Patch runtime dependency advisories and verify caller compatibility

[antuz123]

The runtime lockfile had a critical proxy-addr path plus PBKDF2 and moderate Moment/UUID advisories. This pins proxy-addr 2.0.8, pbkdf2 3.1.7 and Moment 2.31.0, and explicitly overrides the four transitive UUID copies to CommonJS-compatible 11.1.1. Their actual callers use the unchanged v4 API; provider and cron lifecycle APIs stay intact.

Validation: Node 22 compile; 121/121 tests, including BIP39/long-passphrase vectors, email duration formatting, AWS/Google UUID helpers, cron registration/manual execution and the Google HTTP client's multipart boundary on loopback; current-source and fetched-history Gitleaks scans. Runtime audit now reports zero critical/high/moderate findings and one low AWS SDK v2 region-config advisory. docs/SECURITY_REVIEW.md records the remaining SDK migration, provider-validation limits and preserved mobile HTTP error contract.

No hosted deployment or production configuration/credential change is included. Live SES/Google delivery and the supported AWS SDK v3 migration require their own staging validation. The public contributor setup may pin this reviewed public commit, with final delivery depending on this PR's merge.

Combined local validation (9 Oct 2026): isolated merge of #1 (3cc7728c) and #2 (73399398) passed Node 22 npm ci --ignore-scripts, compile and 125/125 tests across 6 suites. Disposable SES loopback serialization, Google Secret Manager provider mock and access-log canary passed; no external provider call or real credential was used. Combined runtime audit: 0 critical/high/moderate and 1 low AWS SDK v2 advisory; current-source Gitleaks passed. Hosted provider/log acceptance still requires non-production SES IAM/verified identity/region, GCP staging project and Secret Manager access, and private running artifact/log/config visibility.

Cloud continuation (12 October 2026): this source head is unchanged and was approved by Utkarsh on 9 October. Exact-head GitHub source/test checks remain successful. An isolated unpushed integration of #1/#2/#5 at 8de93e58358d0f9066c4ccda27fbeac474c9279d passed Node 22.23.3 compile and 127/127 tests across six suites. This is compatibility evidence only, not a deployment or production route/log/provider attestation. Mac-native testing is not needed for backend source review; staging/operator and app/hardware integration acceptance remain open.

[Copilot]

Copilot review overview

🟢 Approval recommended

The dependency updates are consistent, the tests cover the stated compatibility checks, and no blocking issues were identified.

Review effort: Balanced
Findings: None

What changed in this PR

Updates Signing Server runtime dependencies with security patches and adds BIP39 seed compatibility checks.

Changes:

• Pins pbkdf2 to 3.1.7 and proxy-addr to 2.0.8 through npm overrides and lockfile updates.
• Adds seed-derivation tests using a published vector and Node crypto with a long synthetic passphrase.

File	Description
tests/​unit/​bip39Compatibility.test.ts	Adds BIP39 seed compatibility tests.
package.json	Pins patched runtime dependencies through overrides.
package-lock.json	Records matching dependency versions and integrity hashes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[antuz123]

Source and dependency review at 3cc7728: I checked the lockfile overrides against the AWS, Google, cron, and teeny-request UUID v4 callers, plus the BIP39 and Moment compatibility fixtures. Exact-head GitHub CI compiled and passed 121/121 tests (run 37625344825); current-source and fetched-history scan jobs passed (run 37625344830). A fresh Node 22 lockfile-only runtime audit on 8 Oct reports 0 critical, 0 high, 0 moderate, and 1 low advisory (AWS SDK v2 region configuration). The SES region is deployment configuration, so hosted region validation and a staged SES send/response check remain operational gates; the SDK v3 migration remains separate. This comment records source review evidence only and does not establish hosted behavior or independent maintainer approval.

[antuz123]

R4 backend acceptance handoff — 12 October 2026

State: BLOCKED_ON_STAGING_OPERATOR_ACCEPTANCE
Scope: Existing R4 source only. New Assisted Multisig remains pending Adam.

Source/compatibility evidence: Public Relay runtime pin ee935359f22ff7932ea0a62e9084d4b49801f4aa passed Node 22 compile, 105/105 baseline/local-mode and 104/104 Mongo 7 replica-set backup tests during this continuation. SigningServer #1 3cc7728, #2 7339939 and #5 7c14b6e merged without conflicts into isolated unpushed verification SHA 8de93e58358d0f9066c4ccda27fbeac474c9279d; Node 22.23.3 compile and 127/127 tests in 6 suites passed. All three source PRs and Relay #3 have Utkarsh's 9 October approvals on the pinned heads; hosted source/test checks on those unchanged heads are green. These are source/local-fixture results, not a deployed-service claim.

Operator/staging acceptance still required:

• Attest running source/artifact identity, effective route authorization and environment, dependency inventory, provider roles and log/access visibility using an approved private read-only process. Publish only non-sensitive SHA/build IDs and aggregate outcome categories.
• On a disposable staging replica set, attest transaction support and the actual account-scoped index; exercise readback/conditional repair, two writes from one revision, delete/recreate and A→B→A generation invalidation, cross-account isolation, malformed IDs, signer-map cleanup, archive/unlink and old-client walletObject/signersObjects aliases. Ambiguous old/current field pairs must reject before mutation; stale writes must preserve concurrent data.
• Verify synthetic old-client restore through mobile and hosted HTTP; the current contributor stack pin is not proof of production route parity. Use an independent contributor's own fork/identity to demonstrate clean setup and a scoped PR; never share a maintainer credential.
• For SigningServer migration, use synthetic V2 fixtures via staged HTTP with real route controls: unauthorized/invalid-token requests rejected, first migration and retry preserve migrationSuccessful/setup metadata and V2 policy/restrictions, outbound responses omit verifier, migrated scalar TOTP validates, retry leaves one V3/map.
• Inventory potentially malformed preexisting V3 records privately and obtain a separate reviewed repair decision. Redact legacy migration verifier and preserve V2 TOTP in V3 #5 leaves existing V3 records untouched.
• Verify staged SES and Google provider success/failure with scoped non-production roles; fixed operational log categories and method/status/size/duration access logs must omit request URLs, IDs, raw exceptions and secret/config values. AWS SDK v2 migration remains separate.
• Keep source approval, hosted CI, staging acceptance, deployment approval and running-artifact postflight as separate decisions. No deployment, credential change, owner backup mutation, production index action or funded operation has been authorized by this handoff.

Native Mac testing is not required to review backend source itself. The final app/Desktop Local handoff must separately record iOS/Android/physical signer round trips against explicitly identified compatible services.