Snyk fix 1a42f46a3694152c28f6d1d4dc5aea44 by Dargon789 · Pull Request #196 · Dargon789/sequence.js

Dargon789 · 2026-01-09T09:32:04Z

No description provided.

Bumps the npm_and_yarn group with 1 update in the / directory: [express](https://github.com/expressjs/express). Updates `express` from 4.18.2 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.18.2...4.19.2) --- updated-dependencies: - dependency-name: express dependency-type: direct:development dependency-group: npm_and_yarn-security-group ... Signed-off-by: dependabot[bot] <support@github.com>

[skip ci]

…ity-group-e0cd778f82

…yarn-security-group-e0cd778f82 Bump the npm_and_yarn group across 1 directory with 1 update

Snyk has created this PR to upgrade @tanstack/react-query from 5.45.1 to 5.64.2. See this package in npm: @tanstack/react-query See this project in Snyk: https://app.snyk.io/org/dargon789/project/bb845543-cbee-4e11-8cf9-8bfdf9205bf1?utm_source=github&utm_medium=referral&page=upgrade-pr

…9e16dcb9a2eda9 Snyk upgrade 03178c54d4c54014129e16dcb9a2eda9

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

Bumps the npm_and_yarn group with 1 update in the / directory: [next](https://github.com/vercel/next.js). Updates `next` from 15.4.2 to 15.4.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.4.2...v15.4.7) --- updated-dependencies: - dependency-name: next dependency-version: 15.4.7 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

Bumps the npm_and_yarn group with 1 update in the / directory: [happy-dom](https://github.com/capricorn86/happy-dom). Bumps the npm_and_yarn group with 1 update in the /packages/wallet/dapp-client directory: [happy-dom](https://github.com/capricorn86/happy-dom). Bumps the npm_and_yarn group with 1 update in the /packages/wallet/wdk directory: [happy-dom](https://github.com/capricorn86/happy-dom). Updates `happy-dom` from 17.6.3 to 20.0.0 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v17.6.3...v20.0.0) Updates `happy-dom` from 17.6.3 to 20.0.0 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v17.6.3...v20.0.0) Updates `happy-dom` from 17.6.3 to 20.0.0 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v17.6.3...v20.0.0) --- updated-dependencies: - dependency-name: happy-dom dependency-version: 20.0.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: happy-dom dependency-version: 20.0.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: happy-dom dependency-version: 20.0.0 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the npm_and_yarn group with 1 update in the / directory: [happy-dom](https://github.com/capricorn86/happy-dom). Updates `happy-dom` from 20.0.0 to 20.0.2 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.0.0...v20.0.2) --- updated-dependencies: - dependency-name: happy-dom dependency-version: 20.0.2 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

codesandbox · 2026-01-09T09:32:08Z

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

bolt-new-by-stackblitz · 2026-01-09T09:32:08Z

Run & review this pull request in StackBlitz Codeflow.

sourcery-ai

Sorry, we are unable to review this pull request

The GitHub API does not allow us to fetch diffs exceeding 300 files, and this pull request has 3637

wagmi-project/packages/core/src/createEmitter.ts

...re-1.0.0/lib/signals-implicit-mode/lib/sequence-v3/lib/openzeppelin-contracts/certora/run.js

wagmi-project/packages/sequence-core-1.0.0/packages/services/builder/src/builder.gen.ts

+  protected path = '/rpc/Builder/'
+
+  constructor(hostname: string, fetch: Fetch) {
+    this.hostname = hostname.replace(/\/*$/, '')


...ges/sequence-core-1.0.0/packages/services/identity-instrument/src/identity-instrument.gen.ts

+  protected path = '/rpc/IdentityInstrument/'
+
+  constructor(hostname: string, fetch: Fetch) {
+    this.hostname = hostname.replace(/\/*$/, '')


wagmi-project/packages/sequence-core-1.0.0/packages/services/indexer/src/indexer.gen.ts

+  protected path = '/rpc/Indexer/'
+
+  constructor(hostname: string, fetch: Fetch) {
+    this.hostname = hostname.replace(/\/*$/, '')


wagmi-project/packages/sequence-core-1.0.0/packages/services/metadata/src/metadata.gen.ts

+  protected path = '/rpc/Collections/'
+
+  constructor(hostname: string, fetch: Fetch) {
+    this.hostname = hostname.replace(/\/*$/, '')


wagmi-project/packages/sequence-core-1.0.0/packages/services/metadata/src/metadata.gen.ts

+  protected path = '/rpc/Admin/'
+
+  constructor(hostname: string, fetch: Fetch) {
+    this.hostname = hostname.replace(/\/*$/, '')


...roject/packages/sequence-core-1.0.0/packages/services/relayer/src/rpc-relayer/relayer.gen.ts

+  protected path = '/rpc/Relayer/'
+
+  constructor(hostname: string, fetch: Fetch) {
+    this.hostname = hostname.replace(/\/*$/, '')


wagmi-project/packages/sequence-core-1.0.0/packages/wallet/dapp-client/src/DappTransport.ts

...roject/packages/sequence-core-1.0.0/packages/wallet/primitives-cli/src/subcommands/server.ts

snyk-io · 2026-01-09T09:32:26Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

vercel · 2026-01-09T09:36:33Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
sequence-js-docs	Ready	Preview, Comment	Jan 9, 2026 9:46am
sequence-js-web	Ready	Preview, Comment	Jan 9, 2026 9:46am

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

gemini-code-assist · 2026-01-09T09:38:43Z

Summary of Changes

Hello @Dargon789, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request includes a variety of updates, from dependency upgrades and improved randomness to enhanced error handling and project setup configurations. It also introduces new documentation and issue templates to improve project maintainability and developer experience.

Highlights

Dependencies: Updates dependencies, including next, esbuild, @next/swc-*, caniuse-lite, turbo, and baseline browser mapping.
Randomness: Improves randomness in ID generation by using crypto.getRandomValues in DappTransport.ts and Hex.random(16) for nonce generation in identity-instrument.
Error Handling: Enhances error handling in server.ts by providing a generic parse error response without exposing internal error details.
Project Setup: Adds initial configurations for CircleCI (config.yml), CodeSandbox (tasks.json), and issue templates to streamline project workflows.
Documentation: Migrates the README.md to a new format, including documentation links, community resources, contributing guidelines, and sponsor information.

Ignored Files

Ignored by pattern: .github/workflows/** (2)
- .github/workflows/Publish-Dists.yml
- .github/workflows/tests.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request applies several important security fixes, such as using cryptographically secure random number generators for nonces and IDs, and preventing the leakage of internal error details. These changes are valuable improvements.

However, the pull request also includes a large number of unrelated changes that appear to be a mistake. The README.md has been completely replaced with content from the wagmi project, and an entire wagmi-project directory has been added. These changes are inconsistent with the PR's title of a 'Snyk fix' and are highly confusing.

I've added comments on a few specific issues related to these new files, such as the incorrect README content, inconsistent package manager usage in the Azure pipeline, a placeholder email in the security policy, and a duplicated CircleCI config.

I recommend splitting this PR to only include the security fixes and reverting the unrelated changes to keep the commit history clean and focused.

README.md

SECURITY.md

azure-pipelines.yml

wagmi-project/.circleci/config.yml

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

…ession for hostnames Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

…rough a stack trace Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

dependabot bot and others added 30 commits March 30, 2024 07:24

Create SECURITY.md

ca06c8f

Set up CI with Azure Pipelines

3af5a88

[skip ci]

Merge branch '0xsequence:master' into master

fa3e0a9

Merge branch '0xsequence:master' into master

f2761ef

Merge branch '0xsequence:master' into master

7a74500

codesandbox dev-project wagmi-dapp

709280e

Merge branch 'master' of https://github.com/Dargon789/sequence.js

29c9084

Create CNAME

1275488

Merge branch '0xsequence:master' into master

9b5807f

Merge branch '0xsequence:master' into master

c1fedd5

Merge branch '0xsequence:master' into master

2f0a536

Merge branch '0xsequence:master' into master

4b1880a

Merge branch '0xsequence:master' into master

c292dd5

Merge branch 'master' into dependabot/npm_and_yarn/npm_and_yarn-secur…

caab6bc

…ity-group-e0cd778f82

Merge pull request #1 from Dargon789/dependabot/npm_and_yarn/npm_and_…

bb78b92

…yarn-security-group-e0cd778f82 Bump the npm_and_yarn group across 1 directory with 1 update

Create fortify.yml

b12a5dc

Update issue templates

5cbdca4

Update CNAME

1d8c21c

Merge pull request #34 from Dargon789/snyk-upgrade-03178c54d4c5401412…

2ec6a7c

…9e16dcb9a2eda9 Snyk upgrade 03178c54d4c54014129e16dcb9a2eda9

Create config.yml (#46)

3e905fe

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

Merge branch '0xsequence:master' into master

16474c1

Merge branch '0xsequence:master' into master

039742e

Update issue templates

ceb95d4

Update fortify.yml

13549e5

Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

Potential fix for code scanning alert no. 84: Insecure randomness

1869b3b

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>

sourcery-ai bot reviewed Jan 9, 2026

View reviewed changes

github-advanced-security bot found potential problems Jan 9, 2026

View reviewed changes

Merge branch 'proto' into snyk-fix-1a42f46a3694152c28f6d1d4dc5aea44

b4e210e

vercel bot deployed to Preview – sequence-js-docs January 9, 2026 09:36 View deployment

Potential fix for code scanning alert no. 92: Insecure randomness

980ba9c

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

vercel bot deployed to Preview – sequence-js-docs January 9, 2026 09:37 View deployment

vercel bot deployed to Preview – sequence-js-web January 9, 2026 09:37 View deployment

gemini-code-assist bot reviewed Jan 9, 2026

View reviewed changes

README.md Show resolved Hide resolved

SECURITY.md Show resolved Hide resolved

azure-pipelines.yml Show resolved Hide resolved

wagmi-project/.circleci/config.yml Show resolved Hide resolved

Potential fix for code scanning alert no. 94: Insecure randomness

a03fd01

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

vercel bot deployed to Preview – sequence-js-docs January 9, 2026 09:43 View deployment

vercel bot deployed to Preview – sequence-js-web January 9, 2026 09:44 View deployment

Potential fix for code scanning alert no. 93: Incomplete regular expr…

dbed8f8

…ession for hostnames Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

vercel bot deployed to Preview – sequence-js-docs January 9, 2026 09:45 View deployment

vercel bot deployed to Preview – sequence-js-web January 9, 2026 09:45 View deployment

Potential fix for code scanning alert no. 95: Information exposure th…

47ad7c2

…rough a stack trace Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>

vercel bot deployed to Preview – sequence-js-docs January 9, 2026 09:46 View deployment

vercel bot deployed to Preview – sequence-js-web January 9, 2026 09:46 View deployment

Repository owner deleted a comment from vercel bot Jan 9, 2026

Dargon789 merged commit 1716625 into proto Jan 9, 2026
15 of 20 checks passed

Dargon789 deleted the snyk-fix-1a42f46a3694152c28f6d1d4dc5aea44 branch January 9, 2026 10:17

Dargon789 mentioned this pull request Jan 9, 2026

[vc]: #proto-wagmi-gemini #197

Open

This was linked to issues Jan 9, 2026

[vc]: #proto-wagmi-gemini #197

Open

# Flow diagram for Next.js workflow job steps #178

Closed

# Sequence diagram for AuthCodeHandler OAuth URL construction for Apple vs non-Apple #200

Closed

Dargon789 linked an issue Jan 17, 2026 that may be closed by this pull request

# Sequence diagram for Indexer subscribeReceipts streaming flow #208

Closed

Conversation

Dargon789 commented Jan 9, 2026

Uh oh!

codesandbox bot commented Jan 9, 2026

Review or Edit in CodeSandbox

Uh oh!

bolt-new-by-stackblitz bot commented Jan 9, 2026

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check failure

Uh oh!

Uh oh!

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check failure

Uh oh!

Uh oh!

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

snyk-io bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

vercel bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Jan 9, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

snyk-io bot commented Jan 9, 2026 •

edited

Loading

vercel bot commented Jan 9, 2026 •

edited

Loading