold_config_slot()and friends are now defined, percrates/miden-multisig-client/src/account.rs) or importing those constants directly instead of re-declaring string literals.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/server/src/testing/generate_fixtures.rs` around lines 17 - 20, Update the slot-name constants near THRESHOLD_CONFIG_SLOT, SIGNER_PUBKEYS_SLOT, and EXECUTED_TXS_SLOT to use the canonical definitions from the multisig client account module, or reference that module as the source in the comment instead of claiming they match multisig_guardian.rs. Remove the duplicated hardcoded literals when importable canonical symbols such as multisig_threshold_config_slot() are available.crates/miden-multisig-client/src/account.rs (1)
9-28: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicated
AuthGuardedMultisigslot-name wrappers across two crates. Both files independently re-derive the same set of slot-name accessor wrappers (threshold_config,approver_public_keys,guardian_public_key) fromAuthGuardedMultisig::*_slot()in this same PR. Since both crates already pull in the sharedguardian_sharedcrate elsewhere in this diff, hoisting these thin wrappers into a shared location would remove the duplication and the risk of the two copies drifting if the slot-name derivation ever needs to change.
crates/miden-multisig-client/src/account.rs#L9-L28: movemultisig_threshold_config_slot,multisig_approver_pubkeys_slot,multisig_procedure_thresholds_slot,guardian_public_key_slotinto a shared module (e.g.guardian_shared) and import them here.crates/server/src/network/miden/account_inspector.rs#L4-L18: drop the duplicatemultisig_threshold_config_slot/multisig_approver_pubkeys_slot/guardian_public_key_slot_namedefinitions and import the shared versions instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/miden-multisig-client/src/account.rs` around lines 9 - 28, The slot-name accessor wrappers are duplicated across the multisig client and server inspector. Move multisig_threshold_config_slot, multisig_approver_pubkeys_slot, multisig_procedure_thresholds_slot, and guardian_public_key_slot from crates/miden-multisig-client/src/account.rs:9-28 into the shared guardian_shared module, then import and reuse them there; likewise remove the duplicate multisig_threshold_config_slot, multisig_approver_pubkeys_slot, and guardian_public_key_slot_name definitions from crates/server/src/network/miden/account_inspector.rs:4-18 and use the shared equivalents.packages/miden-multisig-client/tests/browser/determinism.spec.ts (1)
38-66: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winTwo tests independently rebuild the same account, doubling the expensive browser/WASM build.
Both tests call
buildInBrowser(page)(each waiting up to 170s), reconstructing the identical account twice. Consider merging into a single test with both assertion groups, or sharing the built result via a fixture/beforeAll, to avoid doubling this test file's CI runtime.♻️ Merge into a single test
-test('TS account reproduces the Rust storage layout and override-target procedures', async ({ - page, -}) => { - const result = await buildInBrowser(page); - console.log('TS account decomposition:', JSON.stringify(result, null, 2)); - - // Storage layout parity (slot names, order, values) — holds across SDKs. - expect(result?.storageCommitment).toBe(EXPECTED_STORAGE_COMMITMENT); - expect(result?.slotNames).toHaveLength(7); - - // Every threshold-override-target procedure root resolves in the TS-built account, so - // per-procedure overrides set via the SDK bind to real procedures. - const hasProcedure = result?.hasProcedure as Record<string, boolean> | undefined; - for (const name of OVERRIDE_TARGET_PROCEDURES) { - expect(hasProcedure?.[name], `missing override-target procedure: ${name}`).toBe(true); - } -}); - -// `@miden-sdk/miden-sdk` 0.15.2 bundles `miden-standards 0.15.3`, matching the Rust pin -// (`miden-standards = "=0.15.3"`), so `auth_tx_guarded_multisig` compiles to the same MAST and a -// TS-built account is byte-identical to the Rust/server account. -test( - 'TS account id + commitment match the Rust builder', - async ({ page }) => { - const result = await buildInBrowser(page); - expect(result?.id).toBe(EXPECTED_ID); - expect(result?.commitment).toBe(EXPECTED_COMMITMENT); - }, -); +test('TS account matches the Rust builder (id, commitment, storage layout, override targets)', async ({ + page, +}) => { + const result = await buildInBrowser(page); + + expect(result?.id).toBe(EXPECTED_ID); + expect(result?.commitment).toBe(EXPECTED_COMMITMENT); + expect(result?.storageCommitment).toBe(EXPECTED_STORAGE_COMMITMENT); + expect(result?.slotNames).toHaveLength(7); + + const hasProcedure = result?.hasProcedure as Record<string, boolean> | undefined; + for (const name of OVERRIDE_TARGET_PROCEDURES) { + expect(hasProcedure?.[name], `missing override-target procedure: ${name}`).toBe(true); + } +});🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/miden-multisig-client/tests/browser/determinism.spec.ts` around lines 38 - 66, Merge the two tests into one test that calls buildInBrowser(page) only once and retains all storage-layout, procedure, ID, and commitment assertions. Remove the duplicate build invocation while preserving the existing OVERRIDE_TARGET_PROCEDURES checks and expected-value comparisons.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 101-102: Update both checkout steps in the contract-behavior and
ts-sdk jobs to set persist-credentials to false. Keep the existing
actions/checkout references and all subsequent build/test steps unchanged.
In `@crates/contracts/README.md`:
- Around line 20-24: Update the “Running tests” section in the README to
document the separate Playwright browser determinism check alongside the Rust
cargo test command. Include the appropriate browser-test command or explicitly
state that this determinism gate runs separately, without implying the cargo
command is the complete test flow.
In `@crates/miden-multisig-client/src/account.rs`:
- Around line 15-16: Remove the two inline comments documenting the
AuthGuardedMultisig storage slot names; do not replace them with additional
implementation comments, preserving the surrounding slot definitions unchanged.
In `@crates/miden-multisig-client/src/transaction/builder.rs`:
- Around line 564-569: Thread the destination guardian key scheme through
TransactionType::SwitchGuardian and its proposal metadata, rather than deriving
it from key_manager.scheme(). Update both
build_update_guardian_transaction_request call sites, including the proposal and
final execution branches, to pass the new guardian’s scheme so cross-scheme
rotations use the correct value.
In `@crates/server/src/services/configure_account.rs`:
- Around line 659-660: Update the mock error message in the configure-account
test fixture to replace the stale “OpenZeppelin slot” provider name with “Miden
Standards,” while preserving the existing guardian public-key path and error
text structure.
In `@docs/PRODUCTION.md`:
- Around line 105-106: Update the Miden 0.15 cutover guidance in the production
documentation to state that it preserves EVM rows, so it is not automatically a
safe encryption enablement window. Document that retained EVM plaintext rows
require separate handling before enabling encryption, since encryption must
start with an empty store and does not support mixed plaintext/ciphertext data.
In `@examples/web/package.json`:
- Around line 18-20: Align the dependency versions in the examples/web package
manifest: update the `@miden-sdk/miden-sdk` entry to a supported 0.14.x version
for the existing `@miden-sdk/miden-para` and `@miden-sdk/use-miden-para-react`
releases, or upgrade both Para packages to releases compatible with SDK 0.15.2.
Ensure all three Miden dependencies share a supported version range.
In
`@packages/miden-multisig-client/masm/account_components/auth/guarded_multisig.masm`:
- Around line 16-33: Update the docstring for auth_tx_guarded_multisig to state
that guardian verification is always performed, removing the misleading
“optional guardian verification” wording. Keep the implementation and
input/output documentation unchanged.
In `@packages/miden-multisig-client/src/account/storage.ts`:
- Around line 6-8: Remove the newly added inline comments from
MULTISIG_SLOT_NAMES and buildGuardianSlots in
packages/miden-multisig-client/src/account/storage.ts, and from
buildGuardedMultisigComponent and validateMultisigConfig in
packages/miden-multisig-client/src/account/builder.ts. Preserve the
implementation unchanged and move any rationale to documentation or the PR
description instead.
In `@packages/miden-multisig-client/src/transaction/updateProcedureThreshold.ts`:
- Around line 31-33: Remove the inline // comments in
updateProcedureThreshold.ts while leaving the surrounding implementation and
behavior unchanged.
---
Outside diff comments:
In `@examples/rust/src/multisig.rs`:
- Around line 105-132: Update build_multisig_config_advice to accept a
SignatureScheme parameter and use that parameter when emitting each approver’s
scheme-id felt, matching the SDK’s per-approver scheme handling. Update all
callers to pass the intended scheme instead of implicitly assuming Falcon.
---
Nitpick comments:
In `@crates/miden-multisig-client/src/account.rs`:
- Around line 9-28: The slot-name accessor wrappers are duplicated across the
multisig client and server inspector. Move multisig_threshold_config_slot,
multisig_approver_pubkeys_slot, multisig_procedure_thresholds_slot, and
guardian_public_key_slot from crates/miden-multisig-client/src/account.rs:9-28
into the shared guardian_shared module, then import and reuse them there;
likewise remove the duplicate multisig_threshold_config_slot,
multisig_approver_pubkeys_slot, and guardian_public_key_slot_name definitions
from crates/server/src/network/miden/account_inspector.rs:4-18 and use the
shared equivalents.
In `@crates/miden-multisig-client/src/transaction/configuration/config.rs`:
- Around line 21-50: Add focused unit-test coverage for
build_multisig_config_advice using a small fixed threshold, signer commitments,
and signature scheme. Assert the returned Vec<Felt> exactly matches the expected
header and reverse-order interleaved commitment/scheme fields, and verify the
returned config hash matches the hash of that payload.
In `@crates/server/src/testing/generate_fixtures.rs`:
- Around line 17-20: Update the slot-name constants near THRESHOLD_CONFIG_SLOT,
SIGNER_PUBKEYS_SLOT, and EXECUTED_TXS_SLOT to use the canonical definitions from
the multisig client account module, or reference that module as the source in
the comment instead of claiming they match multisig_guardian.rs. Remove the
duplicated hardcoded literals when importable canonical symbols such as
multisig_threshold_config_slot() are available.
In `@examples/smoke-web/miden-sdk-compat.mjs`:
- Line 9: Update the module re-export in miden-sdk-compat.mjs to use the public
`@miden-sdk/miden-sdk` package specifier or a documented public subpath instead of
the internal dist/st/eager.js path, while preserving the shim’s exported API.
In `@examples/web/miden-sdk-compat.mjs`:
- Line 9: Update the module re-export in miden-sdk-compat.mjs to resolve
`@miden-sdk/miden-sdk` through the package’s configured export or alias rather
than a relative node_modules path, while preserving the existing eager.js entry
point.
In `@packages/miden-multisig-client/src/inspector.ts`:
- Line 10: Remove the newly added inline `//` comments in inspector.ts,
including the storage-slot, version-guard, and guardian-read annotations at the
referenced locations. Keep the surrounding implementation and behavior
unchanged.
In `@packages/miden-multisig-client/src/transaction/updateGuardian.ts`:
- Around line 17-19: Remove the three-line inline comment immediately above
buildUpdateGuardianScript, leaving the implementation unchanged.
In `@packages/miden-multisig-client/src/transaction/updateSigners.ts`:
- Line 34: Remove the inline comments in updateSigners.ts, including the
interleave-order comment near the signer data construction and the
FeltArray-ownership comment around lines 48–50, while leaving the implementation
unchanged.
In `@packages/miden-multisig-client/tests/browser/determinism.spec.ts`:
- Around line 38-66: Merge the two tests into one test that calls
buildInBrowser(page) only once and retains all storage-layout, procedure, ID,
and commitment assertions. Remove the duplicate build invocation while
preserving the existing OVERRIDE_TARGET_PROCEDURES checks and expected-value
comparisons.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 39510513-8507-4609-8424-bbacfd002c0a
⛔ Files ignored due to path filters (6)
Cargo.lockis excluded by!**/*.lockexamples/_shared/multisig-browser/package-lock.jsonis excluded by!**/package-lock.jsonexamples/operator-smoke-web/package-lock.jsonis excluded by!**/package-lock.jsonexamples/smoke-web/package-lock.jsonis excluded by!**/package-lock.jsonexamples/web/package-lock.jsonis excluded by!**/package-lock.jsonpackages/miden-multisig-client/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (96)
.github/workflows/ci.ymlCargo.tomlcrates/contracts/Cargo.tomlcrates/contracts/README.mdcrates/contracts/build.rscrates/contracts/masm/account_components/auth/multisig.masmcrates/contracts/masm/account_components/auth/multisig_ecdsa.masmcrates/contracts/masm/account_components/auth/multisig_guardian.masmcrates/contracts/masm/account_components/auth/multisig_guardian_ecdsa.masmcrates/contracts/masm/auth/guardian.masmcrates/contracts/masm/auth/guardian_ecdsa.masmcrates/contracts/masm/auth/multisig.masmcrates/contracts/masm/auth/multisig_ecdsa.masmcrates/contracts/src/lib.rscrates/contracts/src/main.rscrates/contracts/src/masm_builder.rscrates/contracts/src/multisig_guardian.rscrates/contracts/tests/auth/multisig.rscrates/miden-multisig-client/Cargo.tomlcrates/miden-multisig-client/examples/procedure_roots.rscrates/miden-multisig-client/src/account.rscrates/miden-multisig-client/src/client/offline.rscrates/miden-multisig-client/src/error.rscrates/miden-multisig-client/src/execution.rscrates/miden-multisig-client/src/procedures.rscrates/miden-multisig-client/src/transaction/builder.rscrates/miden-multisig-client/src/transaction/configuration/config.rscrates/miden-multisig-client/src/transaction/guardian.rscrates/miden-multisig-client/src/transaction/mod.rscrates/server/Cargo.tomlcrates/server/src/delta_summary/projection.rscrates/server/src/network/miden/account_inspector.rscrates/server/src/network/miden/mod.rscrates/server/src/services/configure_account.rscrates/server/src/testing/e2e/switch_guardian_canonicalization.rscrates/server/src/testing/fixtures/account.jsoncrates/server/src/testing/fixtures/commitments.jsoncrates/server/src/testing/fixtures/delta_1.jsoncrates/server/src/testing/fixtures/delta_2.jsoncrates/server/src/testing/fixtures/delta_3.jsoncrates/server/src/testing/fixtures/keys.jsoncrates/server/src/testing/generate_fixtures.rscrates/shared/src/lib.rsdocs/MULTISIG_SDK.mddocs/PRODUCTION.mddocs/guides/miden-dashboard/.gitignoreexamples/_shared/multisig-browser/package.jsonexamples/_shared/multisig-browser/src/multisigApi.tsexamples/_shared/multisig-browser/src/types.tsexamples/operator-smoke-web/package.jsonexamples/rust/Cargo.tomlexamples/rust/src/multisig.rsexamples/smoke-web/miden-sdk-compat.mjsexamples/smoke-web/package.jsonexamples/smoke-web/vite.config.tsexamples/web/miden-sdk-compat.mjsexamples/web/package.jsonexamples/web/src/components/LoadMultisigDialog.tsxexamples/web/src/lib/multisigApi.tsexamples/web/vite.config.tspackages/miden-multisig-client/.gitignorepackages/miden-multisig-client/masm/account_components/auth/guarded_multisig.masmpackages/miden-multisig-client/masm/account_components/auth/multisig.masmpackages/miden-multisig-client/masm/account_components/auth/multisig_ecdsa.masmpackages/miden-multisig-client/masm/account_components/auth/multisig_guardian.masmpackages/miden-multisig-client/masm/account_components/auth/multisig_guardian_ecdsa.masmpackages/miden-multisig-client/masm/auth/guardian.masmpackages/miden-multisig-client/masm/auth/guardian_ecdsa.masmpackages/miden-multisig-client/masm/auth/multisig.masmpackages/miden-multisig-client/masm/auth/multisig_ecdsa.masmpackages/miden-multisig-client/package.jsonpackages/miden-multisig-client/playwright.config.tspackages/miden-multisig-client/scripts/generate-masm.mjspackages/miden-multisig-client/src/account/builder.test.tspackages/miden-multisig-client/src/account/builder.tspackages/miden-multisig-client/src/account/masm/account-components/auth.tspackages/miden-multisig-client/src/account/masm/auth.tspackages/miden-multisig-client/src/account/masm/index.tspackages/miden-multisig-client/src/account/storage.tspackages/miden-multisig-client/src/client.test.tspackages/miden-multisig-client/src/client.tspackages/miden-multisig-client/src/inspector.test.tspackages/miden-multisig-client/src/inspector.tspackages/miden-multisig-client/src/multisig.test.tspackages/miden-multisig-client/src/procedures.tspackages/miden-multisig-client/src/transaction/updateGuardian.tspackages/miden-multisig-client/src/transaction/updateProcedureThreshold.tspackages/miden-multisig-client/src/transaction/updateSigners.tspackages/miden-multisig-client/src/types.tspackages/miden-multisig-client/src/utils/signature.tspackages/miden-multisig-client/tests/advice-feltarray-ownership.test.tspackages/miden-multisig-client/tests/browser/determinism.spec.tspackages/miden-multisig-client/tests/browser/harness.htmlpackages/miden-multisig-client/tests/browser/harness.tspackages/miden-multisig-client/tests/browser/vite.config.tspackages/miden-multisig-client/tests/masm.test.ts
💤 Files with no reviewable changes (28)
- crates/contracts/build.rs
- packages/miden-multisig-client/src/account/masm/index.ts
- packages/miden-multisig-client/masm/account_components/auth/multisig_guardian_ecdsa.masm
- packages/miden-multisig-client/masm/account_components/auth/multisig_ecdsa.masm
- crates/contracts/masm/account_components/auth/multisig.masm
- crates/contracts/masm/account_components/auth/multisig_ecdsa.masm
- crates/contracts/masm/auth/guardian_ecdsa.masm
- packages/miden-multisig-client/masm/auth/guardian_ecdsa.masm
- crates/contracts/masm/account_components/auth/multisig_guardian_ecdsa.masm
- crates/contracts/masm/auth/multisig.masm
- crates/contracts/src/main.rs
- examples/_shared/multisig-browser/src/types.ts
- examples/_shared/multisig-browser/src/multisigApi.ts
- crates/contracts/masm/account_components/auth/multisig_guardian.masm
- packages/miden-multisig-client/masm/auth/guardian.masm
- packages/miden-multisig-client/src/types.ts
- packages/miden-multisig-client/masm/auth/multisig_ecdsa.masm
- packages/miden-multisig-client/src/client.ts
- packages/miden-multisig-client/src/account/masm/auth.ts
- crates/contracts/masm/auth/guardian.masm
- examples/web/src/lib/multisigApi.ts
- packages/miden-multisig-client/src/client.test.ts
- crates/contracts/src/lib.rs
- packages/miden-multisig-client/masm/account_components/auth/multisig_guardian.masm
- packages/miden-multisig-client/masm/auth/multisig.masm
- packages/miden-multisig-client/masm/account_components/auth/multisig.masm
- crates/contracts/src/masm_builder.rs
- crates/contracts/masm/auth/multisig_ecdsa.masm
Comment on lines
564
to
569
| // Build the GUARDIAN update transaction request (no signatures for proposal) | ||
| let tx_request = build_update_guardian_transaction_request( | ||
| new_guardian_pubkey, | ||
| key_manager.scheme(), | ||
| salt, | ||
| std::iter::empty(), |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '== outline builder.rs =='
ast-grep outline crates/miden-multisig-client/src/transaction/builder.rs --view expanded || true
echo '== search relevant symbols =='
rg -n "SwitchGuardian|update_guardian_public_key|build_update_guardian_transaction_request|scheme\(" crates/miden-multisig-client/src/transaction/builder.rs crates/miden-multisig-client/src -g '*.rs' || true
echo '== lines around 520-700 =='
sed -n '520,700p' crates/miden-multisig-client/src/transaction/builder.rsRepository: OpenZeppelin/guardian
Length of output: 14625
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ast-grep outline crates/miden-multisig-client/src/transaction/builder.rs --view expanded || true
rg -n "SwitchGuardian|update_guardian_public_key|build_update_guardian_transaction_request|scheme\(" crates/miden-multisig-client/src -g '*.rs' || true
sed -n '540,700p' crates/miden-multisig-client/src/transaction/builder.rsRepository: OpenZeppelin/guardian
Length of output: 12989
🏁 Script executed:
Inspect `crates/miden-multisig-client/src/transaction/builder.rs` around the guardian update transaction and locate any type that stores the destination guardian scheme.Repository: OpenZeppelin/guardian
Length of output: 293
🏁 Script executed:
#!/bin/bash
set -euo pipefail
pwd
rg -n "build_update_guardian_transaction_request|update_guardian_public_key|SwitchGuardian|scheme\(" crates/miden-multisig-client/src -g '*.rs' || true
sed -n '540,700p' crates/miden-multisig-client/src/transaction/builder.rsRepository: OpenZeppelin/guardian
Length of output: 12328
🌐 Web query:
"build_update_guardian_transaction_request new_guardian_pubkey key_manager.scheme() miden-multisig-client"
💡 Result:
In the miden-multisig-client Rust SDK, there is no direct function named build_update_guardian_transaction_request. Instead, updating a guardian is handled via the TransactionType::SwitchGuardian variant [1]. To initiate a transition to a new guardian, you typically use the following approach: 1. Create a SwitchGuardian transaction type: Use TransactionType::switch_guardian(new_endpoint, new_commitment), where new_commitment is the word representation of the new guardian's public key [1]. 2. Build the proposal: The SDK uses ProposalBuilder or MultisigClient::propose_transaction to create a proposal from the TransactionType [2][3]. Example pattern: let tx = TransactionType::switch_guardian("https://new-guardian.example.com", new_guardian_pubkey_word); let proposal = client.propose_transaction(tx).await?; 3. Key Management: The key_manager.scheme method is used to determine the signing scheme (e.g., Falcon or Ecdsa) for authentication during these workflows [4][5]. If you are working with the TypeScript SDK variant, you may encounter different builder methods such as buildUpdateSignersTransactionRequest, though the Rust SDK logic centers on the TransactionType enum for defining these operations [6][1]. If the goal is to perform an offline switch when the current guardian is unreachable, the SDK supports this via client.create_proposal_offline(tx) [7].
Citations:
- 1: https://docs.rs/miden-multisig-client/latest/miden_multisig_client/enum.TransactionType.html
- 2: https://docs.rs/miden-multisig-client/latest/miden_multisig_client/struct.ProposalBuilder.html
- 3: https://docs.rs/miden-multisig-client/latest/miden_multisig_client/struct.MultisigClient.html
- 4: https://docs.rs/miden-multisig-client/latest/miden_multisig_client/trait.KeyManager.html
- 5: https://docs.rs/miden-multisig-client/latest/src/miden_multisig_client/keystore.rs.html
- 6: https://github.com/OpenZeppelin/private-state-manager/blob/7aa44610215f76d7b97e6b3ef3c937c8c7f24717/packages/miden-multisig-client/src/multisig.ts
- 7: https://docs.rs/crate/miden-multisig-client/latest
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '== transaction/guardian.rs =='
sed -n '1,220p' crates/miden-multisig-client/src/transaction/guardian.rs
echo '== proposal.rs SwitchGuardian definition =='
sed -n '90,240p' crates/miden-multisig-client/src/proposal.rs
echo '== execution.rs guardian request callsite =='
sed -n '190,240p' crates/miden-multisig-client/src/execution.rsRepository: OpenZeppelin/guardian
Length of output: 10097
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '== execution.rs context around SwitchGuardian branch =='
sed -n '1,260p' crates/miden-multisig-client/src/execution.rs
echo '== search for any stored scheme in SwitchGuardian metadata or proposal =='
rg -n "new_guardian.*scheme|scheme.*new_guardian|guardian.*scheme|with_guardian_update_metadata|SwitchGuardian \{" crates/miden-multisig-client/src -g '*.rs'Repository: OpenZeppelin/guardian
Length of output: 12938
Thread the destination guardian scheme through SwitchGuardian (crates/miden-multisig-client/src/transaction/builder.rs:564-569). build_update_guardian_transaction_request needs the scheme for new_guardian_pubkey, but this path and the final execution branch both pass key_manager.scheme(). Add the scheme to TransactionType::SwitchGuardian/proposal metadata and use it in both call sites, or cross-scheme guardian rotations will be built with the wrong scheme.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/miden-multisig-client/src/transaction/builder.rs` around lines 564 -
569, Thread the destination guardian key scheme through
TransactionType::SwitchGuardian and its proposal metadata, rather than deriving
it from key_manager.scheme(). Update both
build_update_guardian_transaction_request call sites, including the proposal and
final execution branches, to pass the new guardian’s scheme so cross-scheme
rotations use the correct value.
Source: Coding guidelines
Contributor
There was a problem hiding this comment.
Pull request overview
Replaces Guardian’s locally-maintained multisig + guardian MASM custody contracts with the audited upstream miden-standards AuthGuardedMultisig component, and updates the Rust/TS SDKs + server wiring to match the new storage layout, procedure roots, and rotation semantics (including new determinism/parity gates).
Changes:
- Switch custody account construction and tx-script compilation to
miden::standards::auth::*(removing locally-vendored MASM and selectors). - Add runtime contract-version guards and cross-SDK parity tests (Vitest + Playwright) to prevent silent procedure-root drift.
- Update server slot-name usage and fixtures to source slot identifiers from upstream accessors and regenerated commitments.
Reviewed changes
Copilot reviewed 93 out of 99 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/miden-multisig-client/tests/masm.test.ts | Narrows MASM constant validation to the single vendored guarded-multisig shell. |
| packages/miden-multisig-client/tests/browser/vite.config.ts | Adds Vite config to serve built dist/ + WASM SDK for browser determinism tests. |
| packages/miden-multisig-client/tests/browser/harness.ts | Browser harness that builds an account and exposes id/commitment/slot/procedure info for Playwright. |
| packages/miden-multisig-client/tests/browser/harness.html | Static page to run the determinism harness. |
| packages/miden-multisig-client/tests/browser/determinism.spec.ts | Playwright parity gate for storage layout + procedure presence + id/commitment equality. |
| packages/miden-multisig-client/tests/advice-feltarray-ownership.test.ts | Regression test for FeltArray ownership/consumption when hashing + inserting into advice. |
| packages/miden-multisig-client/src/utils/signature.ts | Exposes authSchemeId() for scheme-id encoding into storage/advice. |
| packages/miden-multisig-client/src/types.ts | Removes guardianEnabled from the TS multisig config API surface. |
| packages/miden-multisig-client/src/transaction/updateSigners.ts | Updates update-signers script/advice to use upstream multisig module + scheme-id interleaving. |
| packages/miden-multisig-client/src/transaction/updateProcedureThreshold.ts | Switches to upstream set_procedure_threshold and stack-arg semantics. |
| packages/miden-multisig-client/src/transaction/updateGuardian.ts | Switches guardian rotation to upstream module + stack args (no advice-map pubkey entry). |
| packages/miden-multisig-client/src/procedures.ts | Regenerates pinned procedure roots; removes standalone guardian verify procedure root. |
| packages/miden-multisig-client/src/multisig.test.ts | Updates tests for removed guardianEnabled and new guardian-ack semantics. |
| packages/miden-multisig-client/src/inspector.ts | Updates slot names; adds pinned-contract-version guard before root-keyed reads; removes selector handling. |
| packages/miden-multisig-client/src/inspector.test.ts | Updates inspector mocks/tests for new slot names and contract-version rejection. |
| packages/miden-multisig-client/src/client.ts | Stops propagating removed guardianEnabled field from inspector results. |
| packages/miden-multisig-client/src/client.test.ts | Updates client tests for removed guardianEnabled. |
| packages/miden-multisig-client/src/account/storage.ts | Updates storage layout to upstream slot names; removes selector slot; adjusts guardian slots. |
| packages/miden-multisig-client/src/account/masm/index.ts | Stops exporting deleted auth MASM module; keeps account-component export. |
| packages/miden-multisig-client/src/account/masm/account-components/auth.ts | Generated guarded-multisig component MASM constant (new upstream shell). |
| packages/miden-multisig-client/src/account/builder.ts | Builds guarded auth component by compiling only the vendored shell; uses buildWithoutSchemaCommitment(). |
| packages/miden-multisig-client/src/account/builder.test.ts | Updates builder tests to ensure no duplicate module re-linking; adds guardian≠signer invariant tests. |
| packages/miden-multisig-client/scripts/generate-masm.mjs | Updates MASM generation to only vend/emit guarded-multisig account-component shell. |
| packages/miden-multisig-client/playwright.config.ts | Adds Playwright config to run browser determinism tests via Vite + system Chrome. |
| packages/miden-multisig-client/package.json | Pins @miden-sdk/miden-sdk to 0.15.2 and adds Playwright/Vite dev deps and browser test script. |
| packages/miden-multisig-client/masm/auth/guardian.masm | Deletes locally-maintained guardian MASM. |
| packages/miden-multisig-client/masm/auth/guardian_ecdsa.masm | Deletes locally-maintained guardian ECDSA MASM. |
| packages/miden-multisig-client/masm/account_components/auth/multisig.masm | Deletes local multisig account-component shell. |
| packages/miden-multisig-client/masm/account_components/auth/multisig_guardian.masm | Deletes local multisig+guardian account-component shell. |
| packages/miden-multisig-client/masm/account_components/auth/multisig_guardian_ecdsa.masm | Deletes local multisig+guardian ECDSA account-component shell. |
| packages/miden-multisig-client/masm/account_components/auth/multisig_ecdsa.masm | Deletes local multisig ECDSA account-component shell. |
| packages/miden-multisig-client/masm/account_components/auth/guarded_multisig.masm | Adds vendored upstream guarded-multisig account-component shell. |
| packages/miden-multisig-client/.gitignore | Ignores Playwright outputs. |
| examples/web/src/lib/multisigApi.ts | Removes guardianEnabled from example account creation config. |
| examples/web/src/components/LoadMultisigDialog.tsx | Updates UI to report guardian “Present/Not found” instead of enabled/disabled. |
| examples/web/package.json | Bumps Miden SDK deps and adds dependency overrides. |
| examples/smoke-web/vite.config.ts | Adjusts optimizeDeps exclusions (removes explicit miden-sdk exclude). |
| examples/smoke-web/package.json | Bumps Miden SDK deps and adds dependency overrides. |
| examples/rust/src/multisig.rs | Updates example scripts/advice layout and links upstream StandardsLib. |
| examples/rust/Cargo.toml | Adds miden-standards dependency for upstream library linking. |
| examples/operator-smoke-web/package.json | Bumps @miden-sdk/miden-sdk to 0.15.2. |
| examples/operator-smoke-web/package-lock.json | Updates lockfile to reflect 0.15.2 SDK and platform packages. |
| examples/_shared/multisig-browser/src/types.ts | Removes guardianEnabled from serialized detected-config type + serializer. |
| examples/_shared/multisig-browser/src/multisigApi.ts | Removes guardianEnabled from shared example account creation config. |
| examples/_shared/multisig-browser/package.json | Bumps Miden SDK deps and adds dependency overrides. |
| docs/PRODUCTION.md | Documents irreversible Miden 0.15 cutover purge behavior and operator actions. |
| docs/MULTISIG_SDK.md | Documents contract pinning policy, support table, and runtime mismatch behavior. |
| docs/guides/miden-dashboard/.gitignore | Adds ignores for dashboard guide artifacts. |
| crates/shared/src/lib.rs | Adds SignatureScheme -> AuthScheme mapping and scheme-id helper for guarded-multisig. |
| crates/server/src/testing/generate_fixtures.rs | Updates fixture generation slot names to upstream slot identifiers. |
| crates/server/src/testing/fixtures/delta_3.json | Regenerates fixture account_id/delta payload/commitments for upstream component. |
| crates/server/src/testing/fixtures/delta_2.json | Regenerates fixture account_id/delta payload/commitments for upstream component. |
| crates/server/src/testing/fixtures/delta_1.json | Regenerates fixture account_id/delta payload/commitments for upstream component. |
| crates/server/src/testing/fixtures/commitments.json | Regenerates expected commitments for upstream component. |
| crates/server/src/testing/e2e/switch_guardian_canonicalization.rs | Updates guardian rotation e2e to new stack-arg semantics and links upstream code. |
| crates/server/src/services/configure_account.rs | Updates expected slot-name strings in tests to upstream guardian pub_key slot. |
| crates/server/src/network/miden/mod.rs | Removes selector-based logic; uses upstream slot accessor for executed txs + guardian slot names. |
| crates/server/src/network/miden/account_inspector.rs | Sources slot names from AuthGuardedMultisig::*_slot() accessors; updates detection logic. |
| crates/server/src/delta_summary/projection.rs | Updates slot-name expectations in tests to upstream procedure_thresholds slot. |
| crates/server/Cargo.toml | Expands e2e feature deps to include contracts testing feature. |
| crates/miden-multisig-client/src/transaction/mod.rs | Improves kernel-drift doc comment clarity. |
| crates/miden-multisig-client/src/transaction/guardian.rs | Updates guardian rotation tx construction for upstream stack-args + scheme id. |
| crates/miden-multisig-client/src/transaction/configuration/config.rs | Switches scripts to StandardsLib; updates advice layout and procedure threshold call. |
| crates/miden-multisig-client/src/transaction/builder.rs | Wires scheme into guardian rotation and updates procedure-threshold request signature. |
| crates/miden-multisig-client/src/procedures.rs | Updates procedure roots and adds test to pin against upstream exported procedures. |
| crates/miden-multisig-client/src/execution.rs | Wires scheme into guardian rotation final-tx requests and updates procedure threshold requests. |
| crates/miden-multisig-client/src/error.rs | Adds UnsupportedContractVersion error for pinned-root mismatch. |
| crates/miden-multisig-client/src/client/offline.rs | Wires scheme into offline guardian rotation export flow. |
| crates/miden-multisig-client/src/account.rs | Uses upstream slot accessors; removes selector support; adds contract-version guard for root-keyed reads. |
| crates/miden-multisig-client/examples/procedure_roots.rs | Updates example to source roots from upstream code exports and BasicWallet roots. |
| crates/miden-multisig-client/Cargo.toml | Adds miden-confidential-contracts testing dev-dependency. |
| crates/contracts/src/multisig_guardian.rs | Replaces local MASM builders with upstream AuthGuardedMultisigConfig/AuthGuardedMultisig facade. |
| crates/contracts/src/masm_builder.rs | Removes local MASM assembler/build system (deleted). |
| crates/contracts/src/main.rs | Removes unused binary main (deleted). |
| crates/contracts/src/lib.rs | Removes masm_builder module export; keeps multisig_guardian. |
| crates/contracts/README.md | Updates crate purpose/docs post-upstream adoption. |
| crates/contracts/masm/auth/multisig.masm | Deletes local multisig MASM (deleted). |
| crates/contracts/masm/auth/guardian.masm | Deletes local guardian MASM (deleted). |
| crates/contracts/masm/auth/guardian_ecdsa.masm | Deletes local guardian ECDSA MASM (deleted). |
| crates/contracts/masm/account_components/auth/multisig.masm | Deletes local account-component MASM (deleted). |
| crates/contracts/masm/account_components/auth/multisig_guardian.masm | Deletes local account-component MASM (deleted). |
| crates/contracts/masm/account_components/auth/multisig_guardian_ecdsa.masm | Deletes local account-component MASM (deleted). |
| crates/contracts/masm/account_components/auth/multisig_ecdsa.masm | Deletes local account-component MASM (deleted). |
| crates/contracts/Cargo.toml | Updates crate metadata; moves heavy deps to dev-deps and adds testing feature. |
| crates/contracts/build.rs | Removes MASM build-script env wiring (deleted). |
| Cargo.toml | Pins miden-standards exactly to =0.15.3 for parity. |
| .github/workflows/ci.yml | Adds contract-behavior + TS SDK parity jobs (Vitest + Playwright determinism gate). |
Files not reviewed (3)
- examples/_shared/multisig-browser/package-lock.json: Generated file
- examples/operator-smoke-web/package-lock.json: Generated file
- packages/miden-multisig-client/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces Guardian's locally-drafted multisig + guardian MASM contracts with the audited upstream
AuthGuardedMultisigcomponent frommiden-standards 0.15.3. Guardian no longer ships or compiles any custody MASM of its own (−~3,900 lines of MASM plus its builders and generated TS embeddings).What changed
crates/contractsmasm_builder.rsdeleted.MultisigGuardianBuilderis now a thin facade over upstreamAuthGuardedMultisigConfig/AuthGuardedMultisig; the crate keeps the MockChain behavior test suite.crates/miden-multisig-client)StandardsLib/AuthGuardedMultisig::code(); procedure roots regenerated from the upstream component; guardian rotation ported to upstream stack-arg semantics.packages/miden-multisig-client)miden::standards::auth::*libraries embedded in@miden-sdk/miden-sdk 0.15.2; the 1,512-line generated local MASM module is gone.AuthGuardedMultisig::*_slot()accessors (cannot drift); guardian selector logic removed; replay-protection adjustment gated on the structuralthreshold_configslot.Custody-semantics changes (deliberate, need sign-off)
guardian_enabledis removed from both SDK APIs.update_guardian_public_key): requires only the multisig threshold signatures — no current-guardian co-signature — matchingdocs/CONCEPTS.mdcold-key recovery. The old fork required guardian participation. See §4 of the security review.Determinism & parity gates
Cross-SDK byte-equality (TS-built account == Rust-built account) is enforced by exact pins — Rust
miden-standards = "=0.15.3", npm@miden-sdk/miden-sdk 0.15.2(embeds standards 0.15.3) — and guarded by:procedure_roots_match_upstream_component(Rust, pins hardcoded roots against the live library)tests/procedure-roots.test.ts(TS roots vs the Rustprocedure_rootsexample output)tests/browser/determinism.spec.ts(Playwright: full account id + commitment byte-equality, storage layout, override-target procedure presence)tests/masm.test.ts(vendored component shell in sync with its generated constant)All of these now run in CI (
contract-behaviorandts-sdkjobs added in this PR).Version-pin policy (documented in
docs/MULTISIG_SDK.md→ "Contract version pinning", with an SDK ↔ contract support table): deployed accounts are immutable, so a pin bump that changes procedure roots is a breaking release that operates new accounts only until a contract-version registry (keyed by auth-procedure root) lands as a follow-up.Runtime contract-version guard: both SDKs reject accounts built from a different contract version before any procedure-root-keyed storage read, instead of silently reporting wrong thresholds — Rust
MultisigError::UnsupportedContractVersion(viaMultisigAccount::procedure_threshold, withis_pinned_contract_version()exposed), TS anunsupported contract versionerror fromAccountInspector.fromAccount. Negative-tested on both sides.Migration
One-time, irreversible cutover documented in
docs/PRODUCTION.md→ "Upgrading to Miden 0.15": the first 0.15 deploy truncates pre-0.15states/deltas/delta_proposals/account_metadata(v0→v1 account-ID derivation + new component make them non-deserializable); theadmin_actionsaudit table is preserved. Existing accounts are recreated, not migrated.Security review
docs/security/2026-06-15-upstream-guarded-multisig-security-review.md— direct review of the upstream MASM custody enforcement plus adversarial review of the Guardian-side wiring. No Critical/High findings; the cross-SDK determinism blocker it recorded is resolved (status note in the doc). Open item: external sign-off on the rotation-model change above.Breaking API changes
guardianEnabledremoved fromMultisigConfig/DetectedMultisigConfig; allPROCEDURE_ROOTSvalues changed;updateGuardian/updateSignersbuilders take the signature scheme.MultisigGuardianConfig::with_guardian_enabledremoved;ProcedureName::VerifyGuardianremoved (guardian verification is internal toauth_tx_guarded_multisig); root constants changed.Follow-ups (tracked, not in this PR)
miden-sdk-compat.mjsshims inexamples/{web,smoke-web}once the Para adapter tree ships a 0.15-compatible release.Decided:
miden-confidential-contractsstays a separate slim crate — it is the shared account-construction layer between server tooling (e2e, loadgen, benchmarks) and the SDK; folding it into the SDK would drag guardian-client + miden-client into the server's test/bench dependency tree.Summary by CodeRabbit
Breaking Changes
guardianEnabled; Guardian status is represented through the Guardian commitment.Improvements
Documentation