MetaMask / MetaMask/core

Merge dependabot security PRs

Open
#4,847 0 comments 0 reactions 2 assignees Claimed by @mikesposito View on GitHub
team-wallet-framework
Dominant language
TypeScript
Stars
413
Forks
308
Avg merge
1d 4h
Merged PRs (30d)
253

Description

There are several PR related to security vulnerabilities from dependabot in repos owned by Wallet Framework (for full list, see https://github.com/MetaMask/MetaMask-planning/issues/3540).

In some cases, we should also prioritize release and update of affected packages in their consumers in order to mitigate the security issues, based on their `EPSS` value.

**When to release the package**
- if `EPSS` is >= 1% then release the package and deliver to clients
- if `EPSS` is < 1%
- if the package is released (and delivered to clients) frequently then just merge the dependabot PR
- if the package is rarely updated, release and deliver to (at least) other packages that are released more frequently, or to clients if it makes sense

**To get the `EPSS` value**
- Go to the alert related to the PR (e.g. https://github.com/MetaMask/actions-gh-pages-test-repo/security/dependabot/64)
- Click on [See advisory in GitHub Advisory Database](https://github.com/advisories/GHSA-grv7-fg5c-xmjg)
- See `EPSS` right below `GHSA ID`

**For packages we are in process of archiving**
For affected packages that are in the process of being abandoned/archived, we should make sure that the related vulnerabilities have been mitigated on clients before ignoring the dependabot PR.

**PR List**

- [ ] https://github.com/MetaMask/actions-gh-pages-test-repo/pull/118
- [ ] https://github.com/MetaMask/ethjs-unit/pull/22
- https://github.com/MetaMask/ethjs-unit/security/dependabot/6
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-unit/security/dependabot/10
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-unit/security/dependabot/14
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-unit/security/dependabot/21
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- `elliptic` package (patched version 6.6.0):
- https://github.com/MetaMask/ethjs-unit/security/dependabot/5
- https://github.com/MetaMask/ethjs-unit/security/dependabot/7
- https://github.com/MetaMask/ethjs-unit/security/dependabot/36
- https://github.com/MetaMask/ethjs-unit/security/dependabot/32
- https://github.com/MetaMask/ethjs-unit/security/dependabot/25
- https://github.com/MetaMask/ethjs-unit/security/dependabot/24
- https://github.com/MetaMask/ethjs-unit/security/dependabot/23
- [x] Extension is using a patched version
- [ ] Mobile is using a patched version
- [ ] https://github.com/MetaMask/metamask-mobile/pull/12979
- https://github.com/MetaMask/ethjs-unit/security/dependabot/13
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-unit/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [x] https://github.com/MetaMask/swappable-obj-proxy/pull/61
- [x] https://github.com/MetaMask/swappable-obj-proxy/pull/73
- [x] Core packages already use the patched version of `braces`
- [ ] https://github.com/MetaMask/ethjs-filter/pull/14
- https://github.com/MetaMask/ethjs-filter/security/dependabot/5
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-filter/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-filter/security/dependabot/13
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-util/pull/25
- https://github.com/MetaMask/ethjs-util/security/dependabot/22
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/16
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/13
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/24
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/20
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/15
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/10
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/9
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/8
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/5
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/1
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs/pull/32
- https://github.com/MetaMask/ethjs/security/dependabot/71
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs/security/dependabot/77
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs/security/dependabot/59
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs/security/dependabot/7
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs/security/dependabot/75
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-contract/pull/25
- https://github.com/MetaMask/ethjs-contract/security/dependabot/33
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/20
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/16
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/38
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/30
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/18
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/12
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/10
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/5
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/35
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-format/pull/15
- https://github.com/MetaMask/ethjs-format/security/dependabot/23
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/16
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/13
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/25
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/20
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/15
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/10
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/9
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/8
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/5
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-provider-http/pull/25
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/15
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/1
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/22
- [ ] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/17
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/6
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-query/pull/54
- https://github.com/MetaMask/ethjs-query/security/dependabot/81
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-query/security/dependabot/64
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-query/security/dependabot/75
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-query/security/dependabot/77
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [x] (Mitigated on clients) https://github.com/MetaMask/number-to-bn/pull/24
- https://github.com/MetaMask/number-to-bn/security/dependabot/75
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/number-to-bn/security/dependabot/24
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/number-to-bn/security/dependabot/57
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [x] https://github.com/MetaMask/oss-attribution-generator/pull/32

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.