[pollosp]

Why

Dependabot reports vulnerabilities in ws, @metamask/sdk and sharp. All three come from the wallet SDK tree: @crossmint/client-sdk-react-ui@4.9.0 -> @dynamic-labs/*@4.28.0 -> viem / @metamask/sdk / @dynamic-labs/iconic.

These parents pin exact versions. @crossmint/client-sdk-react-ui@4.9.0 is the latest version and it pins @dynamic-labs/*@4.28.0. Thus a parent bump is not possible. This PR adds three narrow pnpm.overrides.

Changes

Package	From	To	Bump type	Advisory	Severity	Alert #
ws (via viem, isows)	8.18.0, 8.18.1, 8.18.2	8.21.0	minor	GHSA-96hv-2xvq-fx4p (memory exhaustion DoS from tiny fragments)	high	#415
ws (same)	8.18.0, 8.18.1, 8.18.2	8.21.0	minor	GHSA-58qx-3vcg-4xpx (uninitialized memory disclosure)	medium	#405
@metamask/sdk (via @dynamic-labs/ethereum)	0.33.0	0.33.1	patch	GHSA-qj3p-xc97-xw74 (exposed via malicious debug@4.4.2)	medium	#383
@metamask/sdk-communication-layer (via @metamask/sdk)	0.33.0	0.33.1	patch	GHSA-qj3p-xc97-xw74	medium	#384
sharp (via @dynamic-labs/iconic)	0.33.5	0.35.4	minor (0.x)	GHSA-f88m-g3jw-g9cj (libvips CVEs)	high	#421
sharp (same)	0.33.5	0.35.4	minor (0.x)	GHSA-rgj7-g3m4-5g8c (libheif CVEs)	high	#427

Overrides (root package.json):

"ws@>=8.0.0 <8.21.0": "8.21.0",
"@metamask/sdk@0.33.0": "0.33.1",
"@dynamic-labs/iconic>sharp": "0.35.4"

Notes:

• Each target is the first fixed version. Each target has no active advisory.
• The ws override has a version range. It changes only vulnerable ws 8.x copies. The ws 6.x and 7.x copies are not affected by these advisories and do not change. The existing ws@8.21.3 users do not change.
• @metamask/sdk@0.33.1 pins debug@4.3.4 (this is the fix). Thus debug@4.3.4 and ms@2.1.2 are new in the lockfile. Both have no advisory.
• @dynamic-labs/iconic lists sharp as a dependency, but its code does not import sharp. next already uses sharp@0.35.4. Now there is only one sharp version.
• Many @dynamic-labs/* lockfile keys change. The versions are the same. Only the peer hashes change (new ws version, and sharp@0.35.4 has @types/node as an optional peer).

Risk: medium

• ws and @metamask/sdk are runtime code in the browser wallet flow (WalletConnect, MetaMask, viem WebSocket transport).
• ws 8.18 -> 8.21 is a minor bump inside the same major. The ws changelog for 8.19-8.21 has fixes and new options, but no breaking changes.
• @metamask/sdk 0.33.0 -> 0.33.1 is a patch.
• sharp has almost no risk here, because @dynamic-labs/iconic does not load it.
• The automated tests do not cover a real wallet connection. Please do a manual wallet login and checkout on the Vercel preview before merge.
• Rollback: revert this PR. No data or state changes.

How I tested

Local, Node 20.19.6, pnpm 10.33.0. Same steps as .github/workflows/ci.yml:

Command	Result
pnpm install --frozen-lockfile	pass
pnpm turbo run build --filter='./packages/*' --force	pass
pnpm turbo run typecheck --force	pass
pnpm turbo run test --force	pass, 159 tests (same as main)
pnpm turbo run build --filter=@agent-commerce/web --force (CI placeholder env)	pass
next start + curl on /, /login, /skill.md	200, no server errors
pnpm why ws@8.21.0 / sharp / @metamask/sdk -r	only the target versions are in the tree
pnpm audit	34 findings on main, 16 on this branch. No ws, sharp or @metamask findings.

Not fixed in this PR

Package	Alert #	Reason
next	#430, #431	Separate PR (direct dependency of apps/web).
esbuild	#381, #414	Separate PR (build/dev only).
image-size 1.2.1	#428, #429	Fix is 2.0.3. Needs a major bump. metro@0.80.12 declares ^1.0.2. Not done.
valibot 0.36.0	#386, #422	Fix is 1.2.0 / 1.4.2. Needs a major bump. @mysten/sui@1.24.0 declares ^0.36.0. Not done.
fast-xml-parser 4.5.7	#391	Fix is 5.7.0. Needs a major bump. Not done.
stream-json 1.9.1	#426	Fix is 3.5.0. Needs a major bump. Not done.
decode-uri-component 0.2.2	#425	Fix is 0.5.0. That version is ESM-only. query-string@7 loads it with require(), so the bump breaks it. Not done.
uuid	#406	uuid@8.3.2 and 9.0.1 (from @metamask/*) need a major bump. A patch for the 11.1.0 copy does not close the alert. Not done.
node-forge, elliptic, bigint-buffer	#432, #387, #382	No fixed version exists.

Most of these need a new @crossmint/client-sdk-react-ui release with newer @dynamic-labs/* packages.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agent-commerce-sample-app	Ready	Preview	Oct 2, 2026 8:26am UTC