hiero-ledger / hiero-ledger/hiero-consensus-node
Replace test module deps on `net.i2p.crypto.eddsa` with `com.goterl.lazysodium`
Open
dependencies
- Dominant language
- Java
- Stars
- 406
- Forks
- 226
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 210
Description
The token service has some [test-only dependencies](https://github.com/hiero-ledger/hiero-consensus-node/blob/main/hedera-node/hedera-token-service-impl/build.gradle.kts#L18) on `net.i2p.crypto.eddsa`, whose latest version has a CVE.
We can clean things up by replacing this with LazySodium.
Contributor guide
Research direction
Start at hedera-node/hedera-token-service-impl/build.gradle.kts line 18 and inspect the test-only net.i2p.crypto.eddsa dependency and its usages in the token service tests. Replace those dependencies with com.goterl.lazysodium, then verify that the token service test build passes without the vulnerable library.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100