Migrate `@metamask/eth-json-rpc-provider` into core monorepo #1707

MajorLift · 2023-09-22T20:31:16Z

Explanation

References

Changelog

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've highlighted breaking changes using the "BREAKING" category above as appropriate

The package manifest, README, and PR template have been updated.

* Migrate both provider functions The functions `providerFromEngine` and `providerFromMiddleware` have been migrated from `@metamask/eth-json-rpc-middleware`. The `SafeEventEmitterProvider` is now a class with its own separate module, rather than a type. Hopefully this will help prevent future type errors. The error in the `SafeEventEmitterProvider` type in `@metamask/eth-json-rpc-middleware` has been corrected; the response in in the callback is now optional. Everything should be fully documented and tested. * Export type * Fix spelling mistake Co-authored-by: Alex Donesky <alex.donesky@consensys.net> * Improve test names --------- Co-authored-by: Alex Donesky <alex.donesky@consensys.net>

Bumps [@metamask/eslint-config-jest](https://github.com/MetaMask/eslint-config) from 11.0.0 to 11.1.0. - [Release notes](https://github.com/MetaMask/eslint-config/releases) - [Commits](MetaMask/eslint-config@v11.0.0...v11.1.0) --- updated-dependencies: - dependency-name: "@metamask/eslint-config-jest" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [@metamask/eslint-config](https://github.com/MetaMask/eslint-config) from 11.0.2 to 11.1.0. - [Release notes](https://github.com/MetaMask/eslint-config/releases) - [Commits](MetaMask/eslint-config@v11.0.2...v11.1.0) --- updated-dependencies: - dependency-name: "@metamask/eslint-config" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mark Stacey <markjstacey@gmail.com>

Bumps [@metamask/eslint-config-typescript](https://github.com/MetaMask/eslint-config) from 11.0.2 to 11.1.0. - [Release notes](https://github.com/MetaMask/eslint-config/releases) - [Commits](MetaMask/eslint-config@v11.0.2...v11.1.0) --- updated-dependencies: - dependency-name: "@metamask/eslint-config-typescript" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mark Stacey <markjstacey@gmail.com>

Bumps [@metamask/eslint-config-nodejs](https://github.com/MetaMask/eslint-config) from 11.0.1 to 11.1.0. - [Release notes](https://github.com/MetaMask/eslint-config/releases) - [Commits](MetaMask/eslint-config@v11.0.1...v11.1.0) --- updated-dependencies: - dependency-name: "@metamask/eslint-config-nodejs" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mark Stacey <markjstacey@gmail.com>

The version has been changed to v0.0.1 so that the first release can be v1. I set this to v1 forgetting that our release automation would also attempt to set this.

* 1.0.0 * Update changelog --------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: Mark Stacey <markjstacey@gmail.com>

* deps: @metamask/safe-event-emitter@^2.0.0->^3.0.0 * deps: migrate from json-rpc-engine to @metamask/json-rpc-engine

--------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: legobt <6wbvkn0j@anonaddy.me>

v1.0.1 contains two changes that should have been considered semver-major: - Type-interface incompatability with previous version (MetaMask/json-rpc-engine#139) - Introduced dependency `@metamask/json-rpc-engine` indicates a minimum supported Node.js version of 16. This prevents the module from installing on some package manager configurations, like default yarn classic. This will be re-released as v2.0.0.

Required by update of `@metamask/json-rpc-engine` (#16)

This reverts commit 5d8309f.

Required by update of `@metamask/json-rpc-engine` (#16)

--------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: legobt <6wbvkn0j@anonaddy.me>

…25) * deps: @metamask/utils@^5.0.1->^8.1.0 * deps: @metamask/json-rpc-engine@^7.0.0->^7.1.0 * deps: @metamask/utils@^7.1.0->^8.1.0

--------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: legobt <6wbvkn0j@anonaddy.me> Co-authored-by: legobeat <109787230+legobeat@users.noreply.github.com> Co-authored-by: Maarten Zuidhoorn <maarten@zuidhoorn.com>

Closes #1682

…norepo - added: `eslint-plugin-promise` - removed: `eslint-plugin-node` Closes #1683

…rovider`

…po settings

…ted dependency graph.

socket-security · 2023-09-22T22:26:09Z

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
jest-it-up	2.2.0	filesystem, environment	`+16`	533 kB	rbardini
@metamask/keyring-api	0.2.5...0.2.6	None	`+38/-50`	28.3 MB	metamaskbot
jest-when	3.5.2...3.6.0	None	`+30/-24`	18.2 MB	timkindberg

🚮 Removed packages: @lavamoat/allow-scripts@2.3.1, @metamask/contract-metadata@2.3.1, @metamask/snaps-controllers@1.0.1, @metamask/snaps-utils@1.0.1, @types/lodash@4.14.195

socket-security · 2023-09-22T22:26:12Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Issue	Package	Version	Note	Source
Network access	ws	7.5.9	Module: tls Location: lib/sender.js +7 more instances...	@metamask/eslint-config-jest@12.1.0, @metamask/eth-json-rpc-provider@0.0.0-use.local, @metamask/keyring-api@0.2.6, eslint-plugin-jest@27.4.0, jest@27.5.1, jest-environment-jsdom@27.5.1, jest-when@3.6.0, ts-jest@27.1.5 via `package.json` @metamask/keyring-api@0.2.6, jest@27.5.1, ts-jest@27.1.5 via `packages/accounts-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/address-book-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/announcement-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/approval-controller/package.json` @metamask/network-controller@12.2.0, jest@27.5.1, jest-environment-jsdom@27.5.1, ts-jest@27.1.5 via `packages/assets-controllers/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/base-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/composable-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/controller-utils/package.json` @metamask/network-controller@12.2.0, jest@27.5.1, ts-jest@27.1.5 via `packages/ens-controller/package.json` @metamask/eslint-config-jest@12.1.0, eslint-plugin-jest@27.4.0, jest@27.5.1, ts-jest@27.1.5 via `packages/eth-json-rpc-provider/package.json` @metamask/network-controller@12.2.0, jest@27.5.1, jest-when@3.6.0, ts-jest@27.1.5 via `packages/gas-fee-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/keyring-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/logging-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/message-manager/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/name-controller/package.json` jest@27.5.1, jest-when@3.6.0, ts-jest@27.1.5 via `packages/network-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/notification-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/permission-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/phishing-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/preferences-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/rate-limit-controller/package.json` @metamask/network-controller@12.2.0, jest@27.5.1, ts-jest@27.1.5 via `packages/selected-network-controller/package.json` jest@27.5.1, ts-jest@27.1.5 via `packages/signature-controller/package.json` @metamask/network-controller@12.2.0, jest@27.5.1, ts-jest@27.1.5 via `packages/transaction-controller/package.json`
New author	@lavamoat/aa	3.1.5	New Author: boneskull Previous Author: naugtur
Unstable ownership	@lavamoat/aa	3.1.5	Author: boneskull
No README	@inquirer/core	0.0.15-alpha.0	Location: Package overview	@metamask/eth-json-rpc-provider@0.0.0-use.local, jest-it-up@2.2.0 via `package.json` @metamask/network-controller@12.2.0 via `packages/assets-controllers/package.json` @metamask/network-controller@12.2.0 via `packages/ens-controller/package.json` jest-it-up@2.2.0 via `packages/eth-json-rpc-provider/package.json` @metamask/network-controller@12.2.0 via `packages/gas-fee-controller/package.json` @metamask/network-controller@12.2.0 via `packages/selected-network-controller/package.json` @metamask/network-controller@12.2.0 via `packages/transaction-controller/package.json`
Shell access	@metamask/snaps-controllers	2.0.0	Module: child_process Location: dist/cjs/services/node/NodeProcessExecutionService.js +1 more instances...	@metamask/keyring-api@0.2.6 via `package.json` @metamask/keyring-api@0.2.6 via `packages/accounts-controller/package.json`
Shell access	@metamask/snaps-utils	2.0.0	Module: child_process Location: dist/cjs/eval.js +1 more instances...	@metamask/keyring-api@0.2.6 via `package.json` @metamask/keyring-api@0.2.6 via `packages/accounts-controller/package.json`

Next steps

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

What is new author?

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

What is unstable ownership?

A new collaborator has begun publishing package versions. Package stability and security risk may be elevated.

Try to reduce the amount of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Why are READMEs important?

Package does not have a README. This may indicate a failed publish or a low quality package.

Add a README to to the package and publish a new version.

What is shell access?

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore @inquirer/core@0.0.15-alpha.0
@SocketSecurity ignore @lavamoat/aa@3.1.5
@SocketSecurity ignore @metamask/snaps-controllers@2.0.0
@SocketSecurity ignore @metamask/snaps-utils@2.0.0
@SocketSecurity ignore ws@7.5.9

legobeat · 2023-09-25T05:57:07Z

I think this should not be merged before bumping workspace dependencies on the package in line with latest:

deps: Bump @metamask/{eth-json-rpc-provider,rpc-errors} #1653

mikesposito · 2023-09-25T09:37:52Z

@MajorLift perhaps would be better to break down this PR into multiple ones to make it easier to see and review the changes, and creating the first two PRs on the original repository:

MajorLift · 2023-09-25T19:02:04Z

Thanks for the feedback! I'll be closing this PR and reopening it.

@legobeat Thanks for pointing this out. It looks like using the latest version of @metamask/utils is necessary to clear the errors currently showing up in CI. I'll bump it in the new PR.

@mikesposito I just opened the first two PRs on the original repo. It's looking like most of the commits will happen on the last PR after the merging step.

Gudahtt and others added 26 commits February 8, 2023 18:30

Initial commit

8a2290f

Initial repository setup (#5)

504a752

The package manifest, README, and PR template have been updated.

Decrement version ahead of v1 release (#7)

5f652b1

The version has been changed to v0.0.1 so that the first release can be v1. I set this to v1 forgetting that our release automation would also attempt to set this.

1.0.0 (#8)

328a43e

* 1.0.0 * Update changelog --------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: Mark Stacey <markjstacey@gmail.com>

deps: Switch from json-rpc-engine to @metamask/json-rpc-engine (#16)

c4eb3e3

* deps: @metamask/safe-event-emitter@^2.0.0->^3.0.0 * deps: migrate from json-rpc-engine to @metamask/json-rpc-engine

1.0.1 (#18)

06c41f6

--------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: legobt <6wbvkn0j@anonaddy.me>

BREAKING: Update minimum Node.js version to 16 (#20)

5d8309f

Required by update of `@metamask/json-rpc-engine` (#16)

Revert "BREAKING: Update minimum Node.js version to 16 (#20)" (#22)

d8c8315

This reverts commit 5d8309f.

BREAKING: Update minimum Node.js version to 16 (#23)

9e24300

Required by update of `@metamask/json-rpc-engine` (#16)

2.0.0 (#21)

de124c4

--------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: legobt <6wbvkn0j@anonaddy.me>

deps: @metamask/utils@^5.0.1->^8.1.0; bump @metamask/json-rpc-engine (#…

b0cea6f

…25) * deps: @metamask/utils@^5.0.1->^8.1.0 * deps: @metamask/json-rpc-engine@^7.0.0->^7.1.0 * deps: @metamask/utils@^7.1.0->^8.1.0

2.1.0 (#26)

0aa45a9

--------- Co-authored-by: github-actions <github-actions@github.com> Co-authored-by: legobt <6wbvkn0j@anonaddy.me> Co-authored-by: legobeat <109787230+legobeat@users.noreply.github.com> Co-authored-by: Maarten Zuidhoorn <maarten@zuidhoorn.com>

Decrement TypeScript to ~4.6.3 ahead of migration to core monorepo

6a144f5

Closes #1682

Update packages for eslint and prettier ahead of migration to core mo…

5a89d45

…norepo - added: `eslint-plugin-promise` - removed: `eslint-plugin-node` Closes #1683

merge eth-json-rpc-provider

e89f401

Remove unnecessary files for migration into core monorepo

a97a524

Move eth-json-rpc-provider submodule into packages directory.

09ed204

upgrade downstream version requirements for `@metamask/eth-json-rpc-p…

f00da30

…rovider`

downgrade eth-json-rpc-provider dependency versions to match monore…

2f5ce82

…po settings

fixes for eth-json-rpc-provider package.json formatting and content

e0325a8

MajorLift added dependencies Pull requests that update a dependency file team-wallet-framework labels Sep 22, 2023

MajorLift self-assigned this Sep 22, 2023

update yarn lock file

bb22f00

MajorLift added 4 commits September 22, 2023 14:08

update README to include @metamask/eth-json-rpc-provider and upda…

c810fb1

…ted dependency graph.

Merge branch 'main' into 230921-migrate-eth-json-rpc-provider

b324ec7

regenerate yarn lock file to resolve conflicts

7916889

downgrade @metamask/eslint-config version

72ae659

MajorLift force-pushed the 230921-migrate-eth-json-rpc-provider branch from f6738df to 72ae659 Compare September 22, 2023 22:23

MajorLift added the enhancement New feature or request label Sep 22, 2023

MajorLift closed this Sep 25, 2023

MajorLift mentioned this pull request Sep 25, 2023

Decrement TypeScript to ~4.6.3 ahead of migration to core monorepo MetaMask/eth-json-rpc-provider#27

Closed

MajorLift deleted the 230921-migrate-eth-json-rpc-provider branch October 17, 2023 19:35

This comment was marked as spam.

Sign in to view

MetaMask locked as spam and limited conversation to collaborators Oct 23, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migrate `@metamask/eth-json-rpc-provider` into core monorepo #1707

Migrate `@metamask/eth-json-rpc-provider` into core monorepo #1707

MajorLift commented Sep 22, 2023 •

edited

Loading

socket-security bot commented Sep 22, 2023

socket-security bot commented Sep 22, 2023

legobeat commented Sep 25, 2023

mikesposito commented Sep 25, 2023

MajorLift commented Sep 25, 2023

This comment was marked as spam.

Migrate @metamask/eth-json-rpc-provider into core monorepo #1707

Migrate @metamask/eth-json-rpc-provider into core monorepo #1707

Conversation

MajorLift commented Sep 22, 2023 • edited Loading

Explanation

References

Changelog

Checklist

socket-security bot commented Sep 22, 2023

socket-security bot commented Sep 22, 2023

Next steps

legobeat commented Sep 25, 2023

mikesposito commented Sep 25, 2023

MajorLift commented Sep 25, 2023

This comment was marked as spam.

Migrate `@metamask/eth-json-rpc-provider` into core monorepo #1707

Migrate `@metamask/eth-json-rpc-provider` into core monorepo #1707

MajorLift commented Sep 22, 2023 •

edited

Loading