@smartledger/bsv 5.4.0 → 5.4.2

package/CHANGELOG.md

@@ -5,6 +5,67 @@ All notable changes to SmartLedger-BSV will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.4.2] - 2026-06-25
+
+Patch release. Dependency security maintenance — no API or behavior changes.
+
+### Security
+
+- **`bn.js` `4.11.9` → `4.12.3`** — picks up the backported 4.x patch for
+  GHSA-378v-28hj-76wf (infinite loop via hardened hex parsing). This is the
+  only runtime-dependency change; the public `BN` API is unchanged. After the
+  bump, `npm audit --omit=dev` reports **0 vulnerabilities** in the runtime
+  tree.
+
+### Changed
+
+- **`mocha` `^8.4.0` → `^11.7.6`** and **`nyc` `^14.1.1` → `^18.0.0`**
+  (dev-only). Clears the high-severity dev advisories with real upstream fixes
+  (cross-spawn / spawn-wrap ReDoS, the old `serialize-javascript` RCE, `nanoid`,
+  `uuid`). Full suite still **4256 passing**; `nyc` coverage verified.
+
+### Notes
+
+- The remaining `npm audit` findings are all development-only and never reach
+  installers (the published tarball ships no `node_modules`; none are listed
+  under `dependencies`). They are either upstream-blocked (`mocha`/`nyc` are at
+  their latest releases but still range-pin affected transitives) or await the
+  deferred `standard@17` lint migration. See `SECURITY.md` for the full scope.
+
+## [5.4.1] - 2026-06-25
+
+Patch release. Repairs Legal Token Protocol (LTP) right-token creation,
+signing, transfer, obligation and verification, which all threw on use.
+
+### Fixed
+
+- **LTP right-token signing was completely broken.** `lib/ltp/right.js`
+  defined `_signToken` twice; the duplicate object-literal key shadowed the
+  working signer and referenced an undefined `hash`, so every
+  `prepareRightToken` / transfer / reissue / obligation signing failed with
+  "hash is not defined". The detached-JWS builder is now `_createJWS(hash,
+  signature)`.
+- **`LTP#createRightToken` called non-existent entrypoints** (`LTPRight.create`
+  and `LTPProof.createSignature`). Added a build-only `RightToken.create(...)`
+  (reused by `prepareRightToken`) and signing now goes through the repaired
+  `RightToken._signToken`.
+- **`LTP#verifyToken`, `transferRight`, `createObligation`,
+  `createSelectiveDisclosure` and `createLegalValidityProof` all threw** — each
+  called a non-existent `LTPProof`/`LTPRight` method (the same `prepare*` vs
+  `create*` naming mismatch). They now call the real `prepare*` entrypoints.
+- **Added `RightToken.verifyToken(token, publicKey)`** — a real public-key
+  ECDSA verifier for tokens signed by `_signToken` (recomputes the canonical
+  hash, confirms `tokenHash` integrity, then verifies the signature embedded in
+  the detached JWS). `LTP#verifyToken` routes through it, so the pre-transfer
+  ownership check is now a genuine signature check.
+
+### Tests
+
+- Adds `test/ltp/right.js` covering right-token creation, signing,
+  verification (valid / wrong-key / tampered), transfer (incl. non-transferable
+  rejection), obligation creation, selective disclosure and legal-validity
+  proofs. Full suite: 4256 passing.
+
 ## [5.4.0] - 2026-06-15
 
 ### Changed

package/SECURITY.md

@@ -52,13 +52,22 @@ to remain anonymous.
 - Bugs in BIP-143 preimage handling, covenant construction, or LTP/GDAF
   signing paths.
 - Supply-chain concerns about pinned runtime dependencies
-  (`elliptic@6.6.1`, `bn.js@4.11.9`, `bs58@4.0.1`, etc.).
+  (`bn.js@4.12.3`, `bs58@4.0.1`, `@noble/*`, etc.). The runtime dependency
+  tree carries **no known advisories** (`npm audit --omit=dev` is clean);
+  `elliptic` was dropped from the runtime/bundle path in 5.4.0.
 
 ## Out of Scope
 
 - Vulnerabilities in development-only dependencies (`webpack 4`, `standard 12`,
-  `mocha 8`, etc.). These are tracked separately and addressed in the planned
-  3.5.0 toolchain upgrade.
+  `mocha`, `nyc`, `crypto-browserify`, etc.). These never reach installers — the
+  published tarball ships no `node_modules` and none are listed under
+  `dependencies`. The remaining `npm audit` findings (currently 17, all
+  dev-only) are either upstream-blocked — `mocha`/`nyc` are already at their
+  latest releases but still range-pin affected transitives (`diff`,
+  `serialize-javascript`, nested `js-yaml`) — or require the deferred
+  `standard@17` lint migration (`eslint`/`inquirer`/`tmp` chain) and the
+  `crypto-browserify` browser-build chain. They are accepted dev-only risk and
+  tracked separately.
 - Issues that require a malicious local environment (compromised Node, browser
   extension, or filesystem) to exploit.
 - Denial-of-service from intentionally malformed inputs that do **not** cross