lawmn🇯🇵

We've just published 15 security advisories across BitcoinJS libraries (14 High and one Medium), with patched releases available on npm. This follows work with @junderwood4649 and the reporters to investigate the issues, prepare fixes and provide backports for the maintained release lines. The findings cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation. If you maintain an application using BitcoinJS packages, please check your direct and transitive dependencies and upgrade affected versions. For bitcoinjs-lib, the patched releases are 7.0.5, 6.1.10 and 5.2.3, depending on your release line. Both tiny-secp256k1 and bitcoin-js/tiny-secp256k1-asmjs have fixes in 2.2.5. The other patched releases are bip39 3.1.2 and 2.6.1, bip38 3.1.2 and 2.0.4, bolt11 1.4.2, merkle-lib 2.0.11 and bip32-utils 0.11.2. Some fixes require changes in the application as well as a dependency update. You can find the affected ranges, technical details and upgrade guidance here: github.com/bitcoinjs/bitcoin… github.com/bitcoinjs/tiny-se… github.com/bitcoinjs/bip39/s… github.com/bitcoinjs/bip38/s… github.com/bitcoinjs/bolt11/… github.com/bitcoinjs/merkle-… github.com/bitcoinjs/bip32-u… Thanks to the researchers and reporters: the Bitcoin Red Team (@Rob1Ham, @callebtc and @danielabrozzoni), @0xaudron, @real_a_kalout and ARSB (github.com/ARSB1).