chore: fixes critical dependency version elliptic by upgrading browserfy

[georgewrmarshall]

Description

This PR addresses a critical security vulnerability in the elliptic package (CVE-2023-49276), which is a transitive dependency through browserify. The vulnerability is identified in Security Advisory #8.

Changes

• Upgraded browserify from ^17.0.0 to ^17.0.1
• This update includes the patched version of elliptic (6.6.1) which fixes the vulnerability

Dependency Path

browserify@17.0.1
└─┬ crypto-browserify@3.12.0
  ├─┬ browserify-sign@4.2.2
  │ └── elliptic@6.6.1
  └─┬ create-ecdh@4.0.4
    └── elliptic@6.6.1

Testing

• Verified the demo build continues to work: npm run build-demo
• Confirmed the security vulnerability is resolved
• Package functionality remains unchanged as this only affects dev dependencies

Screenshots

Before

After

Security

This update resolves a critical severity vulnerability that could potentially allow attackers to recover private keys through a timing attack on ECDSA signatures.

Notes

• This change only affects development dependencies and does not impact production builds of projects using @metamask/jazzicon

[socket-security]

New and updated dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/browserify@17.0.0 ➜ 17.0.1	Transitive: environment, eval	+146	6.58 MB	goto-bus-stop

View full report↗︎

[mcmire]

LGTM!