Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release/core contracts/11 #10935

Closed
wants to merge 200 commits into from

Conversation

pahor167
Copy link
Contributor

Description

A few sentences describing the overall effects and goals of the pull request's commits.
What is the current behavior, and what is the updated/expected behavior with this PR?

Other changes

Describe any minor or "drive-by" changes here.

Tested

An explanation of how the changes were tested or an explanation as to why they don't need to be.

Related issues

  • Fixes #[issue number here]

Backwards compatibility

Brief explanation of why these changes are/are not backwards compatible.

Documentation

The set of community facing docs that have been added/modified because of this change

karlb and others added 30 commits June 12, 2023 16:06
* Remove minimum client version set/get/check

According to CIP-53: celo-org/celo-proposals#318

* BlockchainParameters: remove ClientVersion

In the previous commit, all usage of it has been removed. So now we can
remove the state and the initializer params.

* Undo remove ClientVersion from BlockchainParameters

to keep the storage layout identical.

* BlockchainParameters: bump major version

We changed the initializer, so the contract API has changed.
updated github action tests name
to match current circleCI test setup
* added submodules to protocol test matrix

* format

* git submodule checkout in protocol jobs

* Fix protocol cache

* Rebuild protocol package

* Minnor change

---------

Co-authored-by: Javier Cortejoso <[email protected]>
* change default timeout to a variable set by env

* updated authentication test

* PR feedback

* fix optinal timout

* PR feedback

* refactor configs

* updated tests
* Upgrade gyp

* Allow later node-gyp version from 6.0.0 line as well
Bumps [knex](https://github.com/knex/knex) from 2.1.0 to 2.4.0.
- [Release notes](https://github.com/knex/knex/releases)
- [Changelog](https://github.com/knex/knex/blob/master/CHANGELOG.md)
- [Commits](knex/knex@2.1.0...2.4.0)

---
updated-dependencies:
- dependency-name: knex
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victoria <[email protected]>
* Trigger GH jobs when there are changes in packages/sdk

* Run all the jobs when pushed to master

* Included more test triggers
Check RPC after geth startup to reduce flakiness

This is meant to avoid the following errors that happens across most
(all?) e2e tests from time to time:
```
 Error: Connection refused or URL couldn't be resolved: http://localhost:8545
  at XMLHttpRequest.request.onreadystatechange (/home/circleci/app/node_modules/web3-providers/dist/web3-providers.cjs.js:759:22)
  at XMLHttpRequestEventTarget.dispatchEvent (/home/circleci/app/node_modules/xhr2-cookies/xml-http-request-event-target.ts:44:13)
  at XMLHttpRequest._setReadyState (/home/circleci/app/node_modules/xhr2-cookies/xml-http-request.ts:219:8)
  at XMLHttpRequest._onHttpRequestError (/home/circleci/app/node_modules/xhr2-cookies/xml-http-request.ts:379:8)
  at ClientRequest.<anonymous> (/home/circleci/app/node_modules/xhr2-cookies/xml-http-request.ts:266:37)
  at Socket.socketErrorListener (_http_client.js:406:9)
  at emitErrorNT (internal/streams/destroy.js:92:8)
  at emitErrorAndCloseNT (internal/streams/destroy.js:60:3)
  at processTicksAndRejections (internal/process/task_queues.js:80:21)
```

I am not sure this actually works as intended, but I could not reproduce
the problem after this change, anymore. So it is worth testing it out,
as we can easily revert the change or improve the approach.
#10109 did not update the
file as expected by CI. Running `yarn install` provided the expected
lock file.
* Removed terraform (non-public) and celotool commands
* Using gasLimit in hash if present

to make the slasher test work when gasLimit is added to the header in
celo-org/celo-blockchain#2062. This function
will change again as part of
celo-org/celo-blockchain-planning#100.

* Use constant header fields in hash if present

Related to celo-org/celo-blockchain#2124

* Update header hashing for eth compat

Required to support both old headers and Eth-compatible headers.
See celo-org/celo-blockchain-planning#100
CIP-35 support is dropped in Gingerbread, so that hard fork must be
turned off to test CIP-35.
* chore: remove binanceus from usdc configs

* chore: remove bitso and kraken too
* Remove terraform-modules-public package

* Remove terraform library in celotool

* remove reference to deleted packages

* Update cannonical readme

* Updated phone-utils package doc
Update to v8.
Significant change: issues get closed as `not planned` as opposed to `completed`.
* Test error when skipping circleci jobs

* Dummy circleci job

* Run no-changes always
* Updates DB timeout to use .env variable.
 Use constant as fallback

* update ODIS to use env var & constants as fallback

* increase test timeout

* cleanup

* lint fix

* format

* PR comments

* forgotten pr feedback

* happier linter

---------

Co-authored-by: Javier Cortejoso <[email protected]>
Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.13 to 3.9.17.
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md)
- [Commits](patriksimek/vm2@3.9.13...3.9.17)

---
updated-dependencies:
- dependency-name: vm2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Victoria <[email protected]>
* Node 18

* update truffle-ganache-ethereumjs dependencies

* fix build errors

* split migration into JS & TS dir

* build with latest node 18.14

* -- ganache.server promise wrapper
∆ ganache.server option format

* ignore migrations_ts js files

* sync with master

* added resolutions

* remove lib

* removed leftover old dependencies

* fixed revert assersion error message

* WIP notes

* WIP todos

* updated web3 & ethereumjs in utils & protocol

* ++ ethereum-cryptography dependency

* Merge branch 'soloseng/fixing-gas-price'

* timeout fix

* -- comments

* Fixed overflow test

* Merge branch 'soloseng/ast-version_fix'

* using istanbul hardfork

* ++ yarn.lock

* update ganache & ethereumjs version

* - removed resolutions
- using fixed node-fetch types version

* built using latest web3

* Updated ganache config

* Specify gas and await tx receipt

* updated dependencies to fix cross-fecth bind error

* updated yarn.lock

* updated node version in circleci docker file

* updated expected error message

* ensure leading 0x instead of trimming

* increased jest version

* Node 18.16.0

* - update node-fetch
- manage migrations folder during build and clean

* yarn installed using node 18.16.0

* Appease linter

* fixed import issue

* use devchain chain copy

* using fixed jest version

* disabled flake-traker

* generated CLI docs

* buypass jest_setup
in phone-number-privacy/combiner

* ignored ts error due to properties mismatch

* ++ @types/node-fetch

* yarn.lock

* using same @types/node-fetch where applicable

* ts-ignored for abort-controller

* Fix broken kit headers test

* temp force exit on contractkit test

* no detectOpenHandles

* Fix cross-fetch jest mocking issues

* lint fix

* disabled verbose logs during testing

* disabled rpc log in protocol test

* Disabled:
- pre-protocol-test-release
- protocol-test-release

* removed disabled jobs from workflow

* supress test logs

* disabled protocol test

* disabling flakey summary

* disabled odis test

* increased resource class to xlarge

* enaled protocol and odis CI test

* re-enabled
pre-protocol-test-release
protocol-test-release

* enable phone-number-privacy test logs

* Fixing mocha issues in celotool tests

* Change node to 18.14.0

* Node 18.14.2

* changed uniswap init code hash

* Revert "changed uniswap init code hash"

This reverts commit e8a0499.

* fix unicode char in datetime format

* Update e2e test docker image

* verbose output

* Pre-review cleanup

* appease linter

* removed dead code
comment cleanup

* deprecate defaultRpcCaller for httpRpcCaller
This allows compatibility with latest web3

* updated ganache-dev command

* appease linter

* updated revert assertion with message

* downgraded truffle

* updated truffle version and config

* add web3*@1.8.2 to resolutions

* Fixed stability test

* removed resolutions

* updated yarn lock

* updated governance/network test revert messages

* updated protocol common test revert assertion msg

* appease linter

* using assertRevertWithReason
in governance/validators

* using assertRevertWithReason in governance/voting

* angry linter

* using assertRevertWithReason in identity/

* fix linter issue

* using `@ethereumjs/rlp` for RLP encoding

* linter fix

* updated web3* dependencies

* specify type of transaction

* removed verbose output

* added `assertRevertWithoutReason()`

* linting fix

* added revert without msg for identity test

* updated deprecated functions

* distinguish between
transaction reverts and view call reverts

* fixed typing ignore

* specified gas, as gas estimations fails

* updated revert message in test

* updated yarn lock

* updated yarn lock again

* change docker image path

* updated revert msg to match contract

* updated docs to match current node version

* tracking issue in comment

* specified chain id

* revert to default verbose output

* removed debud logging

* GH Workflows run in node18 runners

* Force new node cache

* Disable flake-tracker

* prettify

* Updated test to revert with message

* quiet test

* fixed build errors

* updated scripts to better handle ts & js files

* moved `artifactSingleton` file to lib/

* added transaction type when using mento artifacts

* fix Migration test

* allow submodules in e2e matrix

* python2 -> python (3)

* using nvm to switch to node12 for pre-release test

* ∆ to trigger GH action

* ∆ to trigger full test in GH actions

* Using nvm for circleci image

* Do not use nvm with circleci

* use node12 to generate old release devchain

* reset and reinstall before cleaning

* set python2 in release branch

* installed python2

* added log

* removed python2 install script

* set new release tag

* trigger all test

* WIP comments

* trigger all test

* CircleCi Build pre-protocol with node12

* Circle node12 fix

* Adding python 2 and 3 to circleci image

* run devchain from tar in detached mode

* ++ comments

* updated release tag in circleCI config

* Replace pull_request by pull_request_target

* bump MTWdeployer patch version

* testing bypass dryrun

* loggin and force CI run

* removed false param

* revert change and added try catch

* moved await

* added type to tx detail

* included tx type in contract deployment

* increased logging level in ganache and truffle

* specified gas to deployment tx

* removed truffle debug logging

* keep chaincopy

* removed debug logs

* clean up redundant install
++ comment

* revert GH action trigger on current branch push

* remove comments

* remove gas specfication

* updated node version in docs

* unskip migration test

* PR feedback

* revert back to skip

* ∆ forked packages to celo namespace

* reinstalled

* cleanup TODO and comments

* python -> python3

* updated node base images to 18

* python -> python3

* Updated netcat dependency

* Fix build

* Fix build docker

* force GH action test

* removed flake-tracker

---------

Co-authored-by: Daniel Kesler <[email protected]>
Co-authored-by: Javier Cortejoso <[email protected]>
Co-authored-by: Javier Cortejoso <[email protected]>
* Update circleci.yml
* Remove TODOs comments

---------

Co-authored-by: Javier Cortejoso <[email protected]>
* ReleaseGold refund test fix

* gas fix
* removed legacy code

* ∆ PnpSignAction and PnpQuotaService
to non-abstract class

* renamed variable

* removed empty test

* lowered coverage threshold by 3%

* add back legacy accounts table for now (#10450)

* update sdk/identity

* deprecate `endpoint` variable

* removed todo comment

* removed commented var

* increased fetch_depth

* increase all fetch_depth

* ∆ `pull_request_target` to `pull_request`

* bump version

* remove endpoint var from call to ODIS

* decreased code coverage to threshold to 76%

---------

Co-authored-by: Alec Schaefer <[email protected]>
* ReleaseGold refund test fix

* gas fix

* PR comments

* removal of comment

* Cli fix 2
* odis-tracing-node18

* yarn command

* Test again

* Pray

* Pray 2

* Pray 3

* Pray 4

* endpoint traces

* Error trace

* Span in io.ts

* Handle errors - OK

* Fix if

* IO tracing

* Common IO tracing

* Event messages

* Authenticate tracing

* Sign tracing

* Span end

* Span ends

* Controller span

* NodeTracerProvider

* Trace names

* Instrumentations

* No ExpressInstrumentation

* Remove parentSpan

* Request

* Ignore paths

* parentSpan

* Ignore more paths

* knex instrumentation

* Knex instrumentation

* Full node inst + manual

* ignoreIncomingPaths for http inst

* Comments

* No cache build

* Common packages

* TSlint error 1

* TSlint error 2

* TSlint errors

* TSlint errors shorthand

* // tslint:disable-next-line:no-floating-promises

* Fix tests?
renovate bot and others added 11 commits January 23, 2024 18:55
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* replace tslint with eslint for typescript

* remove many unneeded awaits and asyncs
* change console logs to console info
* ignore some more offensive files
* fix some interprolated values which could have been [object object]
* add missing dependencies
* try to have minimal changes

* use tsconfig/recommended instead of our tsconfig library as base.
Fix env tests use of typescript 4.0
for protocol package cannot extend because of bug in ts-node so instead just copy the config.
remove tslint.json files

* fix lint again

* dont add strict mode, its too brutal,

* add package validation

* help out future devs with instructions on how to fix error

* it works on my machine ok

* trust but verify. but dont actually trust

* use latest ts-node AND always run yarn ts-node to ensure the project one is used.

* removing patch-package since the only remaining place it was used was had been for tslint

* most of us dont need to decrypt to dont try automatically

* i think running in yarn added extra output that broke gh action so try this otherwise revert

* structs fro sol contracts are returned as objects with named keys (as well as number keys) but NOT as arrays.
* Sorted oracles update

* integration test fixes

* constants added

* Update packages/protocol/contracts/stability/SortedOracles.sol

Co-authored-by: Martín Volpe <[email protected]>

* Removal of Mento reference

* Update packages/protocol/test-sol/stability/SortedOracles.t.sol

Co-authored-by: soloseng <[email protected]>

* Update packages/protocol/test-sol/stability/SortedOracles.t.sol

Co-authored-by: soloseng <[email protected]>

* PR comments

* Equivalent tokens on top of updated sorted oracles  (Based of CR10) (#10904)

* Brought changes from https://github.com/celo-org/celo-monorepo/pull/10895/files#diff-ba272032c5f1b7e89d5777b3c886685b581324bdf22733ee272e2790f5d631df

* Fuzzy added

---------

Co-authored-by: pahor167 <[email protected]>

* prettify fix

---------

Co-authored-by: Martín Volpe <[email protected]>
Co-authored-by: soloseng <[email protected]>
* FeeCurrency Adapter

* PR comments

* Format documents

* gitmodules

* submodules added

* solidity version fix

* OZ contracts same commit as master

* Revert "OZ contracts same commit as master"

This reverts commit 8d8f2d6.

* OZ to same commit as master

* Getter&Setter for wrapped token

* Proxy added

* split of FeeCurrencyAdapter

* prettier fix

* refactor

* Update packages/protocol/test-sol/stability/FeeCurrencyAdapter.t.sol

Co-authored-by: Martín Volpe <[email protected]>

* PR comments

* PR comments

* Decimals + Total supply added

* Update packages/protocol/contracts-0.8/stability/FeeCurrencyAdapter.sol

* Update packages/protocol/contracts-0.8/stability/FeeCurrencyAdapter.sol

* Trigger

* Wrapper reference removed

* interface added

---------

Co-authored-by: Martín Volpe <[email protected]>
Co-authored-by: Tim Moreton <[email protected]>
Co-authored-by: alvarof2 <[email protected]>
* Fix for historical vote records

* contractkit fix

* lint fix

* Governance version update

* PR comments

* extended test

* Remove console.log

* Test

* lint fix

* version fix

* version fix

---------

Co-authored-by: Martín Volpe <[email protected]>
* Update Dockerfiles (#10915)

* Remove references to packages deleted

* Remove circleci dockerfiles and workflow

* Delete reference to patches folder

* Update workload-id-provider in metadata-crawler-build job (#10916)

Use `master` workload-id-provider pool

* fix ganache dependency resolution (#10917)

* fix & cleanup

* fixed resolved field in lock file

* test

* Tooling fix

* lint fix

* revert of gas price minimum

* Update packages/protocol/lib/compatibility/ast-code.ts

Co-authored-by: Martín Volpe <[email protected]>

---------

Co-authored-by: Javier Cortejoso <[email protected]>
Co-authored-by: soloseng <[email protected]>
Co-authored-by: Martín Volpe <[email protected]>
* Removal of SortedOracle multiplier

* removal of comment
@pahor167 pahor167 requested review from a team as code owners February 12, 2024 19:41
@pahor167 pahor167 requested a review from a team February 12, 2024 19:41
@pahor167 pahor167 requested a review from a team as a code owner February 12, 2024 19:41
@pahor167 pahor167 requested review from a team and rkachowski February 12, 2024 19:41
Copy link

socket-security bot commented Feb 12, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@adraffy/[email protected] None 0 429 kB adraffy
npm/@babel/[email protected] None 0 31.6 kB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment +27 6.16 MB nicolo-ribaudo
npm/@celo/[email protected] None 0 4.01 MB app-tooling
npm/@celo/[email protected] Transitive: environment, eval, filesystem, network, shell, unsafe +341 36.5 MB app-tooling
npm/@celo/[email protected] filesystem, network Transitive: environment, eval, shell, unsafe +354 44 MB app-tooling
npm/@celo/[email protected] Transitive: environment, filesystem, network +101 16 MB app-tooling
npm/@celo/[email protected] Transitive: environment, eval, filesystem, network, shell, unsafe +358 85.1 MB app-tooling
npm/@celo/[email protected] environment Transitive: eval, filesystem, network +95 37.4 MB soloseng
npm/@celo/[email protected] Transitive: environment, eval, filesystem, network, shell, unsafe +356 44.3 MB app-tooling
npm/@celo/[email protected] Transitive: environment, eval, filesystem, network, shell, unsafe +386 51.6 MB app-tooling
npm/@celo/[email protected] Transitive: environment +4 164 kB aaron-clabs
npm/@celo/[email protected] None 0 3.98 kB app-tooling
npm/@celo/[email protected] filesystem Transitive: environment, unsafe +30 47.4 MB aaron-clabs
npm/@celo/[email protected] Transitive: environment, eval, filesystem, network, shell, unsafe +349 39.2 MB app-tooling
npm/@esbuild/[email protected] None 0 10.9 MB evanw
npm/@esbuild/[email protected] None 0 9.04 MB evanw
npm/@esbuild/[email protected] None 0 10.9 MB evanw
npm/@esbuild/[email protected] None 0 8.86 MB evanw
npm/@esbuild/[email protected] None 0 9.23 MB evanw
npm/@esbuild/[email protected] None 0 8.19 MB evanw
npm/@esbuild/[email protected] None 0 8.75 MB evanw
npm/@esbuild/[email protected] None 0 8.32 MB evanw
npm/@esbuild/[email protected] None 0 8.19 MB evanw
npm/@esbuild/[email protected] None 0 8.31 MB evanw
npm/@esbuild/[email protected] None 0 8.59 MB evanw
npm/@esbuild/[email protected] None 0 9.5 MB evanw
npm/@esbuild/[email protected] None 0 8.32 MB evanw
npm/@esbuild/[email protected] None 0 8.39 MB evanw
npm/@esbuild/[email protected] None 0 9.04 MB evanw
npm/@esbuild/[email protected] None 0 8.76 MB evanw
npm/@esbuild/[email protected] None 0 8.73 MB evanw
npm/@esbuild/[email protected] None 0 8.76 MB evanw
npm/@esbuild/[email protected] None 0 8.74 MB evanw
npm/@esbuild/[email protected] None 0 8.25 MB evanw
npm/@esbuild/[email protected] None 0 8.55 MB evanw
npm/@esbuild/[email protected] None 0 8.9 MB evanw
npm/@eslint-community/[email protected] Transitive: environment, eval, filesystem, shell, unsafe +90 10.7 MB eslint-community-bot
npm/@eslint-community/[email protected] None 0 431 kB eslint-community-bot
npm/@google-cloud/[email protected] Transitive: environment, filesystem, network, shell +74 28.1 MB google-wombot
npm/@isaacs/[email protected] None +14 298 kB isaacs
npm/@noble/[email protected] None +1 2.04 MB paulmillr
npm/@pkgjs/[email protected] None 0 74.2 kB oss-bot
npm/@summa-tx/[email protected] None 0 41.4 kB prestwich
npm/@tsconfig/[email protected] None 0 2.37 kB typescript-deploys
npm/@types/[email protected] None 0 862 kB types
npm/@types/[email protected] None 0 2.7 kB types
npm/@types/[email protected] None +2 1.77 MB types
npm/@typescript-eslint/[email protected] Transitive: environment, eval, filesystem, shell, unsafe +118 48.4 MB jameshenry
npm/@typescript-eslint/[email protected] Transitive: environment, eval, filesystem, shell, unsafe +113 45.3 MB jameshenry
npm/@wagmi/[email protected] environment, filesystem Transitive: network, shell, unsafe +154 261 MB awkweb
npm/[email protected] environment, filesystem +12 5.25 MB trentm
npm/[email protected] None 0 3.71 kB muji
npm/[email protected] filesystem +3 144 kB muji
npm/[email protected] Transitive: eval +7 156 kB ljharb
npm/[email protected] Transitive: eval +59 4.34 MB ljharb
npm/[email protected] filesystem, unsafe Transitive: environment, eval, shell +173 17.2 MB ljharb
npm/[email protected] None 0 32.3 kB eslintbot
npm/[email protected] environment, filesystem Transitive: eval, shell, unsafe +90 10.7 MB eslintbot
npm/[email protected] None +3 662 kB eslintbot
npm/[email protected] None +2 7.67 MB endless
npm/[email protected] shell Transitive: environment, filesystem +7 189 kB isaacs
npm/[email protected] Transitive: eval +59 4.34 MB ljharb
npm/[email protected] eval +4 110 kB ljharb
npm/[email protected] environment, filesystem, shell 0 6.44 kB typicode
npm/[email protected] Transitive: eval +15 304 kB ljharb
npm/[email protected] environment +16 625 kB isaacs
npm/[email protected] filesystem +3 1.08 MB isaacs
npm/[email protected] None 0 9.39 kB medikoo
npm/[email protected] Transitive: eval +14 301 kB ljharb
npm/[email protected] environment, filesystem Transitive: shell +32 2.92 MB isaacs
npm/[email protected] Transitive: eval +10 204 kB ljharb
npm/[email protected] Transitive: eval +59 4.34 MB ljharb
npm/[email protected] Transitive: eval +59 4.34 MB ljharb
npm/[email protected] Transitive: eval +59 4.34 MB ljharb
npm/[email protected] Transitive: environment, eval, filesystem, network, shell, unsafe +565 188 MB rkalis
npm/[email protected] filesystem Transitive: environment, unsafe +15 13.4 MB krzkaczor
npm/[email protected] environment, filesystem, unsafe +18 35.8 MB blakeembrey
npm/[email protected] None +1 57.9 kB gkz
npm/[email protected] Transitive: environment, filesystem, network, unsafe +74 55.4 MB zemse
npm/[email protected] Transitive: environment, filesystem, unsafe +29 47.3 MB ethereum-ts-bot
npm/[email protected] None 0 32 MB typescript-bot
npm/[email protected] Transitive: eval +14 287 kB ljharb

🚮 Removed packages: npm/@apidevtools/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@azure/[email protected], npm/@babel/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@colors/[email protected], npm/@dabh/[email protected], npm/@ethereumjs/[email protected], npm/@ethereumjs/[email protected], npm/@firebase/[email protected], npm/@firebase/[email protected], npm/@firebase/[email protected], npm/@firebase/[email protected], npm/@firebase/[email protected], npm/@google-cloud/[email protected], npm/@google-cloud/[email protected], npm/@google-cloud/[email protected], npm/@ledgerhq/[email protected], npm/@ledgerhq/[email protected], npm/@ledgerhq/[email protected], npm/@mapbox/[email protected], npm/@mrmlnc/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@oclif/[email protected], npm/@octokit/[email protected], npm/@octokit/[email protected], npm/@octokit/[email protected], npm/@opentelemetry/[email protected], npm/@panva/[email protected], npm/@soloseng/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], pypi/[email protected], pypi/[email protected], pypi/[email protected], pypi/[email protected]

View full report↗︎

Copy link

socket-security bot commented Feb 12, 2024

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSource
Install scripts npm/[email protected]
Native code npm/@celo/[email protected]
Native code npm/@celo/[email protected]
Native code npm/@celo/[email protected]
Native code npm/@celo/[email protected]

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

What's wrong with native code?

Contains native code which could be a vector to obscure malicious code, and generally decrease the likelihood of reproducible or reliable installs.

Ensure that native code bindings are expected. Consumers may consider pure JS and functionally similar alternatives to avoid the challenges and risks associated with native code bindings.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@lvpeschke lvpeschke removed request for a team and rkachowski March 1, 2024 16:13
@pahor167 pahor167 closed this Mar 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.