Synchronize with module template (Feb 2024) #104
Conversation
|
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again.
Next stepsWhat is new author?A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package. Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. What is shell access?This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code. Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. What is network access?This module accesses the network. Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. What is an install script?Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts. Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. What is a deprecated package?The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed. Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
mcmire
force-pushed
the
standardize-february-2024
branch
from
2fa2e9c
to
3ddd241
Compare
- **BREAKING:** Drop support for Node 16; use Node 18 as minimum version
- Use Node LTS for development rather than 18
- Use `tsup` to generate ESM-compatible builds (configuration copied
from the module template)
- Upgrade Yarn from v2 to v3.2.1
- Add Yarn constraints
- Replace ESLint config file with module template version
- Doing so re-enabled the `id-denylist` rule; this PR fixes any lint
associated violations
- Bump `prettier-plugin-packagejson` from ^2.2.17 to ^2.3.0
- Bump Jest from v26 to v28
- Add `jest-it-up` and run it after running tests
- Use Babel for Jest coverage reports instead of v8
- This ended up dropping the coverage thresholds
- Add `typedoc`
- Add `auto-changelog` and validate changelogs as a part of linting
- Bump `@metamask/utils` to ^8.3.0
- This forced a bump to the following packages in order to align JSON
types:
- Bump `@metamask/json-rpc-engine` from ^7.1.1 to ^7.3.2
- Bump `@metamask/eth-json-rpc-provider` from ^2.1.0 to ^2.3.2
- Add configuration for Dependabot
- Add pull request template
- Upgrade GitHub workflows
- Upgrade `actions/checkout` from v2 to v3
- Upgrade `actions/setup-node` from v2 to v3
- Upgrade `MetaMask/action-create-release-pr` from v1 to v3
- Publish package to NPM
- Publish API documentation for release candidates and releases
- Notify metamask-npm-publishers of new releases in Slack
mcmire
force-pushed
the
standardize-february-2024
branch
from
3ddd241
to
4179206
Compare
|
This is a lot of changes in one, some breaking, some subtle. In order to unblock some things, I started out by breaking out some things that are not directly related to the upgrading of package managers and change in build system: I think especially this part is relevant to be broken out next and separately from the tooling- and other meta changes: |
tsupto generate ESM-compatible builds (configuration copied from the module template)id-denylistrule; this PR fixes any lint associated violationsprettier-plugin-packagejsonfrom ^2.2.17 to ^2.3.0jest-it-upand run it after running teststypedocauto-changelogand validate changelogs as a part of linting@metamask/utilsto ^8.3.0@metamask/json-rpc-enginefrom ^7.1.1 to ^7.3.2@metamask/eth-json-rpc-providerfrom ^2.1.0 to ^2.3.2actions/checkoutfrom v2 to v3actions/setup-nodefrom v2 to v3MetaMask/action-create-release-prfrom v1 to v3