[danielpeng1]

Bump the @bitgo-beta/* SDK packages, pin transitive CVE fixes, and adapt MBE recovery to the new SDK.

• Bump 76 @bitgo-beta/* dependencies and the sdk-core/statics overrides to the latest betas, and regenerate package-lock.json.
• Raise follow-redirects, node-forge, joi and body-parser to their fixed versions so the Trivy HIGH gate passes.
• Add a body-parser override because express 4.21.2 pins it at 1.20.3, which a lockfile regen cannot fix.
• In recoverEcdsaMPCv2Wallets, throw if eth-like userKey is missing, before recover() runs, since the new SDK made it optional.

Tests

• testUtils.ts: add nockEthWalletIsSigner to mock the Etherscan isSigner(address) calls the new SDK makes for both recovery keys.
• recoveryWallet.test.ts and musigRecovery.test.ts: use the helper in the EVM recovery tests and assert the signer calls are consumed.
• recoveryEcdsa.test.ts: eth-like recovery without userKey is rejected before recover() or the AWM client is called.

Ticket: WCN-4223

[linear-code]

WCN-4223

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[danielpeng1]

@claude

[github-actions]

Review

No Critical or blocking findings. The change is a dependency bump plus a small guard in the ECDSA recovery handler. I reviewed everything except package-lock.json, and did not run the tests or build.

Key safety: nothing in the diff logs, serializes, or transmits key material. The userKey guard in recoverEcdsaMPCv2Wallets runs before baseCoin.recover() and before the AWM call. The user and backup key roles are unchanged.

Notes (non-blocking):

1. recoveryEcdsa.ts:35 throws a plain Error for the missing userKey. If this is reachable from request input, it will probably surface as a 500 rather than the 422 ValidationError the repo uses for bad input. Consider ValidationError, or confirm the route codec already requires userKey so this is only a type-narrowing guard. The new test would then assert the error type as well as the message.
2. A recovery request without userKey that used to work will now be rejected. The SDK made the field optional, so this is a reasonable tightening, but it is a small behavior change. A line in the PR description or release notes would help.
3. The SDK now calls isSigner(address) on the wallet contract for both recovery keys, so recovery makes two extra Etherscan calls. Recovery will fail if those calls fail, which is the safe direction, but it is worth knowing for explorer rate limits and outages.
4. body-parser is now in both dependencies and overrides with the same range. That is fine, and the PR explains why (express 4.21.2 pins 1.20.3).
5. The 76 @bitgo-beta/* beta bumps and the lockfile regeneration are too large to review by hand. Please confirm that CI passes (tests, build, Trivy), and that sdk-core, statics and sdk-lib-mpc resolve to a single version in the lockfile. Duplicate copies of MPC libraries are a common source of subtle failures.
6. The .trivyignore addition (GHSA-8474-xrp6-wh69, a Ruby gem in js-xdr/Gemfile.lock) follows the existing entries and is justified.

Tests: the new nockEthWalletIsSigner helper is used in the EVM recovery tests, and the tests assert that the nocks are consumed. The new unit test covers the missing-userKey path. The tests that call nockEthWalletIsSigner without keeping the returned nocks (the async and split-AWM paths in recoveryWallet.test.ts) don't assert they are consumed. Those paths would pass even if the signer check were skipped. Optional to tighten.

🤖 Generated with Claude Code