Repository navigation
Generated SDK #2941386800 (major) - #213
Conversation
|
Noted. Expect updates shortly. (Note that this SDK code is auto generated) |
|
Caution Review the following alerts detected in dependencies. According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
|
![semgrep-code-fireblocks[bot]](https://avatars.githubusercontent.com/u/40918269?s=60&v=4){kind=small}
| "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.55.tgz", | ||
| "integrity": "sha512-mIrE/Cw9y+9Au6dS5vDKDhQza9YvG6w+ZrS6X+ZzA7yFW/soAeaups4Qzn1bL6g5FVy8WtP79+0j82oPIbqRjQ==", | ||
| "version": "2.0.56", | ||
| "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.56.tgz", |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/node-releases/-/node-releases-2.0.56.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.
To resolve this comment:
✨ Commit fix suggestion
| "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.56.tgz", | |
| "resolved": "https://<VERIFIED_VALUE_REQUIRED>" |
View step-by-step instructions
- Configure the project-level
.npmrcto use the approved internal Artifactory registry instead of the public npm registry. For example:registry=https://artifactory.example.com/artifactory/api/npm/<approved-repository>/ - Configure Artifactory authentication using the approved environment variables or credential provider, and do not place access tokens or passwords in
.npmrcor source control. - Remove the existing dependency artifacts so npm does not preserve public registry URLs:
$ rm -rf node_modules package-lock.json - Reinstall dependencies using the configured registry:
$ npm install - Keep the regenerated
package-lock.json. Itsresolvedentries, includingnode-releases, must reference the approved Artifactory host rather thanregistry.npmjs.orgor another public registry.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.
You can view more details about this finding in the Semgrep AppSec Platform.
| "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.2.tgz", | ||
| "integrity": "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==", | ||
| "version": "2.17.0", | ||
| "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.17.0.tgz", |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/is-core-module/-/is-core-module-2.17.0.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.
To resolve this comment:
✨ Commit fix suggestion
| "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.17.0.tgz", | |
| "resolved": "https://<VERIFIED_VALUE_REQUIRED>/is-core-module/-/is-core-module-2.17.0.tgz", |
View step-by-step instructions
-
Configure the project to use the approved internal Artifactory registry in
.npmrc:
registry=https://example.com/artifactory/api/npm/<approved-repository>/
Replace the example URL and repository name with the registry provided by your organization. -
Configure authentication through your organization’s approved mechanism, such as an environment variable or npm credential store. Do not place tokens or passwords in
.npmrccommitted to the repository. -
Remove the existing dependency installation and lockfile so npm does not preserve public registry URLs:
$ rm -rf node_modules package-lock.json -
Regenerate the dependencies using the configured internal registry:
$ npm install -
Confirm that the regenerated
package-lock.jsonuses the approved Artifactory host forresolved,registry, andtarballentries, including theis-core-moduleentry. Do not manually replace URLs in the lockfile because the integrity metadata must match the package served by the registry.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.
You can view more details about this finding in the Semgrep AppSec Platform.
| "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.429.tgz", | ||
| "integrity": "sha512-/1ENIE3cx4HTIx4IfPZFaOunJmsrSVTnj6coXoRVbiJUbkeTyFkJvBeWGkdgh08OhFbxYLMT1kbkwFVSarq6Ow==", | ||
| "version": "1.5.435", | ||
| "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.435.tgz", |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.435.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.
To resolve this comment:
✨ Commit fix suggestion
| "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.435.tgz", | |
| "resolved": "<VERIFIED_VALUE_REQUIRED>", |
View step-by-step instructions
- Configure the project’s
.npmrcto use the approved internal JFrog/Artifactory npm registry, for example:registry=<approved-internal-registry-url>. Do not useregistry.npmjs.orgor another public registry. - Remove the existing dependency installation and lockfile:
$ rm -rf node_modules package-lock.json - Regenerate the dependencies through the configured internal registry:
$ npm install - Confirm the regenerated
package-lock.jsoncontains internal JFrog/Artifactory URLs in itsresolvedfields, including theelectron-to-chromiumentry, rather than public npm or CDN URLs. - Keep the project
.npmrcconfiguration with the approved registry so future lockfile updates use the same source.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.
You can view more details about this finding in the Semgrep AppSec Platform.
| "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.24.tgz", | ||
| "integrity": "sha512-hYrgxie335U08WqICoGqKRzV1HFXv6zdxwJE4ekCb80CM9a0SVVsN4QPwT67RraRo+9h8IATk6uxHJw7QSkdOg==", | ||
| "version": "2.11.25", | ||
| "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.25.tgz", |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.25.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.
To resolve this comment:
✨ Commit fix suggestion
| "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.25.tgz", | |
| "resolved": "<VERIFIED_VALUE_REQUIRED>", |
View step-by-step instructions
- Configure the project’s
.npmrcto use the approved internal Artifactory npm registry, for example:registry=https://example.com/artifactory/api/npm/<approved-repository>/. Use the exact registry URL provided by your organization. - Configure registry authentication through the environment or your approved credentials helper; do not place access tokens directly in
.npmrcor source control. - Remove the existing dependency state so npm does not retain public registry URLs:
$ rm -rf node_modules package-lock.json - Regenerate the dependency tree through the internal registry:
$ npm install - Verify that every
resolvedURL in the regeneratedpackage-lock.jsonpoints to the approved Artifactory registry and that noregistry.npmjs.org,yarnpkg.com, or other public registry/CDN URL remains.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.
You can view more details about this finding in the Semgrep AppSec Platform.
| "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz", | ||
| "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==", | ||
| "version": "7.29.9", | ||
| "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.9.tgz", |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/@babel/parser/-/parser-7.29.9.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.
To resolve this comment:
✨ Commit fix suggestion
| "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.9.tgz", | |
| "resolved": "<VERIFIED_VALUE_REQUIRED>", |
View step-by-step instructions
-
Configure the project’s
.npmrcto use the approved internal Artifactory registry instead of the public npm registry. For example, replace the URL below with your organization’s approved registry URL:registry=https://example.com/artifactory/api/npm/<repository>/ -
Configure authentication through your approved credential mechanism, such as an environment variable or CI secret. Do not place access tokens directly in
.npmrc,package.json, or the lockfile. -
Remove the existing dependency installation and lockfile so npm does not retain public registry URLs:
$ rm -rf node_modules package-lock.json -
Regenerate the dependency tree using the configured internal registry:
$ npm install -
Verify that every
resolvedURL inpackage-lock.jsonpoints to the approved Artifactory registry and that noregistry.npmjs.org,yarnpkg.com, or other public registry/CDN URL remains.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.
You can view more details about this finding in the Semgrep AppSec Platform.
Changelog
2026-10-13
Breaking Change
Trading is now generally available
Products: Trading
Scope: API + SDKs
What's new
The Trading endpoints are no longer marked as beta and are now part of the general API surface.
Impact
Trading endpoints are grouped under Trading instead of Trading (Beta), which changes the generated SDK class used to call them.
Affected endpoints:
Canton calls take the wallet at the top level
Products: Canton (Beta)
Scope: API + SDKs
What's new
Canton call requests now carry
vaultAccountIdandblockchainIdbeside the call type instead of insidepayload, andpayloaditself is now optional on participant onboarding calls.Impact
Canton call requests that still nest the wallet fields inside
payloadare now rejected.Affected endpoints:
Withdraw an allocation by answering the offer
Products: Canton (Beta)
Scope: API + SDKs
What's new
Withdrawing a Canton allocation is now sent as a third answer to the allocation offer, alongside accept and reject, instead of as a separate Canton call.
Impact
Existing integrations that withdraw a Canton allocation stop working until they send the withdrawal against the original offer.
Affected endpoints:
Added
Identify Canton offer responses in transactions
Products: Transactions
Scope: API + SDKs
What's new
Canton transaction details now report
responseTypeon every offer response, plusallocationTransactionIdon an allocation withdrawal so it names the accept it released.Impact
A Canton response transaction read on its own now states which answer it carried; this is a non-breaking addition, so existing integrations keep working unchanged.
Affected endpoints:
Add bulk signing key registration
Products: Key Link (Beta)
Scope: API + SDKs
What's new
Adds the ability to register many Key Link signing keys in a single request and track the registration job until it completes.
Impact
Customers can onboard large sets of signing keys in one request instead of registering each key individually.
Affected endpoints: