Update dependencies by MoMannn · Pull Request #112 · MetaMask/snap-7715-permissions

MoMannn · 2025-07-16T07:02:01Z

Description

Updating dependency version to resolve security vulnerabilities at the same time pinning dependency version to reduce risk of supply chain attacks.

Manual testing steps

Go to localhost:8000
Make sure that all functionalities still work same as they did before

Pre-merge author checklist

I've followed MetaMask 7715 Permissions Snaps Contributor Docs and MetaMask 7715 Permissions Snaps Coding Standards.
I've completed the PR template to the best of my ability
I’ve included tests if applicable
I’ve documented my code using JSDoc format if applicable

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

into chore/dependency-updates

socket-security · 2025-07-17T11:08:24Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality	Maintenance
	@lavamoat/preinstall-always-fail@2.0.0 ⏵ 2.1.1
	unique-slug@2.0.2 ⏵ 4.0.0		^-4
	unique-filename@1.1.1 ⏵ 3.0.0		^-15
	abbrev@1.1.1 ⏵ 2.0.0
	bare-os@2.2.0 ⏵ 3.6.1		⁺³
	bare-stream@2.6.5
	npm-install-checks@6.3.0
	spdx-correct@3.2.0
	bare-path@2.1.0 ⏵ 3.0.0	⁺¹	⁺¹
	@lavamoat/aa@4.0.0 ⏵ 4.3.3	⁺¹	⁺¹	^-3
	bare-events@2.2.0 ⏵ 2.6.0		⁺²	⁺⁵
	spdx-exceptions@2.3.0 ⏵ 2.5.0	⁺¹	⁺³
	git-hooks-list@3.2.0 ⏵ 4.1.1		⁺⁴
	@isaacs/cliui@8.0.2
	prettier-plugin-packagejson@2.5.10 ⏵ 2.5.18			^-2
	@isaacs/fs-minipass@4.0.1
	jsbn@1.1.0
	@metamask/create-release-branch@4.1.1 ⏵ 4.1.3	^-2		⁺⁴
	eastasianwidth@0.2.0
	minipass-collect@1.0.2 ⏵ 2.0.1
	validate-npm-package-license@3.0.4
	sprintf-js@1.1.3
	isexe@3.1.1
	has-bigints@1.0.2 ⏵ 1.1.0		⁺²
	@humanwhocodes/object-schema@2.0.1 ⏵ 2.0.3
	builtins@5.0.1 ⏵ 5.1.0	⁺¹
	is-builtin-module@3.2.1
	fast-diff@1.2.0 ⏵ 1.3.0		⁺¹
	@pkgjs/parseargs@0.11.0
	@metamask/snaps-sdk@6.24.0 ⏵ 8.1.0	⁺¹	⁺¹
	optionator@0.9.3 ⏵ 0.9.4
	@metamask/snaps-jest@8.16.0 ⏵ 9.3.0	⁺²	⁺¹	⁺²
	slashes@3.0.12
See 87 more rows in the dashboard

View full report

socket-security · 2025-07-17T11:08:26Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

@npmcli/agent@2.2.2
@npmcli/agent@3.0.0
foreground-child@3.3.1
@metamask/snaps-sandbox@1.0.0
fast-diff@1.3.0
diff@5.2.0
react-dom@18.2.0
validate-npm-package-name@5.0.1
unique-slug@5.0.0
@npmcli/fs@4.0.0
unique-filename@4.0.0
abbrev@2.0.0
agent-base@7.1.4

View full report

jeffsmale90

LGTM!

into chore/dependency-updates

…ave an empty line

jeffsmale90 · 2025-07-25T02:22:19Z

@SocketSecurity ignore @npmcli/agent@2.2.2 @npmcli/agent@3.0.0 agent-base@7.1.4 foreground-child@3.3.1 @npmcli/fs@4.0.0 abbrev@2.0.0 diff@5.2.0 fast-diff@1.3.0 react-dom@18.2.0 unique-filename@4.0.0 unique-slug@5.0.0 validate-npm-package-name@5.0.1

The New Authors were investigated, and found to likely be legitimate contributors. The various access endowments were investigated and found to be legitimate.

+----------------------------------------------+----------------+--------------------------------------------+
| Package                                      | Reason         | Finding                                    |
+----------------------------------------------+----------------+--------------------------------------------+
| @npmcli/agent@2.2.2                          | Network access | Networking utility                         |
| @npmcli/agent@3.0.0                          | Network access | Networking utility                         |
| agent-base@7.1.4                             | Network access | Networking utility                         |
| foreground-child@3.3.1                       | Shell access   | Used by glob CLI, not glob lib             |
| @npmcli/fs@4.0.0                             | New Author     | npm-cli-ops                                |
| abbrev@2.0.0                                 | New Author     | lukekarrys                                 |
| diff@5.2.0                                   | New Author     | explodingcabbage                           |
| fast-diff@1.3.0                              | New Author     | luin                                       |
| react-dom@18.2.0                             | New Author     | gnoff                                      |
| unique-filename@4.0.0                        | New Author     | npm-cli-ops                                |
| unique-slug@5.0.0                            | New Author     | npm-cli-ops                                |
| validate-npm-package-name@5.0.1              | New Author     | npm-cli-ops                                |
+----------------------------------------------+----------------+--------------------------------------------+

into chore/dependency-updates

MoMannn · 2025-07-25T09:36:23Z

@SocketSecurity ignore @metamask/snaps-sandbox@1.0.0 We trust packages we produce :)

## **Description** This is a version bump for the preinstalled @metamask/message-signing-snap to v1.1.3 This version solves some security vulnerabilities caused by out of date dependencies. ## **Related issues** Relates to: MetaMask/message-signing-snap#131 Required by: MetaMask/snap-7715-permissions#112 ## **Manual testing steps** No user facing tests ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

MoMannn added 2 commits July 15, 2025 20:24

update node version, bump dependencies

cba2494

bump major version on dependencies

59e1b6b

MoMannn self-assigned this Jul 16, 2025

MoMannn requested a review from a team as a code owner July 16, 2025 07:02

MoMannn added 3 commits July 17, 2025 12:44

Update message-signing-snap dependency to 1.1.3

31b6c19

Merge branch 'main' of https://github.com/MetaMask/snap-7715-permissions

081ff7e

into chore/dependency-updates

Update snap manifest

8d613af

MoMannn changed the title ~~[Draft] Update dependencies~~ Update dependencies Jul 17, 2025

MoMannn requested a review from jeffsmale90 July 17, 2025 11:07

This comment was marked as outdated.

Sign in to view

MoMannn added 2 commits July 17, 2025 13:26

linter fixes

e09e399

linter error fix

3f939f7

This was referenced Jul 17, 2025

chore(deps): bump @metamask/message-signing-snap to v1.1.3 MetaMask/metamask-extension#34364

Merged

chore(deps): bump @metamask/message-signing-snap to v1.1.3 MetaMask/metamask-mobile#17332

Closed

jeffsmale90 previously approved these changes Jul 22, 2025

View reviewed changes

MoMannn added 2 commits July 22, 2025 10:19

Merge branch 'main' of https://github.com/MetaMask/snap-7715-permissions

d638a62

into chore/dependency-updates

update manifest

0b399f0

MoMannn dismissed jeffsmale90’s stale review via 0b399f0 July 22, 2025 08:20

MoMannn requested a review from jeffsmale90 July 22, 2025 08:22

Update linter rule for empty line is js docs and update comments to h…

1b4f823

…ave an empty line

jeffsmale90 previously approved these changes Jul 22, 2025

View reviewed changes

MoMannn added 3 commits July 25, 2025 11:27

Merge branch 'main' of https://github.com/MetaMask/snap-7715-permissions

cda165b

into chore/dependency-updates

fix import order

0dca69a

manifest update

3891047

MoMannn dismissed jeffsmale90’s stale review via 3891047 July 25, 2025 09:29

jeffsmale90 self-requested a review July 25, 2025 09:32

jeffsmale90 approved these changes Jul 25, 2025

View reviewed changes

MoMannn merged commit 3e7e95e into main Jul 25, 2025
16 checks passed

MoMannn deleted the chore/dependency-updates branch July 25, 2025 10:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Update dependencies#112

Update dependencies#112
MoMannn merged 13 commits into
mainfrom
chore/dependency-updates

MoMannn commented Jul 16, 2025 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 17, 2025 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 17, 2025 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

jeffsmale90 left a comment

Uh oh!

jeffsmale90 commented Jul 25, 2025 •

edited

Loading

Uh oh!

MoMannn commented Jul 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

MoMannn commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Manual testing steps

Pre-merge author checklist

Pre-merge reviewer checklist

Uh oh!

socket-security Bot commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

jeffsmale90 left a comment

Choose a reason for hiding this comment

Uh oh!

jeffsmale90 commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MoMannn commented Jul 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

MoMannn commented Jul 16, 2025 •

edited

Loading

socket-security Bot commented Jul 17, 2025 •

edited

Loading

socket-security Bot commented Jul 17, 2025 •

edited

Loading

jeffsmale90 commented Jul 25, 2025 •

edited

Loading