ethjs is discontinued and contains security vulnerabilities

[nikolockenvitz]

ethjs libraries are used in this repo but they are discontinued (see this and this comment).

Even if PRs are still accepted packages would also need to be relased to use these updates. As you can see in this PR they still depend on vulnerable versions of other packages and as they specified the version exactly, it's hard to update to the fixed version.

IMO they should be replaced. Is that already planned or are you working on that already / how is the progress/timeline?

This also affects other repos, e.g. ethr-did

[mirceanis]

Thank you for spotting this.
We are aware of the deprecation and had already started moving to the ethers.js backbone for ETH operations.
The update will have to happen first in ethr-did since that is the principal dependent, and a small correction needs to be done in DAF after that to adapt to the new API.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.