Skip to content

fix: Add resolution for rpc-websockets to handle deps audit failure#25112

Merged
legobeat merged 2 commits intodevelopfrom
fix-rpc-websockets-deps-audit
Jun 6, 2024
Merged

fix: Add resolution for rpc-websockets to handle deps audit failure#25112
legobeat merged 2 commits intodevelopfrom
fix-rpc-websockets-deps-audit

Conversation

@danjm
Copy link
Copy Markdown
Contributor

@danjm danjm commented Jun 6, 2024 •
edited
Loading

Description

fixes this test-deps-audit failure:

└─ rpc-websockets
   ├─ ID: rpc-websockets (deprecation)
   ├─ Issue: deprecate 7.11.1
   ├─ Severity: moderate
   ├─ Vulnerable Versions: 7.11.1
   │ 
   ├─ Tree Versions
   │  └─ 7.11.1
   │ 
   └─ Dependents
      └─ @solana/web3.js@npm:1.91.8

Exited with code exit status 1

The next version after 7.11.1 is a major version bump, 8.0.1. The release notes for that version say "Switched to ESNext (ESM). Make sure to use import instead of require to import this package." The one package in our dependency tree that uses this package already uses import (https://github.com/solana-labs/solana-web3.js/blob/abbdc5b1d373cb555b1aab6d450854939407a8ab/packages/library-legacy/src/rpc-websocket.ts#L1). So bumping the version should be safe.

Open in GitHub Codespaces

Manual testing steps

This change doesn't affect our functionality. The Trezor functionality that depends on this package is not used in our usage of trezor.

Pre-merge author checklist

  • I’ve followed MetaMask Coding Standards.
  • I've completed the PR template to the best of my ability
  • I’ve included tests if applicable
  • I’ve documented my code using JSDoc format if applicable
  • I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@danjm danjm requested a review from a team as a code owner June 6, 2024 18:24
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jun 6, 2024

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the INVALID-PR-TEMPLATE PR's body doesn't match template label Jun 6, 2024
@socket-security
Copy link
Copy Markdown

socket-security bot commented Jun 6, 2024 •
edited
Loading

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/rpc-websockets@8.0.1 None 0 0 B

🚮 Removed packages: npm/bufferutil@4.0.8, npm/utf-8-validate@5.0.10

View full report↗︎

@socket-security
Copy link
Copy Markdown

socket-security bot commented Jun 6, 2024 •
edited
Loading

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report↗︎

DDDDDanica
DDDDDanica previously approved these changes Jun 6, 2024
View reviewed changes
Gudahtt
Gudahtt reviewed Jun 6, 2024
View reviewed changes
@danjm danjm changed the title Add resolution for rpc-websockets to handle deps audit failure fix: Add resolution for rpc-websockets to handle deps audit failure Jun 6, 2024
@danjm danjm added the team-extension-platform Extension Platform team label Jun 6, 2024
@danjm @Gudahtt
Update package.json
01825d3 
Co-authored-by: Mark Stacey <markjstacey@gmail.com>
Gudahtt
Gudahtt approved these changes Jun 6, 2024
View reviewed changes
Copy link
Copy Markdown
Member

@Gudahtt Gudahtt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@codecov
Copy link
Copy Markdown

codecov bot commented Jun 6, 2024 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 65.67%. Comparing base (af8ef25) to head (01825d3).
Report is 1 commits behind head on develop.

Additional details and impacted files 
@@           Coverage Diff            @@
##           develop   #25112   +/-   ##
========================================
  Coverage    65.67%   65.67%           
========================================
  Files         1359     1359           
  Lines        54015    54015           
  Branches     14017    14017           
========================================
  Hits         35469    35469           
  Misses       18546    18546

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@Gudahtt
Copy link
Copy Markdown
Member

Gudahtt commented Jun 6, 2024

@SocketSecurity ignore npm/utf-8-validate@5.0.10
@SocketSecurity ignore npm/bufferutil@4.0.8

These both appear to be false positives. These are not introduced by this PR.

@Gudahtt Gudahtt requested a review from DDDDDanica June 6, 2024 19:24
@legobeat
Copy link
Copy Markdown
Contributor

legobeat commented Jun 6, 2024 •
edited
Loading

The one package in our dependency tree that uses this package already uses import. So bumping the version should be safe.

Just noting that unless something changed very recently, @solana/web3.js imports rpc-websockets modules directly from .cjs paths as of integrating 7.11.1.

https://github.com/solana-labs/solana-web3.js/pull/2758/files#diff-20d78b28ed2c239f472fb2e5693cb19b45530c9bb2d14654465cc1d78ba65adc

EDIT: But the cjs files are all still there despite the module being advertised as "ESM only now". So looks like yes, it's safe. But may not the last we hear on this package and its ESM migration...

https://www.npmjs.com/package/rpc-websockets?activeTab=code

@legobeat legobeat merged commit 9ca4f56 into develop Jun 6, 2024
@legobeat legobeat deleted the fix-rpc-websockets-deps-audit branch June 6, 2024 19:56
@github-actions github-actions bot locked and limited conversation to collaborators Jun 6, 2024
@metamaskbot metamaskbot added the release-12.1.0 Issue or pull request that will be included in release 12.1.0 label Jun 6, 2024
@metamaskbot
Copy link
Copy Markdown
Collaborator

metamaskbot commented Jun 6, 2024

Builds ready [01825d3]
Page Load Metrics (206 ± 316 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint69249933718
domContentLoaded9171121
load433073206658316
domInteractive9171121
Bundle size diffs
  • background: 0 Bytes (0.00%)
  • ui: 0 Bytes (0.00%)
  • common: 0 Bytes (0.00%)

@metamaskbot metamaskbot added release-12.0.0 Issue or pull request that will be included in release 12.0.0 and removed release-12.1.0 Issue or pull request that will be included in release 12.1.0 labels Jun 6, 2024
@metamaskbot
Copy link
Copy Markdown
Collaborator

metamaskbot commented Jun 6, 2024

Missing release label release-12.0.0 on PR. Adding release label release-12.0.0 on PR and removing other release labels(release-12.1.0), as PR was added to branch 12.0.0 when release was cut.

@metamaskbot metamaskbot added release-11.16.8 Issue or pull request that will be included in release 11.16.8 and removed release-12.0.0 Issue or pull request that will be included in release 12.0.0 labels Jun 7, 2024
@metamaskbot
Copy link
Copy Markdown
Collaborator

metamaskbot commented Jun 7, 2024

Missing release label release-11.16.8 on PR. Adding release label release-11.16.8 on PR and removing other release labels(release-12.0.0), as PR was cherry-picked in branch 11.16.8.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@HowardBraham HowardBraham HowardBraham approved these changes

@Gudahtt Gudahtt Gudahtt approved these changes

@DDDDDanica DDDDDanica DDDDDanica approved these changes

+1 more reviewer

@legobeat legobeat legobeat approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

INVALID-PR-TEMPLATE PR's body doesn't match template release-11.16.8 Issue or pull request that will be included in release 11.16.8 team-extension-platform Extension Platform team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@danjm @Gudahtt @legobeat @metamaskbot @HowardBraham @DDDDDanica