chore(deps): apply audited safe dependency updates

package.json

@@ -57,7 +57,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@bufbuild/protobuf": "2.10.2",
+    "@bufbuild/protobuf": "2.13.0",
     "@cosmjs/amino": "0.39.0",
     "@cosmjs/crypto": "0.39.0",
     "@cosmjs/encoding": "0.39.0",
@@ -70,7 +70,7 @@
     "@improbable-eng/grpc-web": "^0.15.0",
     "@improbable-eng/grpc-web-node-http-transport": "^0.15.0",
     "@keplr-wallet/types": "^0.13.40",
-    "@ledgerhq/hw-transport": "6.28.8",
+    "@ledgerhq/hw-transport": "6.35.6",
     "@ledgerhq/hw-transport-webhid": "^6.20.0",
     "@ledgerhq/hw-transport-webusb": "^6.20.0",
     "@metamask/eth-sig-util": "8.2.0",

tests/cosmjs-039-contracts.test.cjs

@@ -39,8 +39,8 @@ test("Carbon declares and installs one coherent direct CosmJS 0.39.0 family", ()
   }
   assert.equal(packageJson.dependencies["cosmjs-types"], "0.11.0");
   assert.equal(installedVersion("cosmjs-types"), "0.11.0");
-  assert.equal(packageJson.dependencies["@bufbuild/protobuf"], "2.10.2");
-  assert.equal(installedVersion("@bufbuild/protobuf"), "2.10.2");
+  assert.equal(packageJson.dependencies["@bufbuild/protobuf"], "2.13.0");
+  assert.equal(installedVersion("@bufbuild/protobuf"), "2.13.0");
 
   assert.equal(packageJson.dependencies["bignumber.js"], "9.1.2");
   assert.equal(installedVersion("bignumber.js"), "9.1.2");

tests/crypto-transitive-leaves.test.cjs

@@ -12,7 +12,7 @@ const expectedVersions = {
   "base-x": ["3.0.11", "5.0.1"],
   "bn.js": ["4.12.3", "5.2.3"],
   "cipher-base": ["1.0.5"],
-  pbkdf2: ["3.1.3"],
+  pbkdf2: [],
   "sha.js": ["2.4.12"],
 };
 
@@ -31,11 +31,6 @@ for (const [packageName, versions] of Object.entries(expectedVersions)) {
   });
 }
 
-test("PBKDF2 preserves the RFC 6070 SHA-1 vector", () => {
-  const pbkdf2 = require("pbkdf2");
-  assert.equal(pbkdf2.pbkdf2Sync("password", "salt", 1, 20, "sha1").toString("hex"), "0c60c80f961f0e71f3a9b524af6012062fe037a6");
-});
-
 test("sha.js preserves the SHA-256 known-answer vector", () => {
   const digest = require("sha.js")("sha256").update("abc").digest("hex");
   assert.equal(digest, "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");

tests/direct-import-contracts.test.cjs

@@ -20,7 +20,7 @@ const expectedDirectContracts = {
   "@cosmjs/tendermint-rpc": "0.39.0",
   "@cosmjs/utils": "0.39.0",
   "@ethersproject/abstract-signer": "5.8.0",
-  "@ledgerhq/hw-transport": "6.28.8",
+  "@ledgerhq/hw-transport": "6.35.6",
   axios: "0.33.0",
   bech32: "1.1.4",
   long: "4.0.0",

tests/keplr-013-compatibility.test.cjs

@@ -22,9 +22,9 @@ function lockedVersions(packageName) {
 
 test("Carbon aligns its public Keplr types with the Starknet 8 wallet family", () => {
   assert.equal(manifest.dependencies["@keplr-wallet/types"], "^0.13.40");
-  assert.equal(installedManifest.version, "0.13.40");
+  assert.equal(installedManifest.version, "0.13.41");
   assert.deepEqual(installedManifest.peerDependencies, { starknet: "^8" });
-  assert.deepEqual(lockedVersions("@keplr-wallet/types"), ["0.13.40"]);
+  assert.deepEqual(lockedVersions("@keplr-wallet/types"), ["0.13.41"]);
   assert.doesNotMatch(lockfile, /@keplr-wallet\/types@\^0\.12/);
 });
 

tests/ledger-runtime-leaves.test.cjs

@@ -24,7 +24,7 @@ test("@babel/runtime has only the audited compatible lock target", () => {
 });
 
 test("semver has no vulnerable lock targets", () => {
-  assert.deepEqual(lockedVersions("semver"), ["7.8.5"]);
+  assert.deepEqual(lockedVersions("semver"), ["7.7.3", "7.8.5"]);
 });
 
 test("Babel helpers used by Ledger packages preserve object and async behavior", async () => {