Update elliptic to >= 6.6.1

[kev1n-peters]

See: GHSA-vjh7-7g9h-fjfh

[kev1n-peters]

I ran this script to update all of the elliptic dependencies:

const fs = require('fs');
const path = require('path');
const { execSync } = require('child_process');

const targetVersion = '^6.6.1';
const targetDependency = 'elliptic';

function updatePackageJson(filePath) {
  const packageJson = JSON.parse(fs.readFileSync(filePath, 'utf8'));

  let updated = false;

  // Update the version of elliptic in dependencies
  if (packageJson.dependencies && packageJson.dependencies[targetDependency]) {
    packageJson.dependencies[targetDependency] = targetVersion;
    updated = true;
  }

  // Update the version of elliptic in devDependencies
  if (packageJson.devDependencies && packageJson.devDependencies[targetDependency]) {
    packageJson.devDependencies[targetDependency] = targetVersion;
    updated = true;
  }

  // Add or update elliptic in overrides
  if (!packageJson.overrides) {
    packageJson.overrides = {};
  }
  if (packageJson.overrides[targetDependency] !== targetVersion) {
    packageJson.overrides[targetDependency] = targetVersion;
    updated = true;
  }

  if (updated) {
    fs.writeFileSync(filePath, JSON.stringify(packageJson, null, 2));
    console.log(`Updated ${filePath}`);

    // Run npm install in the directory of the updated package.json
    const dir = path.dirname(filePath);
    console.log(`Running npm install in ${dir}`);
    execSync('npm install', { cwd: dir, stdio: 'inherit' });
  }
}

function findPackageJsonFiles(dir) {
  const files = fs.readdirSync(dir);

  files.forEach((file) => {
    const filePath = path.join(dir, file);
    const stat = fs.statSync(filePath);

    if (stat.isDirectory() && file !== 'node_modules') {
      findPackageJsonFiles(filePath);
    } else if (file === 'package.json') {
      updatePackageJson(filePath);
    }
  });
}

// Start the search from the current directory
findPackageJsonFiles(process.cwd());

[evan-gray]

at a glance, the change / approach seem reasonable to me. also noting that many, if not all, of these packages / use cases are non-production and/or controlled inputs

[djb15]

Neat script! Thanks for updating