@smartledger/bsv 5.4.1 → 5.4.2

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to SmartLedger-BSV will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.4.2] - 2026-06-25
+
+Patch release. Dependency security maintenance — no API or behavior changes.
+
+### Security
+
+- **`bn.js` `4.11.9` → `4.12.3`** — picks up the backported 4.x patch for
+  GHSA-378v-28hj-76wf (infinite loop via hardened hex parsing). This is the
+  only runtime-dependency change; the public `BN` API is unchanged. After the
+  bump, `npm audit --omit=dev` reports **0 vulnerabilities** in the runtime
+  tree.
+
+### Changed
+
+- **`mocha` `^8.4.0` → `^11.7.6`** and **`nyc` `^14.1.1` → `^18.0.0`**
+  (dev-only). Clears the high-severity dev advisories with real upstream fixes
+  (cross-spawn / spawn-wrap ReDoS, the old `serialize-javascript` RCE, `nanoid`,
+  `uuid`). Full suite still **4256 passing**; `nyc` coverage verified.
+
+### Notes
+
+- The remaining `npm audit` findings are all development-only and never reach
+  installers (the published tarball ships no `node_modules`; none are listed
+  under `dependencies`). They are either upstream-blocked (`mocha`/`nyc` are at
+  their latest releases but still range-pin affected transitives) or await the
+  deferred `standard@17` lint migration. See `SECURITY.md` for the full scope.
+
 ## [5.4.1] - 2026-06-25
 
 Patch release. Repairs Legal Token Protocol (LTP) right-token creation,

package/SECURITY.md

@@ -52,13 +52,22 @@ to remain anonymous.
 - Bugs in BIP-143 preimage handling, covenant construction, or LTP/GDAF
   signing paths.
 - Supply-chain concerns about pinned runtime dependencies
-  (`elliptic@6.6.1`, `bn.js@4.11.9`, `bs58@4.0.1`, etc.).
+  (`bn.js@4.12.3`, `bs58@4.0.1`, `@noble/*`, etc.). The runtime dependency
+  tree carries **no known advisories** (`npm audit --omit=dev` is clean);
+  `elliptic` was dropped from the runtime/bundle path in 5.4.0.
 
 ## Out of Scope
 
 - Vulnerabilities in development-only dependencies (`webpack 4`, `standard 12`,
-  `mocha 8`, etc.). These are tracked separately and addressed in the planned
-  3.5.0 toolchain upgrade.
+  `mocha`, `nyc`, `crypto-browserify`, etc.). These never reach installers — the
+  published tarball ships no `node_modules` and none are listed under
+  `dependencies`. The remaining `npm audit` findings (currently 17, all
+  dev-only) are either upstream-blocked — `mocha`/`nyc` are already at their
+  latest releases but still range-pin affected transitives (`diff`,
+  `serialize-javascript`, nested `js-yaml`) — or require the deferred
+  `standard@17` lint migration (`eslint`/`inquirer`/`tmp` chain) and the
+  `crypto-browserify` browser-build chain. They are accepted dev-only risk and
+  tracked separately.
 - Issues that require a malicious local environment (compromised Node, browser
   extension, or filesystem) to exploit.
 - Denial-of-service from intentionally malformed inputs that do **not** cross