Skip to content

Upgrade Yarn to v3#5147

Closed
rickycodes wants to merge 11 commits intomainfrom
yarn3-activate
Closed

Upgrade Yarn to v3#5147
rickycodes wants to merge 11 commits intomainfrom
yarn3-activate

Conversation

@rickycodes
Copy link
Copy Markdown
Contributor

@rickycodes rickycodes commented Oct 25, 2022

No description provided.

@socket-security
Copy link
Copy Markdown

socket-security bot commented Oct 25, 2022 •
edited
Loading

Socket Security Pull Request Report

Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.

📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package Script field Source
canvas@2.10.2 (upgraded) binding.gyp package.json via wdio-image-comparison-service@3.1.1, webdriver-image-comparison@0.20.3
keccak@3.0.2 (upgraded) install package.json via @keystonehq/bc-ur-registry-eth@0.7.7, ethereumjs-util@7.1.5, ethereum-cryptography@0.1.3
canvas@2.10.2 (upgraded) install package.json via wdio-image-comparison-service@3.1.1, webdriver-image-comparison@0.20.3
highlight.js@9.18.5 (upgraded) postinstall package.json via @storybook/addon-actions@5.3.21, @storybook/components@5.3.21, react-syntax-highlighter@11.0.3
🫣 Native code

Contains native code which could be a vector to obscure malicious code, and generally decrease the likelihood of reproducible or reliable installs.

Ensure that native code bindings are expected. Consumers may consider pure JS and functionally similar alternatives to avoid the challenges and risks associated with native code bindings.

Package Location Source
canvas@2.10.2 (upgraded) binding.gyp package.json via wdio-image-comparison-service@3.1.1, webdriver-image-comparison@0.20.3
Pull request report summary
Issue Status
Install scripts ⚠️ 4 issues
Native code ⚠️ 1 issue
Bin script confusion ✅ 0 issues
Bin script shell injection ✅ 0 issues
Unresolved require ✅ 0 issues
Invalid package.json ✅ 0 issues
HTTP dependency ✅ 0 issues
Git dependency ✅ 0 issues
Potential typo squat ✅ 0 issues
Known Malware ✅ 0 issues
Telemetry ✅ 0 issues
Protestware/Troll package ✅ 0 issues
Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2

  • @SocketSecurity ignore canvas@2.10.2
  • @SocketSecurity ignore keccak@3.0.2
  • @SocketSecurity ignore highlight.js@9.18.5

Powered by socket.dev

@rickycodes rickycodes force-pushed the yarn3-activate branch 2 times, most recently from fb1d248 to 1ab0343 Compare October 26, 2022 14:55
@rickycodes rickycodes force-pushed the yarn3-activate branch 4 times, most recently from 1c9f4a6 to 77d304b Compare November 9, 2022 00:24
@rickycodes rickycodes changed the title upgrade yarn to version 3 Upgrade yarn to version 3 Nov 10, 2022
@rickycodes rickycodes changed the title Upgrade yarn to version 3 Upgrade Yarn to v3 Nov 10, 2022
@rickycodes rickycodes force-pushed the yarn3-activate branch 2 times, most recently from 5c6a941 to 2153d85 Compare November 10, 2022 15:44
@rickycodes
Upgrade to Yarn v3
4330586 
This change upgrades things to Yarn v3. It also upgrades allow-scripts to v2.
@rickycodes rickycodes marked this pull request as ready for review November 30, 2022 16:32
@rickycodes rickycodes requested a review from a team as a code owner November 30, 2022 16:32
@rickycodes rickycodes marked this pull request as draft November 30, 2022 16:35
@rickycodes rickycodes mentioned this pull request Nov 30, 2022
Closed
4 tasks
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented May 12, 2023

This PR has been automatically marked as stale because it has not had recent activity in the last 90 days. It will be closed in 7 days. Thank you for your contributions.

@github-actions github-actions bot added the stale Issues that have not had activity in the last 90 days label May 12, 2023
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented May 19, 2023

This PR was closed because it has been stalled for 7 days with no activity. Thank you for your contributions.

@github-actions github-actions bot closed this May 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@rickycodes rickycodes

Labels

stale Issues that have not had activity in the last 90 days

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rickycodes