Skip to content

Standardise repo per module template as of July 2023#115

Merged
Mrtenz merged 5 commits intomainfrom
mrtenz/standardise-july-2023
Jul 11, 2023
Merged

Standardise repo per module template as of July 2023#115
Mrtenz merged 5 commits intomainfrom
mrtenz/standardise-july-2023

Conversation

@Mrtenz
Copy link
Copy Markdown
Member

@Mrtenz Mrtenz commented Jul 11, 2023

This updates the repository to match the module template as of July 2023. This includes:

  • A Slack webhook URL to send a message for deployment.
  • Building the package as ESM and CJS.
  • Several GitHub actions versions bumps.
  • Bumping @lavamoat/allow-scripts to 2.3.1.

This was done using template-sync, and can be verified using yarn dlx @metamask/template-sync --check.

@Mrtenz Mrtenz requested a review from a team as a code owner July 11, 2023 19:59
@socket-security
Copy link
Copy Markdown

socket-security bot commented Jul 11, 2023

New dependencies detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives Size Publisher
@swc/cli 0.1.62 network, filesystem, shell, environment +81 386 MB kdy1
@swc/core 1.3.68 filesystem, shell, environment +10 384 MB kdy1

@socket-security
Copy link
Copy Markdown

socket-security bot commented Jul 11, 2023 •
edited
Loading

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: source-map@0.7.4, clone-response@1.0.3, responselike@2.0.1, @mole-inc/bin-wrapper@8.0.1, @swc/cli@0.1.62, @swc/core@1.3.68, arch@2.2.0, got@11.8.6, readable-web-to-node-stream@3.0.2, strip-outer@2.0.0, strip-eof@1.0.0, pump@3.0.0, @tokenizer/token@0.3.0, executable@4.1.1, bin-check@4.1.0, semver-truncate@3.0.0, sort-keys@1.1.2, lowercase-keys@2.0.0, find-versions@5.1.0, filename-reserved-regex@3.0.0, defer-to-connect@2.0.1, content-disposition@0.5.4, json-buffer@3.0.1, bin-version@6.0.0, @szmarczak/http-timer@4.0.6, @types/http-cache-semantics@4.0.1, mime-db@1.52.0, pseudomap@1.0.2, end-of-stream@1.4.4, semver-regex@4.0.5, ext-list@2.2.2, ieee754@1.2.1, os-filter-obj@2.0.0, sort-keys-length@1.0.1, p-finally@1.0.0, trim-repeated@2.0.0, ext-name@5.0.0, mimic-response@1.0.1, mimic-response@3.1.0, resolve-alpn@1.2.1, http2-wrapper@1.0.3, cacheable-request@7.0.4, cacheable-lookup@5.0.4

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

Gudahtt
Gudahtt previously approved these changes Jul 11, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@Gudahtt Gudahtt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@Gudahtt
Copy link
Copy Markdown
Member

Gudahtt commented Jul 11, 2023

@SocketSecurity ignore-all

Same set of warnings seen on the module template PR where SWC was added. Lots of unmaintained things, and packages having appropriate access.

Gudahtt
Gudahtt reviewed Jul 11, 2023
View reviewed changes
Gudahtt
Gudahtt previously approved these changes Jul 11, 2023
View reviewed changes
Gudahtt
Gudahtt previously approved these changes Jul 11, 2023
View reviewed changes
@Mrtenz Mrtenz merged commit ab071ea into main Jul 11, 2023
@Mrtenz Mrtenz deleted the mrtenz/standardise-july-2023 branch July 11, 2023 20:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Gudahtt Gudahtt Gudahtt approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Mrtenz @Gudahtt