MetaMask / MetaMask/metamask-extension

(Ext) Upgrade trezor/connect-web package and reactivate it in yarn audit

Open
#30,851 0 comments 0 reactions 0 assignees View on GitHub
extension INVALID-ISSUE-TEMPLATE team-accounts-framework
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

**What is this about?**

We have deactivated the yarn audit check for `trezor/connect-web` package, because updating this package breaks the webpack build.

We need to find a way to safely upgrade to the new version without breaking the webpack build

Related slack discussion: https://consensys.slack.com/archives/CTQAGKY5V/p1741276386883729
Related PR to ignore the audit check: https://github.com/MetaMask/metamask-extension/pull/30850

**Stakeholder review needed before the work gets merged**

- [ ] Engineering (needed in most cases)
- [ ] Design
- [ ] Product
- [ ] QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- [ ] Security
- [ ] Legal
- [ ] Marketing
- [ ] Management (please specify)
- [ ] Other (please specify)

Contributor guide

Open the contributing guide

Research direction

Start by locating the yarn audit configuration for trezor/connect-web and the webpack build path mentioned in the issue. Determine why the newer package breaks the build; done means the package is upgraded, the audit check is reactivated, and the webpack build succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
webpack
Domain
build-system, security
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.