mirror of
https://github.com/pezkuwichain/pezkuwi-extension.git
synced 2026-10-26 05:25:07 +00:00
Satoshi Qazi Muhammed
bb919831e9
elliptic (open advisories, no fixed version) came only through crypto-browserify, the webpack fallback for node's crypto. Nothing in the extension uses it: the only 'elliptic' in the built files is a word in zxcvbn's dictionary. Without the fallback the chrome and firefox builds contain the same modules with the same bodies; only webpack's module ids and their order change (one browser-field-ignored module is now resolved from a different request). A future crypto import now fails the build instead of shipping a polyfill. braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.