Skip to content

Conversation

enjsec
Copy link
Contributor

@enjsec enjsec commented Oct 6, 2025

snyk-top-banner

Snyk has created this PR to upgrade @polkadot/api from 16.1.1 to 16.4.6.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 10 versions ahead of your current version.

  • The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JS-AXIOS-12613773
738 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073
738 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073
738 Proof of Concept
critical severity Predictable Value Range from Previous Values
SNYK-JS-FORMDATA-10841150
738 Proof of Concept
critical severity Function Call With Incorrect Argument Type
SNYK-JS-SHAJS-12089400
738 Proof of Concept
medium severity Symlink Following
SNYK-JS-TARFS-13045213
738 No Known Exploit
Release notes
Package name: @polkadot/api
  • 16.4.6 - 2025-08-26

    Changes:

    • Upgrade substrate types to stable2506-1 (#6201)
    • Bump @ polkadot/common deps (#6202)
  • 16.4.5 - 2025-08-20

    Changes:

    • Fix transferable balance calculation (#6197)
  • 16.4.4 - 2025-08-13

    Changes:

    • bump polkadot/common to 13.5.5 (#6195)
  • 16.4.3 - 2025-07-29
    • Bump @ polkadot/common to 13.5.4 (#6193)
  • 16.4.2 - 2025-07-22
    • Add validation for cache capacity and TTL in LRUCache (#6187)
  • 16.4.1 - 2025-07-09
    • Update Kusama types to 1.6.0 (#6175)
    • fix(api-contracts): correctly decode pallet_revive events (#6181)
  • 16.3.1 - 2025-07-01
    • Update Substrate types to Polkadot stable2503-5 (#6172)
    • Update Polkadot types to polkadot-fellows/runtimes release 1.6.0 (#6173)
    • Update AssetHub Polkadot types to 1.6.0 (#6174)
    • Update AssetHub Kusama types to 1.6.0 (#6176)
    • Fix signature issue in signAsync + send flow #6177
    • Bump @ polkadot/common to 13.5.2 (#6179)
  • 16.2.2 - 2025-06-17

    Changes:

    • feat(types-codec): Add maximum depth limit in decodeU8a functions (#6168)
    • bump polkadotjs/common to 13.5.2 (#6170)
  • 16.2.1 - 2025-06-10

    Contributed:

    • feat(api-contract): add support for ink! v6 and pallet-revive compatibility (#6158)
  • 16.1.2 - 2025-06-04

    Changes:

    • Use ExtrinsicV4 by default (#6164)
  • 16.1.1 - 2025-05-29
from @polkadot/api GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade @polkadot/api from 16.1.1 to 16.4.6.

See this package in npm:
@polkadot/api

See this project in Snyk:
https://app.snyk.io/org/enjsec/project/5025d949-0e5b-457b-a016-e5e5e3cf9d5f?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants