Skip to content

BREAKING: deps: eth-block-tracker@^6.1.0->^7.1.0; Nodejs min v16#105

Merged
legobeat merged 3 commits intoMetaMask:mainfrom
legobeat:deps-eth-block-tracker-7
Aug 3, 2023
Merged

BREAKING: deps: eth-block-tracker@^6.1.0->^7.1.0; Nodejs min v16#105
legobeat merged 3 commits intoMetaMask:mainfrom
legobeat:deps-eth-block-tracker-7

Conversation

@legobeat
Copy link
Copy Markdown
Contributor

@legobeat legobeat commented Jul 20, 2023 •
edited
Loading

No description provided.

@legobeat legobeat added the dependencies Pull requests that update a dependency file label Jul 20, 2023
@socket-security
Copy link
Copy Markdown

socket-security bot commented Jul 20, 2023 •
edited
Loading

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives Size Publisher
eth-block-tracker 6.1.0...7.1.0 network +15/-1 3.82 MB gudahtt

@socket-security
Copy link
Copy Markdown

socket-security bot commented Jul 20, 2023 •
edited
Loading

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: @metamask/safe-event-emitter@3.0.0, @ethereumjs/common@3.2.0, @metamask/eth-json-rpc-provider@1.0.0, micro-ftch@0.3.1, crc-32@1.2.2, @scure/base@1.1.1

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

@legobeat
Copy link
Copy Markdown
Contributor Author

legobeat commented Jul 20, 2023 

@SocketSecurity ignore @metamask/safe-event-emitter@3.0.0
@SocketSecurity ignore @ethereumjs/common@3.2.0
@SocketSecurity ignore @metamask/eth-json-rpc-provider@1.0.0
@SocketSecurity ignore @metamask/utils@5.0.2
@SocketSecurity ignore superstruct@1.0.3
@SocketSecurity ignore micro-ftch@0.3.1
@SocketSecurity ignore @types/ms@0.7.31
@SocketSecurity ignore crc-32@1.2.2
@SocketSecurity ignore @scure/base@1.1.1
@SocketSecurity ignore eth-rpc-errors@4.0.3
@SocketSecurity ignore json-rpc-engine@6.1.0
@SocketSecurity ignore fast-safe-stringify@2.1.1

@legobeat legobeat changed the title BREAKING: deps: eth-block-tracker@^5.0.1->^6.1.0; Nodejs min v14 BREAKING: deps: eth-block-tracker@^6.1.0->^7.1.0; Nodejs min v16 Jul 20, 2023
@legobeat legobeat force-pushed the deps-eth-block-tracker-7 branch from 0a8edfc to 524f630 Compare July 20, 2023 23:32
@legobeat legobeat force-pushed the deps-eth-block-tracker-7 branch from 4d2e2c1 to 18f457b Compare July 25, 2023 15:17
@legobeat legobeat marked this pull request as ready for review July 25, 2023 15:55
@legobeat legobeat requested a review from a team as a code owner July 25, 2023 15:55
@legobeat legobeat marked this pull request as draft July 25, 2023 15:57
@legobeat legobeat marked this pull request as ready for review July 25, 2023 15:58
mcmire
mcmire approved these changes Jul 25, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@mcmire mcmire left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense!

package.json
"main": "dist/index.js",
"engines": {
"node": "^14 || ^16 || >=18"
"node": "^16.20.1 || ^18.16.1 || >=20"
Copy link
Copy Markdown
Contributor

@mcmire mcmire Jul 25, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we plan on making this version match the module template eventually? (I know this package is out of date and it seems you are progressively updating it, so no worries, just curious at what stage we are at here or what your thoughts are)

Copy link
Copy Markdown
Contributor Author

@legobeat legobeat Jul 25, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if there will ever be a single version range that can be expected to be applicable to all packages? Something like what we have here seems reasonable at this point in time for a package like this: 16 is still widely used, 18 is LTS, 20 is current. Only the latest odd version, if any.

As for the subversions for 16 and 18: Hesitated briefly here between what's here (require latest patches, allow depending on newer features and hey it's breaking engines anyway) and a more conservative >=16, which could make it smoother for maintainers of any downstreams maintaining full 16.x support. That trade-off seemed worth it here.

@legobeat legobeat merged commit 6de9f74 into MetaMask:main Aug 3, 2023
@legobeat legobeat deleted the deps-eth-block-tracker-7 branch August 3, 2023 23:27
@legobeat legobeat mentioned this pull request Aug 3, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mcmire mcmire mcmire approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@legobeat @mcmire