Description

We have a yarn audit failure on develop due to the package inflight which is used by the package glob. While glob is a dependency of many of our dev dependencies, it is only causing an audit failure because it is a dependency of a package ultimately imported by trezor:

danjm@pop-os:~/metamask/metamask-extension$ yarn why -R inflight
└─ metamask-crx@workspace:.
   ├─ @metamask/eth-trezor-keyring@npm:3.1.0 (via npm:^3.1.0)
   │  └─ @trezor/connect-web@npm:9.2.2 [42492] (via npm:^9.1.11 [42492])
   │     ├─ @trezor/connect@npm:9.2.2 [d8f53] (via npm:9.2.2 [d8f53])
   │     │  ├─ @trezor/connect-analytics@npm:1.0.14 [bb3a7] (via npm:1.0.14 [bb3a7])
   │     │  │  └─ @trezor/analytics@npm:1.0.16 [bc8f6] (via npm:1.0.16 [bc8f6])
   │     │  │     └─ @trezor/env-utils@npm:1.0.15 [342f9] (via npm:1.0.15 [342f9])
   │     │  │        └─ expo-constants@npm:15.4.5 [20ef0] (via npm:15.4.5 [20ef0])
   │     │  │           └─ @expo/config@npm:8.5.6 (via npm:~8.5.0)
   │     │  │              ├─ @expo/config-plugins@npm:7.9.2 (via npm:~7.9.0)
   │     │  │              │  └─ glob@npm:7.1.6 (via npm:7.1.6)
   │     │  │              │     └─ inflight@npm:1.0.6 (via npm:^1.0.4)
   │     │  │              ├─ glob@npm:7.1.6 (via npm:7.1.6)
   │     │  │              └─ sucrase@npm:3.34.0 (via npm:3.34.0)
   │     │  │                 └─ glob@npm:7.1.6 (via npm:7.1.6)

However, expo-constants is not actually used in our application code. It's inclusion in our dependency tree is due to some problem in how the trezor packages are built (which we also should probably investigate, but that can be done separately).

To solve the audit failure, this PR edits yarn.lock to resolve the instances of glob under @expo/config to a version that does not use inflight.

Update: as per the below suggestion, instead of directly editing the yarn.lock file, this PR now adds resolutions to resolve the instances of glob under @expo/config to a version that does not use inflight

Manual testing steps

yarn audit should pass

Pre-merge author checklist

• I’ve followed MetaMask Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.