Skip to content
This repository was archived by the owner on Oct 7, 2024. It is now read-only.

Bump @metamask/eth-sig-util from 6.0.0 to 6.0.1 - #268

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/metamask/eth-sig-util-6.0.1
Closed

Bump @metamask/eth-sig-util from 6.0.0 to 6.0.1#268
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/metamask/eth-sig-util-6.0.1

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubSep 12, 2023

Copy link
Copy Markdown
Contributor

Bumps @metamask/eth-sig-util from 6.0.0 to 6.0.1.

Release notes

Sourced from @​metamask/eth-sig-util's releases.

6.0.1

Changed

  • Swap out legacy ethereumjs-abi for @metamask/abi-utils (#319)

Fixed

  • Bump ethereum-cryptography from ^2.0.0 to ^2.1.2 (#302)
  • Bump ethereumjs/util from ^8.0.6 to ^8.1.0 (#302)
  • Remove unused dependency bn.js (#334) (#302)
Changelog

Sourced from @​metamask/eth-sig-util's changelog.

[6.0.1]

Changed

  • Swap out legacy ethereumjs-abi for @metamask/abi-utils (#319)

Fixed

  • Bump ethereum-cryptography from ^2.0.0 to ^2.1.2 (#302)
  • Bump ethereumjs/util from ^8.0.6 to ^8.1.0 (#302)
  • Remove unused dependency bn.js (#334) (#302)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
dependabotBot requested a review from a team as a code ownerSeptember 12, 2023 06:42
@dependabotdependabotBot added the type-dependencies Pull requests that update a dependency file label Sep 12, 2023
@socket-security

Copy link
Copy Markdown

New dependencies detected. Learn more about Socket for GitHub ↗︎

PackagesVersionNew capabilitiesTransitivesSizePublisher
@metamask/utils3.6.0None+3435 kBmetamaskbot

@socket-security

socket-securityBot commented Sep 12, 2023

Copy link
Copy Markdown

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: @types/ms@0.7.31

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

    @dependabot
    dependabotBotforce-pushed the dependabot/npm_and_yarn/main/metamask/eth-sig-util-6.0.1 branch from 23cd63c to 11bec71CompareSeptember 12, 2023 08:57
    @legobeat

    Copy link
    Copy Markdown
    Contributor
    @SocketSecurity ignore @types/ms@0.7.31
    

    unmaintained ok

    Bumps [@metamask/eth-sig-util](https://github.com/MetaMask/eth-sig-util) from 6.0.0 to 6.0.1.
    - [Release notes](https://github.com/MetaMask/eth-sig-util/releases)
    - [Changelog](https://github.com/MetaMask/eth-sig-util/blob/main/CHANGELOG.md)
    - [Commits](MetaMask/eth-sig-util@v6.0.0...v6.0.1)
    ---
    updated-dependencies:
    - dependency-name: "@metamask/eth-sig-util"
    dependency-type: direct:production
    update-type: version-update:semver-patch
    ...
    Signed-off-by: dependabot[bot] <support@github.com>
    @dependabot
    dependabotBotforce-pushed the dependabot/npm_and_yarn/main/metamask/eth-sig-util-6.0.1 branch from 11bec71 to 649e190CompareSeptember 12, 2023 11:04
    @dependabot@github

    dependabotBot commented on behalf of githubSep 13, 2023

    Copy link
    Copy Markdown
    ContributorAuthor

    Superseded by #269.

    @dependabotdependabotBot closed this Sep 13, 2023
    @dependabot
    dependabotBot deleted the dependabot/npm_and_yarn/main/metamask/eth-sig-util-6.0.1 branch September 13, 2023 06:20
    Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

    Labels

    type-dependenciesPull requests that update a dependency file

    Projects

    None yet

    Development

    Successfully merging this pull request may close these issues.

    1 participant

    @legobeat