metamask-extension icon indicating copy to clipboard operation
metamask-extension copied to clipboard

Published 20 hours ago • verified publisher icon MetaMask

feat: updated mmi packages

Open albertolive opened this issue 9 months ago • 5 comments

Description

Updated MMI packges

Open in GitHub Codespaces

Related issues

Fixes:

Manual testing steps

  1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

  • [x] I’ve followed MetaMask Coding Standards.
  • [x] I've completed the PR template to the best of my ability
  • [x] I’ve included tests if applicable
  • [x] I’ve documented my code using JSDoc format if applicable
  • [ ] I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

  • [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

albertolive avatar May 15 '24 18:05 albertolive

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

github-actions[bot] avatar May 15 '24 18:05 github-actions[bot]

@metamaskbot update-policies

albertolive avatar May 15 '24 18:05 albertolive

Policies updated

metamaskbot avatar May 15 '24 18:05 metamaskbot

Builds ready [d4bebd7]
Page Load Metrics (763 ± 510 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint59159952411
domContentLoaded9321773
load5525937631062510
domInteractive9321773
Bundle size diffs
  • background: 0 Bytes (0.00%)
  • ui: 0 Bytes (0.00%)
  • common: 0 Bytes (0.00%)

metamaskbot avatar May 16 '24 09:05 metamaskbot

Builds ready [6854a8b]
Page Load Metrics (661 ± 436 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint56137912110
domContentLoaded83817115
load452256661908436
domInteractive83817115
Bundle size diffs
  • background: 0 Bytes (0.00%)
  • ui: 0 Bytes (0.00%)
  • common: 0 Bytes (0.00%)

metamaskbot avatar May 16 '24 11:05 metamaskbot

@metamaskbot update-policies

albertolive avatar May 21 '24 07:05 albertolive

Policies updated

metamaskbot avatar May 21 '24 07:05 metamaskbot

New dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@gar/[email protected] None 0 4.2 kB gar
npm/@npmcli/[email protected] filesystem 0 8.73 kB gar
npm/[email protected] None 0 8.18 kB iarna
npm/[email protected] None 0 14.3 kB lukekarrys
npm/[email protected] None 0 12.7 kB iarna
npm/[email protected] environment, filesystem, shell 0 17.2 kB lovell
npm/[email protected] None 0 43.2 kB gar
npm/[email protected] environment 0 3.44 kB iarna
npm/[email protected] filesystem 0 10.8 kB isaacs
npm/[email protected] filesystem 0 4.29 kB isaacs
npm/[email protected] filesystem, network 0 199 kB tomas
npm/[email protected] environment, filesystem +7 400 kB nicolasnoble
npm/[email protected] filesystem 0 9.74 kB isaacs
npm/[email protected] None +1 144 kB isaacs
npm/[email protected] None +2 80.4 kB iarna
npm/[email protected] None 0 3.06 kB sindresorhus
npm/[email protected] environment, shell 0 4.89 kB isaacs
npm/[email protected] None 0 55 kB isaacs
npm/[email protected] None 0 4.47 kB iarna

View full report↗︎

socket-security[bot] avatar May 21 '24 07:05 socket-security[bot]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package Note
Shell access npm/[email protected]
Deprecated npm/[email protected]
  • Reason: This package is no longer supported.
Deprecated npm/[email protected]
  • Reason: This package is no longer supported.
Deprecated npm/[email protected]
  • Reason: This package is no longer supported.
Deprecated npm/[email protected]
  • Reason: This package is no longer supported.
Shell access npm/[email protected]
Deprecated npm/@npmcli/[email protected]
  • Reason: This functionality has been moved to @npmcli/fs
Deprecated npm/[email protected]
  • Reason: This package is no longer supported.
New author npm/[email protected]
Deprecated npm/[email protected]
  • Reason: This package is no longer supported.
Network access npm/[email protected]
Network access npm/[email protected]
Deprecated npm/[email protected]
  • Reason: Please upgrade to @mapbox/node-pre-gyp: the non-scoped node-pre-gyp package is deprecated and only the @mapbox scoped package will recieve updates in the future
New author npm/[email protected]

View full report↗︎

Next steps

What is shell access?

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

What is a deprecated package?

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution.

What is new author?

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

socket-security[bot] avatar May 21 '24 07:05 socket-security[bot]

Builds ready [d97df1d]
Page Load Metrics (773 ± 516 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint66169972813
domContentLoaded95318136
load5326787731075516
domInteractive95318136
Bundle size diffs
  • background: 0 Bytes (0.00%)
  • ui: 0 Bytes (0.00%)
  • common: 0 Bytes (0.00%)

metamaskbot avatar May 21 '24 09:05 metamaskbot

@metamaskbot update-policies

albertolive avatar May 22 '24 05:05 albertolive

No policy changes

metamaskbot avatar May 22 '24 05:05 metamaskbot

Builds ready [caab360]
Page Load Metrics (1369 ± 568 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint714341227737
domContentLoaded10351584
load58280413691184568
domInteractive10351584
Bundle size diffs
  • background: 0 Bytes (0.00%)
  • ui: 0 Bytes (0.00%)
  • common: 0 Bytes (0.00%)

metamaskbot avatar May 22 '24 08:05 metamaskbot

@metamaskbot update-policies

zone-live avatar May 22 '24 09:05 zone-live

Policies updated

metamaskbot avatar May 22 '24 09:05 metamaskbot

Builds ready [510d049]
Page Load Metrics (913 ± 499 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint71147982612
domContentLoaded9401373
load5924579131040499
domInteractive9401373
Bundle size diffs
  • background: 0 Bytes (0.00%)
  • ui: 0 Bytes (0.00%)
  • common: 0 Bytes (0.00%)

metamaskbot avatar May 22 '24 10:05 metamaskbot