Release 2.4.2 (2026-07-28)

[mgk-fb]

Summary

• Upgrades axios ^1.6.2 → ^1.18.1 — remediates CVE-2026-44492 (SSRF) and CVE-2026-44487 (Proxy-Authorization leak) plus 3 further axios CVEs
• Removes pm2 from production dependencies — drops the ip SSRF, systeminformation, ws@7.4.6, and bundled axios@0.21.4 CVE column
• Overrides jws to ^3.2.3 — resolves GHSA-869p-cjfg-cm3x / CVE-2025-65945 (HMAC verification advisory on jws pulled in by jsonwebtoken)
• Bumps @types/node to ^22.0.0 (Node 22 LTS), drops skipLibCheck

Test plan

• Build passes (npm run build)
• 187/187 unit tests pass (npm test)
• No JFrog registry URLs in package-lock.json
• npm audit clean on production deps (one accepted finding: uuid v3/v5/v6 buf — not reachable, agent uses uuid.v4 only)

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​node@​20.10.0 ⏵ 22.20.0				-1
	axios@​1.6.2 ⏵ 1.18.1	-1	+75		-2

View full report

[semgrep-code-fireblocks]

Semgrep found 25 block-public-registry-refs-in-package-lock findings:

• package-lock.json
  • L1141 - Triage
  • L3125 - Triage
  • L3156 - Triage
  • L3558 - Triage
  • L3583 - Triage
  • L3595 - Triage
  • L3608 - Triage
  • L3928 - Triage
  • L4815 - Triage
  • L5102 - Triage
  • 15 more - Triage

package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.

[semgrep-code-fireblocks]

Semgrep identified an issue in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/@types/node/-/node-22.20.0.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.0.tgz",
	"resolved": "https://example.com/artifactory/api/npm/npm/@types/node/-/node-22.20.0.tgz",

View step-by-step instructions

1. Update your project .npmrc so registry points to the approved internal JFrog/Artifactory URL, for example registry=https://example.com/artifactory/api/npm/npm/.
2. Add or update the scoped registry too if your internal registry requires it for package scopes such as @types, for example @types:registry=https://example.com/artifactory/api/npm/npm/.
3. Remove the existing lockfile and installed modules so npm stops reusing public registry URLs: $ rm -rf node_modules package-lock.json
4. Reinstall dependencies through the internal registry with $ npm install.
5. Confirm the regenerated package-lock.json no longer contains public URLs such as https://registry.npmjs.org/... and instead uses the approved internal registry hostname. The lockfile stores the source URL for each package tarball, so regenerating it after changing .npmrc replaces the public resolved entries.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[mgk-fb]

False positive for this repository. This is the public GitHub mirror of the internal Fireblocks agent; registry.npmjs.org is the correct and expected registry for public consumers. The internal JFrog/Artifactory URLs from the GitLab lockfile are intentionally rewritten to registry.npmjs.org as part of the public release sanitization process.

[semgrep-code-fireblocks]

Semgrep identified an issue in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	"resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz",
	"resolved": "https://example.com/artifactory/api/npm/npm/@types/node/-/node-20.19.43.tgz",

View step-by-step instructions

1. Update the project’s npm registry configuration to use the approved internal registry instead of the public npm registry.
   Add or update .npmrc with registry=https://example.com/artifactory/api/npm/npm/ or the exact approved JFrog/Artifactory URL used by your team.

2. Remove the existing installed packages and lockfile so npm does not keep the old public resolved URLs.
   Run $ rm -rf node_modules package-lock.json

3. Regenerate the lockfile using the internal registry.
   Run $ npm install
   npm will rebuild package-lock.json and replace entries like https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz with URLs from the approved registry.

4. Check that the regenerated package-lock.json no longer contains public registry or CDN URLs in resolved, registry, or tarball fields, especially for @types/node and other transitive packages.

5. Alternatively, if your team configures the registry outside the repo, set it before reinstalling with $ npm config set registry https://example.com/artifactory/api/npm/npm/, then regenerate package-lock.json the same way.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[mgk-fb]

False positive for this repository. This is the public GitHub mirror of the internal Fireblocks agent; registry.npmjs.org is the correct and expected registry for public consumers. The internal JFrog/Artifactory URLs from the GitLab lockfile are intentionally rewritten to registry.npmjs.org as part of the public release sanitization process.

[mgk-fb]

All 25 block-public-registry-refs-in-package-lock findings are false positives for this repository.

This is the public GitHub mirror of the Fireblocks agent. registry.npmjs.org is the correct registry here — public consumers must be able to resolve dependencies without access to the internal JFrog/Artifactory instance.

The internal lockfile uses JFrog URLs; they are intentionally rewritten to registry.npmjs.org as part of the sanitization step before each public release. This rule should be suppressed or excluded for this repo.