Merge dependabot security PRs
- Dominant language
- TypeScript
- Stars
- 413
- Forks
- 308
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 253
Description
There are several PR related to security vulnerabilities from dependabot in repos owned by Wallet Framework (for full list, see https://github.com/MetaMask/MetaMask-planning/issues/3540).
In some cases, we should also prioritize release and update of affected packages in their consumers in order to mitigate the security issues, based on their `EPSS` value.
**When to release the package**
- if `EPSS` is >= 1% then release the package and deliver to clients
- if `EPSS` is < 1%
- if the package is released (and delivered to clients) frequently then just merge the dependabot PR
- if the package is rarely updated, release and deliver to (at least) other packages that are released more frequently, or to clients if it makes sense
**To get the `EPSS` value**
- Go to the alert related to the PR (e.g. https://github.com/MetaMask/actions-gh-pages-test-repo/security/dependabot/64)
- Click on [See advisory in GitHub Advisory Database](https://github.com/advisories/GHSA-grv7-fg5c-xmjg)
- See `EPSS` right below `GHSA ID`
**For packages we are in process of archiving**
For affected packages that are in the process of being abandoned/archived, we should make sure that the related vulnerabilities have been mitigated on clients before ignoring the dependabot PR.
**PR List**
- [ ] https://github.com/MetaMask/actions-gh-pages-test-repo/pull/118
- [ ] https://github.com/MetaMask/ethjs-unit/pull/22
- https://github.com/MetaMask/ethjs-unit/security/dependabot/6
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-unit/security/dependabot/10
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-unit/security/dependabot/14
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-unit/security/dependabot/21
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- `elliptic` package (patched version 6.6.0):
- https://github.com/MetaMask/ethjs-unit/security/dependabot/5
- https://github.com/MetaMask/ethjs-unit/security/dependabot/7
- https://github.com/MetaMask/ethjs-unit/security/dependabot/36
- https://github.com/MetaMask/ethjs-unit/security/dependabot/32
- https://github.com/MetaMask/ethjs-unit/security/dependabot/25
- https://github.com/MetaMask/ethjs-unit/security/dependabot/24
- https://github.com/MetaMask/ethjs-unit/security/dependabot/23
- [x] Extension is using a patched version
- [ ] Mobile is using a patched version
- [ ] https://github.com/MetaMask/metamask-mobile/pull/12979
- https://github.com/MetaMask/ethjs-unit/security/dependabot/13
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-unit/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [x] https://github.com/MetaMask/swappable-obj-proxy/pull/61
- [x] https://github.com/MetaMask/swappable-obj-proxy/pull/73
- [x] Core packages already use the patched version of `braces`
- [ ] https://github.com/MetaMask/ethjs-filter/pull/14
- https://github.com/MetaMask/ethjs-filter/security/dependabot/5
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-filter/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-filter/security/dependabot/13
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-util/pull/25
- https://github.com/MetaMask/ethjs-util/security/dependabot/22
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/16
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/13
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/24
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/20
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/15
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/10
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/9
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/8
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/5
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/1
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-util/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs/pull/32
- https://github.com/MetaMask/ethjs/security/dependabot/71
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs/security/dependabot/77
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs/security/dependabot/59
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs/security/dependabot/7
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs/security/dependabot/75
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-contract/pull/25
- https://github.com/MetaMask/ethjs-contract/security/dependabot/33
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/20
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/16
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/38
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/30
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/18
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/12
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/10
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/5
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-contract/security/dependabot/35
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-format/pull/15
- https://github.com/MetaMask/ethjs-format/security/dependabot/23
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/16
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/13
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/25
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/20
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/15
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/10
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/9
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/8
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/5
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-format/security/dependabot/11
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-provider-http/pull/25
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/15
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/1
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/22
- [ ] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/17
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-provider-http/security/dependabot/6
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [ ] https://github.com/MetaMask/ethjs-query/pull/54
- https://github.com/MetaMask/ethjs-query/security/dependabot/81
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-query/security/dependabot/64
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-query/security/dependabot/75
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/ethjs-query/security/dependabot/77
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [x] (Mitigated on clients) https://github.com/MetaMask/number-to-bn/pull/24
- https://github.com/MetaMask/number-to-bn/security/dependabot/75
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/number-to-bn/security/dependabot/24
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- https://github.com/MetaMask/number-to-bn/security/dependabot/57
- [x] Extension is using a patched version
- [x] Mobile is using a patched version
- [x] https://github.com/MetaMask/oss-attribution-generator/pull/32
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.