Skip to content

TEST: Patch @metamask/utilsv8.0.0 with https://github.com/MetaMask/utils/pull/134 - #1705

Closed
legobeat wants to merge 7 commits into
MetaMask:mainfrom
legobeat:deps-metamask-utils-8-test-134
Closed

TEST: Patch @metamask/utilsv8.0.0 with https://github.com/MetaMask/utils/pull/134#1705
legobeat wants to merge 7 commits into
MetaMask:mainfrom
legobeat:deps-metamask-utils-8-test-134

Conversation

@legobeat

@legobeatlegobeat commented Aug 29, 2023

Copy link
Copy Markdown
Contributor

Compatibility-validation of MetaMask/utils#134

Based on #1700 + #1706

@socket-security

Copy link
Copy Markdown

Removed dependencies detected. Learn more about Socket for GitHub ↗︎

🚮 Removed packages:@metamask/utils@7.1.0

@legobeat
legobeatforce-pushed the deps-metamask-utils-8-test-134 branch from f3cebb6 to b9ab08eCompareAugust 29, 2023 23:32
@socket-security

socket-securityBot commented Aug 29, 2023

Copy link
Copy Markdown

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: @types/bn.js@5.1.1

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

    @legobeat

    Copy link
    Copy Markdown
    ContributorAuthor
    @SocketSecurity ignore @types/bn.js@5.1.1
    

    unmaintained ok

    @legobeat
    legobeatforce-pushed the deps-metamask-utils-8-test-134 branch 3 times, most recently from 8065ff7 to 083b98bCompareAugust 30, 2023 01:27
    @legobeat

    legobeat commented Aug 30, 2023

    Copy link
    Copy Markdown
    ContributorAuthor

    The one outstanding type error is actually in a dependency:

    Error: node_modules/@metamask/permission-controller/dist/rpc-methods/getPermissions.d.ts(4,89): error TS2344: Type 'undefined' does not satisfy the constraint 'JsonRpcParams'.
    

    @metamask/utils8.0.0 made undefined into not valid for JsonRpcParams.

    Corresponding PR for @metamask/permission-controller: MetaMask/core#1640

    @codecov

    codecovBot commented Aug 30, 2023

    Copy link
    Copy Markdown

    Codecov Report

    Patch coverage: 100.00% and no project coverage change.

    Comparison is base (a596bee) 95.87% compared to head (1d152c5) 95.87%.

    Additional details and impacted files
    @@ Coverage Diff @@## main #1705 +/- ##
    =======================================
    Coverage 95.87% 95.87% =======================================
    Files 239 239 Lines 5401 5401 Branches 836 836 =======================================
    Hits 5178 5178 Misses 223 223 
    Files ChangedCoverage Δ
    packages/snaps-utils/src/cronjob.ts100.00% <100.00%> (ø)

    ☔ View full report in Codecov by Sentry.
    📢 Have feedback on the report? Share it here.

    dependabotBotand others added 6 commits August 30, 2023 13:37
    Bumps [@metamask/utils](https://github.com/MetaMask/utils) from 7.1.0 to 8.0.0.
    - [Release notes](https://github.com/MetaMask/utils/releases)
    - [Changelog](https://github.com/MetaMask/utils/blob/main/CHANGELOG.md)
    - [Commits](MetaMask/utils@v7.1.0...v8.0.0)
    ---
    updated-dependencies:
    - dependency-name: "@metamask/utils"
    dependency-type: direct:production
    update-type: version-update:semver-major
    ...
    Signed-off-by: dependabot[bot] <support@github.com>
    @legobeat
    legobeatforce-pushed the deps-metamask-utils-8-test-134 branch from 74aeff3 to 1d152c5CompareAugust 30, 2023 04:37
    @legobeatlegobeat closed this Sep 6, 2023
    @legobeat
    legobeat deleted the deps-metamask-utils-8-test-134 branch September 6, 2023 15:39
    Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

    Labels

    None yet

    Projects

    None yet

    Development

    Successfully merging this pull request may close these issues.

    1 participant

    @legobeat