Update repository to match module template (February 2024) #296

Mrtenz · 2024-02-26T11:10:57Z

This updates the repository to match the module template as of February 2024. This repo hasn't been updated in a while, so there's quite a few changes. The most notable changes are:

The GitHub workflows were updated to use the latest versions of the publishing actions, including a Slack message for publishing.
Some actions now only run on the .nvmrc Node versions, to reduce the number of jobs.
The Yarn allow-scripts plugin was updated, and the constraints plugin was added.
The package is now built with tsup, and includes a ESM build.

socket-security · 2024-02-26T11:11:35Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@esbuild/[email protected]	None	`0`	11.5 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.83 MB	evanw
npm/@esbuild/[email protected]	None	`0`	11.5 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.76 MB	evanw
npm/@esbuild/[email protected]	None	`0`	10.2 MB	evanw
npm/@esbuild/[email protected]	None	`0`	8.85 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.61 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.18 MB	evanw
npm/@esbuild/[email protected]	None	`0`	8.85 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.14 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.37 MB	evanw
npm/@esbuild/[email protected]	None	`0`	10.4 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.18 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.11 MB	evanw
npm/@esbuild/[email protected]	None	`0`	10 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.6 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.59 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.62 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.59 MB	evanw
npm/@esbuild/[email protected]	None	`0`	8.98 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.45 MB	evanw
npm/@esbuild/[email protected]	None	`0`	9.81 MB	evanw
npm/@isaacs/[email protected]	None	`+11`	247 kB	isaacs
npm/@lavamoat/[email protected]	filesystem Transitive: environment	`+6`	249 kB	naugtur
npm/@lavamoat/[email protected]	environment, filesystem, shell Transitive: network	`+123`	7.72 MB	boneskull
npm/@lavamoat/[email protected]	None	`0`	3.25 kB	naugtur
npm/@metamask/[email protected]	Transitive: environment, eval, filesystem, network, shell, unsafe	`+444`	125 MB	metamaskbot
npm/@metamask/[email protected]	Transitive: environment, eval, filesystem, network, shell, unsafe	`+184`	31.3 MB	metamaskbot
npm/@metamask/[email protected]	Transitive: environment, eval, filesystem, network, shell, unsafe	`+206`	104 MB	metamaskbot
npm/@metamask/[email protected]	Transitive: environment, eval, filesystem, network, shell, unsafe	`+175`	29.6 MB	metamaskbot
npm/@npmcli/[email protected]	environment, network	`+11`	1.15 MB	npm-cli-ops
npm/@npmcli/[email protected]	filesystem	`+2`	136 kB	lukekarrys
npm/@npmcli/[email protected]	filesystem Transitive: environment, shell	`+18`	804 kB	npm-cli-ops
npm/@npmcli/[email protected]	filesystem Transitive: environment, shell	`+56`	3.43 MB	npm-cli-ops
npm/@npmcli/[email protected]	environment, shell Transitive: filesystem	`+2`	62.5 kB	npm-cli-ops
npm/@npmcli/[email protected]	environment Transitive: filesystem, network, shell	`+105`	6.86 MB	npm-cli-ops
npm/@pkgjs/[email protected]	None	`0`	74.2 kB	oss-bot
npm/[email protected]	None	`0`	4.83 kB	lukekarrys
npm/[email protected]	network Transitive: environment, eval	`+3`	80.4 kB	fengmk2
npm/[email protected]	None	`0`	5.67 kB	qix
npm/[email protected]	None	`0`	22.2 kB	kevinbeaty
npm/[email protected]	filesystem	`+6`	142 kB	npm-cli-ops
npm/[email protected]	None	`+2`	114 kB	juliangruber
npm/[email protected]	environment, filesystem, unsafe Transitive: network, shell	`+24`	213 MB	egoist
npm/[email protected]	None	`0`	81.8 kB	egoist
npm/[email protected]	filesystem Transitive: environment, shell	`+51`	3.53 MB	npm-cli-ops
npm/[email protected]	environment, filesystem	`+14`	531 kB	paulmillr
npm/[email protected]	environment, filesystem, network	`+1`	57.5 kB	tootallnate
npm/[email protected]	None	`0`	13.6 kB	komagata
npm/[email protected]	None	`0`	97.9 kB	google-wombot
npm/[email protected]	environment, filesystem, network, shell	`+22`	213 MB	evanw
npm/[email protected]	Transitive: environment, eval, filesystem, shell, unsafe	`+93`	11.4 MB	mysticatea
npm/[email protected]	filesystem Transitive: environment, eval, shell, unsafe	`+105`	12.5 MB	weiran.zsd
npm/[email protected]	Transitive: environment, eval, filesystem, shell, unsafe	`+90`	10.7 MB	eslint-community-bot
npm/[email protected]	Transitive: environment, eval, filesystem, shell, unsafe	`+91`	11 MB	mysticatea
npm/[email protected]	shell Transitive: environment, filesystem	`+6`	112 kB	isaacs
npm/[email protected]	filesystem	`+1`	299 kB	npm-cli-ops
npm/[email protected]	Transitive: environment, filesystem, shell	`+27`	2.86 MB	isaacs
npm/[email protected]	None	`0`	3.02 kB	tarruda
npm/[email protected]	None	`+1`	485 kB	npm-cli-ops
npm/[email protected]	environment	`+13`	574 kB	isaacs
npm/[email protected]	environment, filesystem	`0`	14 kB	egoist
npm/[email protected]	filesystem	`0`	17.7 kB	antonk52
npm/[email protected]	None	`0`	17.1 kB	egoist
npm/[email protected]	None	`0`	75.8 kB	jdalton
npm/[email protected]	None	`0`	458 kB	isaacs
npm/[email protected]	network Transitive: environment, filesystem, shell	`+73`	4.62 MB	npm-cli-ops
npm/[email protected]	None	`+1`	290 kB	isaacs
npm/[email protected]	environment, network	`+5`	522 kB	npm-cli-ops
npm/[email protected]	None	`0`	285 kB	isaacs
npm/[email protected]	filesystem, network, shell	`+4`	52 kB	jongleberry
npm/[email protected]	environment, shell Transitive: filesystem, network	`+82`	6.5 MB	lukekarrys
npm/[email protected]	None	`+1`	31 kB	npm-cli-ops
npm/[email protected]	None	`+12`	763 kB	npm-cli-ops
npm/[email protected]	None	`+2`	116 kB	npm-cli-ops
npm/[email protected]	None	`+7`	630 kB	npm-cli-ops
npm/[email protected]	None	`+10`	657 kB	npm-cli-ops
npm/[email protected]	None	`0`	5.49 kB	sindresorhus
npm/[email protected]	filesystem	`+2`	1.27 MB	isaacs
npm/[email protected]	environment, unsafe Transitive: filesystem	`+25`	73.6 MB	ai
npm/[email protected]	None	`0`	5.21 kB	lukekarrys
npm/[email protected]	environment, filesystem	`+1`	2.43 MB	lukastaegert
npm/[email protected]	network	`+6`	589 kB	tootallnate
npm/[email protected]	None	`+3`	51.4 kB	kemitchell
npm/[email protected]	None	`+1`	323 kB	npm-cli-ops
npm/[email protected]	Transitive: environment, filesystem, network, shell, unsafe	`+42`	4.59 MB	alangpierce
npm/[email protected]	None	`+2`	36.7 kB	dead_horse
npm/[email protected]	None	`+1`	30.1 kB	dead_horse
npm/[email protected]	shell	`0`	7.82 kB	wmhilton
npm/[email protected]	None	`0`	68 kB	dsagal2
npm/[email protected]	environment, eval, filesystem Transitive: network, shell, unsafe	`+144`	296 MB	egoist
npm/[email protected]	None	`+2`	17.9 kB	lukekarrys
npm/[email protected]	None	`+1`	14.5 kB	lukekarrys
npm/[email protected]	None	`+4`	68 kB	kemitchell
npm/[email protected]	None	`+3`	122 kB	lukekarrys
npm/[email protected]	environment Transitive: filesystem	`+1`	50.5 kB	npm-cli-ops

View full report↗︎

socket-security · 2024-02-26T11:11:38Z

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/@lavamoat/[email protected], npm/@npmcli/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

Mrtenz · 2024-02-26T11:34:16Z

@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/@npmcli/[email protected]
@SocketSecurity ignore npm/[email protected]

Network access is ok. Not used in production.

@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]

New authors seem ok.

@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]

Shell access ok. Not used in production.

@SocketSecurity ignore npm/[email protected]

Network / shell access is expected.

@SocketSecurity ignore npm/[email protected]

Deprecated is ok. Shouldn't be an issue in our case.

@SocketSecurity ignore npm/@lavamoat/[email protected]

Script is expected.

FrederikBolding · 2024-02-26T11:37:10Z

.github/CODEOWNERS

@@ -1,4 +1,4 @@
 # Lines starting with '#' are comments.
 # Each line is a file pattern followed by one or more owners.

-*                                    @MetaMask/devs
+*                                    @MetaMask/engineering


GitHub seems to think this doesn't exist. Does the group need to be added manually to the repo or something?

Yeah. I already asked @Gudahtt to do so.

FrederikBolding

LGTM once the CODEOWNERS change has been resolved

Mrtenz added 4 commits February 26, 2024 11:57

Update repository to match module template (February 2024)

87b6f79

Fix lint errors

7ae678c

Remove examples section from pull request template

91b1ca7

Restore support for Node.js 16

c506812

Mrtenz requested a review from a team as a code owner February 26, 2024 11:10

Mrtenz added 2 commits February 26, 2024 12:18

Fix build

ccc8a52

Add sideEffects: false to package.json

c78ccaf

FrederikBolding reviewed Feb 26, 2024

View reviewed changes

FrederikBolding approved these changes Feb 28, 2024

View reviewed changes

Mrtenz merged commit 361d754 into main Feb 28, 2024
16 checks passed

Mrtenz deleted the mrtenz/standardise-february-2024 branch February 28, 2024 14:41

Mrtenz mentioned this pull request Feb 28, 2024

Add StreamProvider to package exports #303

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update repository to match module template (February 2024) #296

Update repository to match module template (February 2024) #296

Mrtenz commented Feb 26, 2024

socket-security bot commented Feb 26, 2024 •

edited

Loading

socket-security bot commented Feb 26, 2024 •

edited

Loading

Mrtenz commented Feb 26, 2024

FrederikBolding Feb 26, 2024

Mrtenz Feb 26, 2024

FrederikBolding left a comment

Update repository to match module template (February 2024) #296

Update repository to match module template (February 2024) #296

Conversation

Mrtenz commented Feb 26, 2024

socket-security bot commented Feb 26, 2024 • edited Loading

socket-security bot commented Feb 26, 2024 • edited Loading

Next steps

Mrtenz commented Feb 26, 2024

FrederikBolding Feb 26, 2024

Choose a reason for hiding this comment

Mrtenz Feb 26, 2024

Choose a reason for hiding this comment

FrederikBolding left a comment

Choose a reason for hiding this comment

socket-security bot commented Feb 26, 2024 •

edited

Loading

socket-security bot commented Feb 26, 2024 •

edited

Loading