16.0.0 #304

github-actions · 2023-11-22T13:29:40Z

This is the release candidate for version 16.0.0.

Blocked by

Blocking

fix(deps): readable-stream@3 metamask-extension#21934

socket-security · 2023-11-22T13:31:49Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
@metamask/keyring-api	2.0.0	network	`+93`	26 MB	metamaskbot

🚮 Removed packages: @metamask/eth-keyring-controller@15.1.0

* Prefer cached `encryptionKey` for encryption when possible (#307) * fix: prefer encryptionKey for encryption when possible * refactor: add test case * Use encryptor `isVaultUpdated` (#310) * chore: update browser-passworder * refactor: remove `updateVault` from `GenericEncryptor`

Gudahtt

This requires an update now that #310 is merged

* 15.1.0 * edit changelog entries * rephrase changelog entry --------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: Michele Esposito <michele@esposito.codes>

* origin/main: Use encryptor `isVaultUpdated` (#310) Bump @metamask/browser-passworder from 4.2.0 to 4.3.0 (#311) Prefer cached `encryptionKey` for encryption when possible (#307) Bump @metamask/obs-store from 8.1.0 to 9.0.0 (#306) Bump @metamask/eth-sig-util from 7.0.0 to 7.0.1 (#302)

legobeat · 2023-11-29T23:22:05Z

This requires an update now that #310 is merged

Might as well get in #314 as well before merging this.

UPDATE: Rebased on top of #314

socket-security · 2024-01-11T02:55:31Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Issue	Package	Version	Note	Source
Network access	@metamask/snaps-sdk	1.3.2	Module: globalThis["fetch"] Location: dist/cjs/images.js +3 more instances...	@metamask/keyring-api@2.0.0 via `package.json`
Network access	@metamask/snaps-utils	5.1.2	Module: globalThis["fetch"] Location: dist/cjs/base64.js +1 more instances...	@metamask/keyring-api@2.0.0 via `package.json`
Shell access	@metamask/snaps-utils	5.1.2	Module: child_process Location: dist/cjs/eval.js +1 more instances...	@metamask/keyring-api@2.0.0 via `package.json`
No README	@spruceid/siwe-parser	1.1.3	Location: Package overview	@metamask/keyring-api@2.0.0 via `package.json`
Shell access	@metamask/snaps-controllers	3.6.0	Module: child_process Location: dist/cjs/services/node/NodeProcessExecutionService.js +1 more instances...	@metamask/keyring-api@2.0.0 via `package.json`

Ignoring: setimmediate@1.0.5, bs58@4.0.1, ripemd160@2.0.2, validate-npm-package-name@5.0.0, md5.js@1.3.5, @metamask/eth-query@4.0.0, rlp@2.2.7, extension-port-stream@3.0.0, browserify-zlib@0.2.0

Next steps

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

What is shell access?

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Why are READMEs important?

Package does not have a README. This may indicate a failed publish or a low quality package.

Add a README to to the package and publish a new version.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore @spruceid/siwe-parser@1.1.3
@SocketSecurity ignore @metamask/snaps-controllers@3.6.0
@SocketSecurity ignore @metamask/snaps-utils@5.1.2
@SocketSecurity ignore @metamask/snaps-sdk@1.3.2

legobeat · 2024-01-11T12:09:58Z

@SocketSecurity ignore setimmediate@1.0.5
@SocketSecurity ignore bs58@4.0.1
@SocketSecurity ignore ripemd160@2.0.2
@SocketSecurity ignore validate-npm-package-name@5.0.0
@SocketSecurity ignore md5.js@1.3.5
@SocketSecurity ignore rlp@2.2.7
@SocketSecurity ignore extension-port-stream@3.0.0
@SocketSecurity ignore browserify-zlib@0.2.0

New authors OK

(It's not clear to me why any of these are being flagged in this PR and not in the most recent merged ones)

legobeat · 2024-01-11T12:11:29Z

@SocketSecurity ignore @metamask/eth-query@4.0.0

new author ok

legobeat mentioned this pull request Nov 22, 2023

deps: @metamask/obs-store@^8.1.0->^9.0.0 #303

Closed

3 tasks

This was referenced Nov 22, 2023

fix(deps): readable-stream@3 MetaMask/metamask-extension#21934

Merged

Bump @metamask/obs-store from 8.1.0 to 9.0.0 #306

Merged

legobeat temporarily deployed to github-pages November 23, 2023 06:49 — with GitHub Actions Inactive

legobeat temporarily deployed to github-pages November 23, 2023 06:52 — with GitHub Actions Inactive

legobeat marked this pull request as ready for review November 23, 2023 06:52

legobeat requested a review from a team as a code owner November 23, 2023 06:52

legobeat requested review from FrederikBolding and a team November 23, 2023 06:53

mikesposito mentioned this pull request Nov 23, 2023

15.0.1 #308

Closed

github-actions and others added 3 commits November 24, 2023 12:14

16.0.0

edf7afc

update changelog

3005067

docs: add entry for #307

4d8636f

mikesposito force-pushed the release/16.0.0 branch from 84e424e to 4d8636f Compare November 24, 2023 11:17

mikesposito temporarily deployed to github-pages November 24, 2023 11:17 — with GitHub Actions Inactive

mikesposito requested a review from Gudahtt November 24, 2023 11:18

mikesposito mentioned this pull request Nov 28, 2023

Bump keyring-controller and browser-passworder MetaMask/metamask-extension#21878

Merged

13 tasks

NicholasEllul previously approved these changes Nov 29, 2023

View reviewed changes

Gudahtt reviewed Nov 29, 2023

View reviewed changes

github-actions bot and others added 2 commits November 29, 2023 19:16

15.1.0 (#313)

a96d4e5

* 15.1.0 * edit changelog entries * rephrase changelog entry --------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: Michele Esposito <michele@esposito.codes>

legobeat dismissed NicholasEllul’s stale review via c18294b November 30, 2023 04:18

legobeat temporarily deployed to github-pages November 30, 2023 04:18 — with GitHub Actions Inactive

legobeat added 2 commits November 30, 2023 13:19

Merge branch 'main' into release/16.0.0

cbdd967

add changelog entries for #310 and #311

4d50ab7

legobeat force-pushed the release/16.0.0 branch from c18294b to 4d50ab7 Compare November 30, 2023 04:19

legobeat temporarily deployed to github-pages November 30, 2023 04:20 — with GitHub Actions Inactive

legobeat requested a review from Gudahtt November 30, 2023 04:20

legobeat mentioned this pull request Jan 6, 2024

feat!: create new vault with any keyring #329

Merged

3 tasks

Merge branch main into release/16.0.0

d50e367

legobeat temporarily deployed to github-pages January 11, 2024 02:51 — with GitHub Actions Inactive

legobeat requested review from gantunesr, mikesposito and danroc January 11, 2024 11:11

This comment was marked as resolved.

Sign in to view

legobeat requested a review from a team January 11, 2024 16:32

gantunesr approved these changes Jan 12, 2024

View reviewed changes

legobeat merged commit af5baf1 into main Jan 12, 2024
18 of 19 checks passed

legobeat deleted the release/16.0.0 branch January 12, 2024 18:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

16.0.0 #304

16.0.0 #304

github-actions bot commented Nov 22, 2023 •

edited by legobeat

Loading

socket-security bot commented Nov 22, 2023 •

edited

Loading

Gudahtt left a comment

legobeat commented Nov 29, 2023 •

edited

Loading

socket-security bot commented Jan 11, 2024 •

edited

Loading

legobeat commented Jan 11, 2024

This comment was marked as resolved.

legobeat commented Jan 11, 2024 •

edited

Loading

16.0.0 #304

16.0.0 #304

Conversation

github-actions bot commented Nov 22, 2023 • edited by legobeat Loading

Blocked by

Blocking

socket-security bot commented Nov 22, 2023 • edited Loading

Gudahtt left a comment

Choose a reason for hiding this comment

legobeat commented Nov 29, 2023 • edited Loading

socket-security bot commented Jan 11, 2024 • edited Loading

Next steps

legobeat commented Jan 11, 2024

This comment was marked as resolved.

legobeat commented Jan 11, 2024 • edited Loading

github-actions bot commented Nov 22, 2023 •

edited by legobeat

Loading

socket-security bot commented Nov 22, 2023 •

edited

Loading

legobeat commented Nov 29, 2023 •

edited

Loading

socket-security bot commented Jan 11, 2024 •

edited

Loading

legobeat commented Jan 11, 2024 •

edited

Loading