[Snyk] Security upgrade @walletconnect/core from 2.17.4 to 2.18.0

[revan-zhang]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• packages/example/package.json
• packages/example/yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Use of a Cryptographic Primitive with a Risky Implementation SNYK-JS-ELLIPTIC-14908844	540

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

---

---

Note

Medium Risk
Dependency-only change, but it upgrades @walletconnect/core to a newer release line (lockfile now resolves 2.23.9) and pulls in updated WalletConnect/crypto/logging transitive deps, which could affect WalletConnect session/relay behavior at runtime.

Overview
Upgrades the example app’s WalletConnect dependency by bumping @walletconnect/core from ^2.13.0 to ^2.18.0 in packages/example/package.json.

Regenerates packages/example/yarn.lock, which updates the resolved WalletConnect stack (notably @walletconnect/core/types/utils/logger) and related crypto/logging transitive packages, addressing the reported vulnerability.

^{Written by Cursor Bugbot for commit 97f6031. This will update automatically on new commits. Configure here.}

[revan-zhang]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tonconnect/​protocol@​2.3.0

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

WalletConnect package version mismatch causes incompatibility risk

Medium Severity

Only @walletconnect/core was upgraded to ^2.18.0 (resolving to 2.23.9), while @walletconnect/sign-client and @walletconnect/types remain at ^2.13.0 (resolving to 2.17.4). The application imports RELAYER_EVENTS from core@2.23.9 but sign-client@2.17.4 internally depends on core@2.17.4, creating a version mismatch. WalletConnect packages are designed to work in lockstep. Additionally, sign-client@2.17.4 still pulls in @walletconnect/utils@2.17.4 which depends on elliptic@6.6.1 — the very vulnerable package this PR aims to fix — so the security vulnerability remains in the dependency tree.

Additional Locations (1)

• packages/example/yarn.lock#L7557-L7579