FIX: audit 1f602 commit 3, wordToBytesCanonical added to src/sha/util…

[jk89]

…s.ts as a sound sibling of wordToBytes for bytesPerWord > 31, backed by new isCanonicalFieldBytesLE range check against FIELD_PRIME_LE, both exported from src/index.ts and src/index.min.ts alongside wordToBytes, regression tests added proving the canonicity check rejects forged p and p+1 byte arrays that satisfy the old mod-p equality alone, all regression tests pass (11 pass 0 fail), changelog/readme updated.

[github-actions]

Quality Gate Report

Generated: 8/20/2026, 2:11:05 PM

Overall Status: FAIL

Required checks failed:

• npm audit

---

Summary

• Passed: 2
• Failed: 4
• Skipped: 1

---

Detailed Results

Dependencies - PASS

Type: REQUIRED

Message: Dependencies installed successfully

Scripts Check - FAIL

Type: Optional

Message: Missing scripts: test:unit, test:integration

Details

Expected: test:unit, test:integration, test:e2e
Found: test:e2e
Missing: test:unit, test:integration

npm audit - FAIL

Type: REQUIRED

Message: Vulnerabilities found (threshold: moderate)

Hint: npm audit fix

Details

# npm audit report

@babel/core  <=7.29.0
@babel/core: Arbitrary File Read via sourceMappingURL Comment - https://github.com/advisories/GHSA-4x5r-pxfx-6jf8
fix available via `npm audit fix`
node_modules/@babel/core

@babel/plugin-transform-modules-systemjs  7.12.0 - 7.29.0
Severity: high
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input - https://github.com/advisories/GHSA-fv7c-fp4j-7gwp
fix available via `npm audit fix`
node_modules/@babel/plugin-transform-modules-systemjs

brace-expansion  <=1.1.17 || 2.0.0 - 2.1.3 || 3.0.0 - 5.0.8
Severity: high
brace-expansion: Large numeric range defeats documented `max` DoS protection - https://github.com/advisories/GHSA-jxxr-4gwj-5jf2
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
node_modules/brace-expansion
node_modules/glob/node_modules/brace-expansion

js-yaml  <=3.15.0 || 4.0.0 - 4.3.0
Severity: high
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
fix available via `npm audit fix`
node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml
node_modules/js-yaml

ws  8.0.0 - 8.20.1
Severity: high
ws: Uninitialized memory disclosure - https://github.com/advisories/GHSA-58qx-3vcg-4xpx
ws: Memory exhaustion DoS from tiny fragments and data chunks - https://github.com/advisories/GHSA-96hv-2xvq-fx4p
fix available via `npm audit fix`
node_modules/ws
  ethers  6.0.0-beta.1 - 6.16.0
  Depends on vulnerable versions of ws
  node_modules/ethers

6 vulnerabilities (1 low, 1 moderate, 4 high)

To address all issues, run:
  npm audit fix

Build - PASS

Type: REQUIRED

Message: Build completed successfully

Prettier - FAIL

Type: Optional

Message: 63 file(s) need formatting

Hint: npm run format

Linter - FAIL

Type: Optional

Message: 21 error(s), 0 warning(s)

Hint: npm run lint

Details

> @nori-zk/proof-conversion@0.8.20 lint
> eslint src/*


/home/runner/actions/_work/proof-conversion/proof-conversion/src/groth/adcd3_regression.spec.ts
  67:21  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  72:18  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  77:18  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  90:21  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars

/home/runner/actions/_work/proof-conversion/proof-conversion/src/groth/adcd3_vk_regression.spec.ts
  73:27  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  78:22  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  83:22  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  88:20  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars

/home/runner/actions/_work/proof-conversion/proof-conversion/src/plonk/recursion/witness_tracker.ts
  29:10  error  'G2Line' is defined but never used  @typescript-eslint/no-unused-vars

/home/runner/actions/_work/proof-conversion/proof-conversion/src/sha/sha_hash.ts
  1:33  error  'Field' is defined but never used     @typescript-eslint/no-unused-vars
  1:48  error  'Provable' is defined but never used  @typescript-eslint/no-unused-vars

✖ 11 problems (11 errors, 0 warnings)

Unit Tests - SKIPPED

Type: Info

Message: test:unit script not found

---

Actionable Insights

• Add unit tests: "test:unit": "for file in $(find . -name '*.unit.spec.ts'); do npm run test -- \"$file\" || exit 1; done"
• Add integration tests: "test:integration": "for file in $(find . -name '*.integration.spec.ts'); do npm run test -- \"$file\" || exit 1; done"
• Fix Vulnerabilities: npm audit fix (or npm audit fix --force for breaking changes)
• Auto-fix formatting: npx prettier --write "**/*.{ts,js,json,md}"
• Linting Errors: Fix the linting errors shown above and run npm run lint locally to verify.

---

Configuration

Quality gate configured via environment variables.

Check	Enabled	Required
Dependencies	true	true
Build	true	true
Scripts	true	false
npm audit	true	true (level: moderate)
Prettier	true	false (dep: prettier)
Linter	true	false (dep: eslint)
Unit Tests	true	false

Note: Integration and E2E tests are checked for existence but run in CI/CD pipeline.