deps: Update @metamask/post-message-stream and dependents#21651
deps: Update @metamask/post-message-stream and dependents#21651brad-decker merged 4 commits intodevelopfrom
Conversation
|
@metamaskbot update-policies |
|
Policies updated |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## develop #21651 +/- ##
========================================
Coverage 68.61% 68.61%
========================================
Files 1045 1045
Lines 41611 41611
Branches 11111 11111
========================================
Hits 28550 28550
Misses 13061 13061 ☔ View full report in Codecov by Sentry. |
Builds ready [e1ea736]
Page Load Metrics (1400 ± 268 ms)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
|
Note that |
|
@legobeat should that block this? |
I have not looked deeply enough into precisely how the stream API is used extension to say for sure. Someone who is more familiar might be able to say "this is fine anyway". Behavioral changes in differences are summarized here FWIW. This may or may not be relevant for usage here. Keeping them aligned should be safer and preferred, in any case. |
|
I am fairly confident that the two places we directly import this dependency in the extension are not affected by the breaking changes, the main one that I think could affect it is the upgrade of readable-stream. However, The phishing page is under E2E test so I feel confident that this isn't breaking due to a mismatch here. I do think we should prioritize the upgrade of the phishing-controller dependency. Ill wait for others to chime in on this and add the do-not-merge flag until a decision is reached. |
Mrtenz
left a comment
There was a problem hiding this comment.
Looks good to me, but I don't know if this would affect @metamask/phishing-warning in some way.
|
@metamaskbot update-policies |
9870a64 to
e5b72d9
Compare
|
@metamaskbot update-policies |
|
Updated dependencies detected. Learn more about Socket for GitHub ↗︎
|
|
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again.
Next stepsWhat are unpublished packages?Package version was not found on the registry. It may exist on a different registry and need to be configured to pull from that registry. Packages can be removed from the registry by manually un-publishing, a security issue removal, or may simply never have been published to the registry. Reliance on these packages will cause problem when they are not found. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
|
Policies updated |
|
Policies updated |
|
@SocketSecurity ignore @metamask/phishing-warning@3.0.0 |
Builds ready [b077452]
Page Load Metrics (578 ± 264 ms)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
Description
@metamask/post-message-streamto 7.0.0@metamask/phishin-warningto 3.0.0 (which eliminates dependencies on post-message-stream 6.2.0)Related issues
Fixes: #21653
Manual testing steps
Screenshots/Recordings
Before
After
Pre-merge author checklist
Pre-merge reviewer checklist