Update pbkdf2 to >= 3.1.3

[oberstet]

Bug Description

See: https://github.com/wamp-proto/wamp-xbr/actions/runs/20275591925/job/58223239617

The failure is caused by a security vulnerability in pbkdf2 where the lowest-non-vulnerable-version is 3.1.3, but dependencies are constraining it to the vulnerable version 3.1.1. Dependencies requiring pbkdf2@^3.1.5 via transitive dependencies on parse-asn1@5.1.9 are responsible.

Solution

Resolve the dependency chain conflict and ensure pbkdf2 gets upgraded to >=3.1.3 (non-vulnerable version).

Steps to Resolution

1. Identify Root Dependencies Requiring pbkdf2@^3.1.5:
   The following direct dependencies cause conflicts:

   • solidity-coverage@0.7.22
   • browserify@17.0.1
   • truffle-contract@4.0.31
   • truffle-hdwallet-provider@1.0.17
   • @openzeppelin/cli@2.8.2
   • verify-on-etherscan@1.2.1

2. Manually Upgrade Dependencies:
   Upgrade your direct dependencies to versions that support pbkdf2@>=3.1.3. The latest version availability can be checked using:

   npm info solidity-coverage@* # or any other package

   For example, update solidity-coverage:

   npm install solidity-coverage@latest

3. Override the Transitive Dependency:
   Use npm's overrides field or yarn resolutions in package.json to explicitly use a pbkdf2 version >=3.1.3.

   Add this configuration to your package.json under overrides:

   "overrides": {
     "pbkdf2": "3.1.3"
   }

   If using yarn, add this under resolutions:

   "resolutions": {
     "pbkdf2": "3.1.3"
   }

4. Validate the Resolution:
   Run the following commands to verify:

   npm ls pbkdf2 # To check installed version
   yarn list pbkdf2 # If using yarn

5. Test and Commit:
   Check your project for functionality after the update. Once validated, commit the changes:

   git add package.json package-lock.json
   git commit -m "Fix dependency conflict and update pbkdf2 to secured version"

6. Retry Dependabot Update:
   Dependabot will now process the update successfully as the dependency conflict is resolved.

---

Checklist

• I have searched existing issues to avoid duplicates
• I have provided a minimal reproducible example
• I have included version information
• I have included error messages/logs