fix(deps): @metamask/eth-json-rpc-middleware 15 #27923

legobeat · 2024-10-17T09:44:18Z

Description

deps: @metamask/eth-json-rpc-middleware@^14.0.1-patched->@^15.0.0
deps: json-rpc-middleware-stream@^5 -> @metamask/json-rpc-middleware-stream@^8
deps: @metamask/providers@^14.0.2->^18.1.0

Related issues

Blocked by

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
I've completed the PR template to the best of my ability
I’ve included tests if applicable
I’ve documented my code using JSDoc format if applicable
I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

github-actions · 2024-10-17T09:44:31Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

socket-security · 2024-10-17T09:45:30Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@metamask/eth-block-tracker@11.0.1	None	`+1`	120 kB	mcmire
npm/@metamask/eth-json-rpc-middleware@15.0.0	network	`0`	172 kB	metamaskbot
npm/klona@2.0.6	None	`0`	23.2 kB	lukeed

🚮 Removed packages: npm/json-rpc-middleware-stream@5.0.1

View full report↗︎

socket-security · 2024-10-17T09:45:32Z

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/@metamask/eth-json-rpc-middleware@15.0.0

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

legobeat · 2024-10-17T09:45:50Z

@SocketSecurity ignore npm/@metamask/eth-json-rpc-middleware@15.0.0

network access ok

## **Description** - Bump `@metamask/eth-json-rpc-filters` from `^8.0.0` `^9.0.0`. [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/27956?quickstart=1) ## **Related issues** - #27923 #### Based on / Blocked by - [x] #27917 ## **Manual testing steps** ## **Screenshots/Recordings** ### **Before** ### **After** ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

legobeat · 2024-10-24T04:54:28Z

E2E error:

Failure on testcase: 'eth_accounts executes a eth_accounts json rpc call', for more information see the artifacts tab in CI

JavascriptError: javascript error: Cannot read properties of undefined (reading 'request')
  (Session info: chrome=126.0.6478.182)

ServerMochaToBackground disconnected from client
manifest-flag-mocha-hooks.ts -- afterEach hook
<?xml version="1.0" encoding="UTF-8"?>
<testsuites name="Mocha Tests" time="11.151" tests="1" failures="1">
  <testsuite name="Root Suite" timestamp="2024-10-24T04:49:13" tests="0" time="0.000" failures="0">
  </testsuite>
  <testsuite name="eth_accounts" timestamp="2024-10-24T04:49:13" tests="1" file="/home/circleci/project/test/e2e/json-rpc/eth_accounts.spec.ts" time="11.150" failures="1">
    <testcase name="eth_accounts executes a eth_accounts json rpc call" time="11.134" classname="executes a eth_accounts json rpc call">
      <failure message="javascript error: Cannot read properties of undefined (reading &apos;request&apos;)
  (Session info: chrome=126.0.6478.182)
  (Ran on CircleCI Node 0 of 1, Job test-e2e-chrome-rpc)" type="JavascriptError"><![CDATA[JavascriptError: javascript error: Cannot read properties of undefined (reading 'request')
  (Session info: chrome=126.0.6478.182)
  (Ran on CircleCI Node 0 of 1, Job test-e2e-chrome-rpc)
    at Object.throwDecodedError (node_modules/selenium-webdriver/lib/error.js:524:15)
    at parseHttpResponse (node_modules/selenium-webdriver/lib/http.js:601:13)
    at Executor.execute (node_modules/selenium-webdriver/lib/http.js:529:28)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async thenableWebDriverProxy.execute (node_modules/selenium-webdriver/lib/webdriver.js:745:17)
    at async /home/circleci/project/test/e2e/json-rpc/eth_accounts.spec.ts:2:1688
    at async withFixtures (test/e2e/helpers.js:217:5)
    at async Context.<anonymous> (test/e2e/json-rpc/eth_accounts.spec.ts:2:1061)]]></failure>
    </testcase>
  </testsuite>
</testsuites>
retry() received: Exited with code '1'
Error occurred while running tests on chrome: Error: Retry limit reached
Error: Exited with code '1'
    at runInShell (/home/circleci/project/development/lib/run-command.js:134:29)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async main (/home/circleci/project/test/e2e/run-all.js:268:7)

naugtur · 2024-10-24T07:37:47Z

app/scripts/inpage.js

@@ -34,7 +34,7 @@ cleanContextForImports();
 import log from 'loglevel';
 import { v4 as uuid } from 'uuid';
 import { WindowPostMessageStream } from '@metamask/post-message-stream';
-import { initializeProvider } from '@metamask/providers/dist/initializeInpageProvider';
+import { initializeProvider } from '../../node_modules/@metamask/providers/dist/initializeInpageProvider.cjs';


The reason why normal importing didn't work might have something to do with the still incomplete exports support in some of the tools we are using.
browserify/resolve#224
This package is depended upon by more things than you think.

have you tried
@metamask/providers/dist/initializeInpageProvider.cjs ?
It's possible that the way it resolves is <package name>/literal/path/in/package

The reason why normal importing didn't work might have something to do with the still incomplete exports support in some of the tools we are using.

That does seem to be the case!

This package is depended upon by more things than you think.

Oh, I'm painfully aware :D

have you tried @metamask/providers/dist/initializeInpageProvider.cjs ?

Yes. For some reason that works for @metamask/providers v17 but not for v18 (here).

## **Description** - Bump `@metamask/eth-json-rpc-filters` from `^8.0.0` `^9.0.0`. [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/27956?quickstart=1) ## **Related issues** - #27923 #### Based on / Blocked by - [x] #27917 ## **Manual testing steps** ## **Screenshots/Recordings** ### **Before** ### **After** ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

## **Description** - Bump `@babel/core` and `@babel/runtime` to latest - Fix: replace previous usage of unpatched `@babel/runtime` with consistent usage of patched version - The unpatched version was inadvertently used by `@metamask/smart-transactions-controller` [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/28068?quickstart=1) ## **Related issues** - #27049 - #27923 ## **Manual testing steps** ## **Screenshots/Recordings** ### **Before** ### **After** ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

…tream@^8 (#28060) ## **Description** - Replace legacy `json-rpc-middleware-stream@^5` (2023-09-27) with `@metamask/json-rpc-middleware-stream@^8` (2024-10-16) [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/28060?quickstart=1) ## **Related issues** - Fully removing usage of old version and aligning versions depends on updating `@metamask/providers`, done in either/both of: - #27049 - #27923 ## **Manual testing steps** ## **Screenshots/Recordings** ### **Before** ### **After** ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Gudahtt · 2024-11-27T23:47:16Z

Replaced by #28756 and #28757

legobeat changed the title ~~deps: @metamask/eth-json-rpc-middleware 15~~ fix(deps): @metamask/eth-json-rpc-middleware 15 Oct 17, 2024

This was referenced Oct 18, 2024

feat: add intializeInpageProvider export MetaMask/providers#380

Merged

18.1.0 MetaMask/providers#382

Merged

legobeat force-pushed the deps-eth-json-rpc-middleware-15 branch from 1a9e699 to 9eb2941 Compare October 18, 2024 12:10

legobeat added dependencies Pull requests that update a dependency file team-security labels Oct 18, 2024

legobeat force-pushed the deps-eth-json-rpc-middleware-15 branch from 9eb2941 to 716fb91 Compare October 22, 2024 23:05

legobeat mentioned this pull request Oct 22, 2024

fix(deps): @metamask/eth-json-rpc-filters@^8.0.0->^9.0.0 #27956

Merged

8 tasks

This comment was marked as resolved.

Sign in to view

legobeat added the blocked label Oct 22, 2024

legobeat mentioned this pull request Oct 22, 2024

feat(browserify): configurable resolve implementation LavaMoat/LavaMoat#1421

Merged

legobeat force-pushed the deps-eth-json-rpc-middleware-15 branch 2 times, most recently from 36f4c3a to 6f1168d Compare October 24, 2024 04:37

legobeat mentioned this pull request Oct 24, 2024

fix: json-rpc-middleware-stream@^5 -> @metamask/json-rpc-middleware-stream@^8 #28060

Merged

7 tasks

naugtur reviewed Oct 24, 2024

View reviewed changes

legobeat mentioned this pull request Oct 24, 2024

chore: bump @metamask/providers to ^17.2.0 #27049

Closed

7 tasks

legobeat mentioned this pull request Oct 24, 2024

fix(devDeps): babel@7.23.2->7.25.9 #28068

Merged

7 tasks

legobeat force-pushed the deps-eth-json-rpc-middleware-15 branch from 6f1168d to 078ee36 Compare October 25, 2024 01:24

legobeat added 2 commits October 29, 2024 11:18

deps: @metamask/eth-json-rpc-middleware@^14.0.1-patched->@^15.0.0

5b5f487

deps: @metamask/providers@^14.0.2->^18.0.0

66cdde1

legobeat added 3 commits October 29, 2024 11:18

deps: @metamask/providers@^18.0.0->^18.1.0

4a1e031

fix: work around broken export/import of @metamask/providers

2cecbe1

chore: update lavamoat policies

bedf307

legobeat force-pushed the deps-eth-json-rpc-middleware-15 branch from 078ee36 to bedf307 Compare October 29, 2024 11:18

Gudahtt closed this Nov 27, 2024

github-actions bot locked and limited conversation to collaborators Nov 27, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): @metamask/eth-json-rpc-middleware 15 #27923

fix(deps): @metamask/eth-json-rpc-middleware 15 #27923

legobeat commented Oct 17, 2024 •

edited

Loading

github-actions bot commented Oct 17, 2024

socket-security bot commented Oct 17, 2024 •

edited

Loading

socket-security bot commented Oct 17, 2024 •

edited

Loading

legobeat commented Oct 17, 2024 •

edited

Loading

This comment was marked as resolved.

legobeat commented Oct 24, 2024

naugtur Oct 24, 2024 •

edited

Loading

legobeat Oct 24, 2024 •

edited

Loading

Gudahtt commented Nov 27, 2024

fix(deps): @metamask/eth-json-rpc-middleware 15 #27923

fix(deps): @metamask/eth-json-rpc-middleware 15 #27923

Conversation

legobeat commented Oct 17, 2024 • edited Loading

Description

Related issues

Blocked by

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

github-actions bot commented Oct 17, 2024

socket-security bot commented Oct 17, 2024 • edited Loading

socket-security bot commented Oct 17, 2024 • edited Loading

Next steps

legobeat commented Oct 17, 2024 • edited Loading

This comment was marked as resolved.

legobeat commented Oct 24, 2024

naugtur Oct 24, 2024 • edited Loading

Choose a reason for hiding this comment

legobeat Oct 24, 2024 • edited Loading

Choose a reason for hiding this comment

Gudahtt commented Nov 27, 2024

legobeat commented Oct 17, 2024 •

edited

Loading

socket-security bot commented Oct 17, 2024 •

edited

Loading

socket-security bot commented Oct 17, 2024 •

edited

Loading

legobeat commented Oct 17, 2024 •

edited

Loading

naugtur Oct 24, 2024 •

edited

Loading

legobeat Oct 24, 2024 •

edited

Loading