Skip to content

[Snyk] Security upgrade @oceanprotocol/lib from 3.0.0-next.5 to 5.0.0 #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
q1blue wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Open

[Snyk] Security upgrade @oceanprotocol/lib from 3.0.0-next.5 to 5.0.0 #29

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
"dependencies": {
"@coingecko/cryptoformat": "^0.5.4",
"@next/font": "13.1.6",
"@oceanprotocol/lib": "3.0.0-next.5",
"@oceanprotocol/lib": "5.0.0",
Copy link

@gemini-code-assist gemini-code-assist bot Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This upgrade from @oceanprotocol/lib v3 to v5 is a major breaking change that will require significant code modifications.

1. Breaking Changes:
A jump from v3 to v5 introduces numerous breaking changes. Based on the codebase, this will affect files such as:

  • src/shared/@ocean/hooks/useOrder.ts
  • src/shared/@ocean/hooks/useGetAccessDetails.ts
  • src/shared/@ocean/utilities/ocean.ts
  • and others that rely on @oceanprotocol/lib.

You will need to consult the @oceanprotocol/lib v4 and v5 migration guides and update all usages of the library accordingly. Without these updates, the application will not function correctly.

2. yarn.lock Not Updated:
As mentioned in the PR description, yarn.lock has not been updated. This is a critical step. After updating the code, you must run yarn install to generate the new lock file and commit it. Failure to do so will result in builds using the old, vulnerable version of the dependency, or failing altogether.

Given the automated nature of this PR, these manual steps are essential before merging.

"@svgr/webpack": "^8.0.1",
"@tippyjs/react": "^4.2.6",
"@types/axios": "^0.14.4",
Expand Down
Loading