Update elliptic for Improper Verification of Cryptographic Signature.

[ahmedtausif]

Update elliptic for Improper Verification of Cryptographic Signature (https://security.snyk.io/vuln/SNYK-JS-ELLIPTIC-8187303)

[ljharb]

6.6.1 is already in-range for ^6.5.5, so nothing needs to be done except you updating your own lockfiles.

[ljharb]

versions should never be updated in PRs, please revert this

[Fraraven]

Will this be released soon?

[ljharb]

@Fraraven no, because there’s no need for it. Just update your lockfile.

[jtstrohl]

@ljharb -
The latest version (6.6.1) of the elliptic package is still marked as vulnerable by Snyk and an example has been provided by a community member that shows it is still vulnerable. Based on the discussion in the issue threads (#321 and #323) in the elliptic project, there doesn't seem to be much hope this will be fixed any time soon. Is it possible to replace browserify-sign's dependency on elliptic with a secure alternative such as noble-curves by paulmillr?

[ljharb]

Unfortunately not, because noble-curves doesn't support the node versions we do, so it'd be a breaking change.