Skip to content

Bump LavaMoat and SES#22590

Merged
FrederikBolding merged 3 commits intodevelopfrom
fb/bump-lavamoat
Jan 18, 2024
Merged

Bump LavaMoat and SES#22590
FrederikBolding merged 3 commits intodevelopfrom
fb/bump-lavamoat

Conversation

@FrederikBolding
Copy link
Copy Markdown
Member

@FrederikBolding FrederikBolding commented Jan 18, 2024 •
edited
Loading

Description

Bumps LavaMoat and SES to fix an issue with lockdown failing on Chrome Canary, making the extension unable to boot.

This PR also re-applies a patch to lavamoat-core and deletes an outdated patch to @lavamoat/lavapack that is not required anymore since lavapack now defaults to relative paths.

@FrederikBolding
Copy link
Copy Markdown
Member Author

FrederikBolding commented Jan 18, 2024

@metamaskbot update-policies

@metamaskbot metamaskbot added the INVALID-PR-TEMPLATE PR's body doesn't match template label Jan 18, 2024
@socket-security
Copy link
Copy Markdown

socket-security bot commented Jan 18, 2024 •
edited
Loading

New and updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives Size Publisher
ses 1.1.0 None +1 3.23 MB kriskowal
@lavamoat/lavapack 5.4.1...6.0.2 None +4/-2 1.58 MB
lavamoat-viz 6.2.1...7.0.2 None +4/-2 103 MB
lavamoat-browserify 15.9.1...17.0.2 None +6/-4 1.64 MB
lavamoat 7.3.1...8.0.2 None +7/-3 1.19 MB
@lavamoat/allow-scripts 2.5.1...3.0.1 None +2/-2 82.5 kB naugtur

@socket-security
Copy link
Copy Markdown

socket-security bot commented Jan 18, 2024 •
edited
Loading

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: json-stable-stringify@1.0.2, lavamoat-browserify@17.0.2, @lavamoat/lavapack@6.0.2, lavamoat-core@15.1.1, @lavamoat/aa@4.0.1, lavamoat-viz@7.0.2, lavamoat@8.0.2, lavamoat-tofu@7.1.0

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

@metamaskbot
Copy link
Copy Markdown
Collaborator

metamaskbot commented Jan 18, 2024

Policies updated

@FrederikBolding FrederikBolding changed the title Bump LavaMoat Bump LavaMoat and SES Jan 18, 2024
@FrederikBolding FrederikBolding marked this pull request as ready for review January 18, 2024 14:59
@FrederikBolding FrederikBolding requested review from a team as code owners January 18, 2024 14:59
@FrederikBolding
Copy link
Copy Markdown
Member Author

FrederikBolding commented Jan 18, 2024

@SocketSecurity ignore json-stable-stringify@1.0.2

Trusted author.

@SocketSecurity ignore lavamoat-browserify@17.0.2
@SocketSecurity ignore @lavamoat/lavapack@6.0.2
@SocketSecurity ignore lavamoat-core@15.1.1
@SocketSecurity ignore @lavamoat/aa@4.0.1
@SocketSecurity ignore lavamoat-viz@7.0.2
@SocketSecurity ignore lavamoat@8.0.2
@SocketSecurity ignore lavamoat-tofu@7.1.0

These packages were just published and are wrongly showing up as unpublished.

Gudahtt
Gudahtt approved these changes Jan 18, 2024
View reviewed changes
Copy link
Copy Markdown
Member

@Gudahtt Gudahtt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@FrederikBolding FrederikBolding merged commit 39eb576 into develop Jan 18, 2024
@FrederikBolding FrederikBolding deleted the fb/bump-lavamoat branch January 18, 2024 17:10
@github-actions github-actions bot locked and limited conversation to collaborators Jan 18, 2024
@metamaskbot metamaskbot added the release-11.10.0 Issue or pull request that will be included in release 11.10.0 label Jan 18, 2024
@metamaskbot
Copy link
Copy Markdown
Collaborator

metamaskbot commented Jan 18, 2024

Builds ready [253882a]
Page Load Metrics (1733 ± 110 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint9148619811153
domContentLoaded978342311
load138220811733230110
domInteractive978342311
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 22.8 KiB (0.68%)
  • ui: 0 Bytes (0.00%)
  • common: -16 Bytes (-0.00%)

@metamaskbot metamaskbot added release-11.7.5 Issue or pull request that will be included in release 11.7.5 and removed release-11.10.0 Issue or pull request that will be included in release 11.10.0 labels Jan 31, 2024
@metamaskbot
Copy link
Copy Markdown
Collaborator

metamaskbot commented Jan 31, 2024

Missing release label release-11.7.5 on PR. Adding release label release-11.7.5 on PR and removing other release labels(release-11.10.0), as PR was cherry-picked in branch 11.7.5.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@Gudahtt Gudahtt Gudahtt approved these changes

+1 more reviewer

@legobeat legobeat legobeat approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

INVALID-PR-TEMPLATE PR's body doesn't match template release-11.7.5 Issue or pull request that will be included in release 11.7.5 team-lavamoat

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@FrederikBolding @metamaskbot @Gudahtt @legobeat