fix(deps): migrate from react-native-aes-crypto-forked to @metamask/react-native-aes-crypto #9540
+9
−29
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
legobeat
added
dependencies
|
New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
🚮 Removed packages: npm/react-native-aes-crypto-forked@1.2.1 |
legobeat
force-pushed
the
deps-mm-react-native-aes-crypto
branch
from
20011ca
to
df9d0da
Compare
|
|
iOS build error needs resolving: I do not have access to a Mac and might need some assistance to figure out why this is happening here. |
legobeat
added
Run Smoke E2E
|
legobeat
force-pushed
the
deps-mm-react-native-aes-crypto
branch
2 times, most recently
from
3bbf657
to
55ec4c6
Compare
legobeat
added
Run Smoke E2E
|
legobeat
force-pushed
the
deps-mm-react-native-aes-crypto
branch
3 times, most recently
from
0dfba57
to
6ee5042
Compare
|
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again.
Next stepsWhat is new author?A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package. Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. What is unstable ownership?A new collaborator has begun publishing package versions. Package stability and security risk may be elevated. Try to reduce the amount of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
legobeat
force-pushed
the
deps-mm-react-native-aes-crypto
branch
3 times, most recently
from
0acc26f
to
b8331c7
Compare
legobeat
force-pushed
the
deps-mm-react-native-aes-crypto
branch
from
b8331c7
to
c8a6259
Compare
legobeat
force-pushed
the
deps-mm-react-native-aes-crypto
branch
2 times, most recently
from
59b1418
to
62189d5
Compare
legobeat
force-pushed
the
deps-mm-react-native-aes-crypto
branch
from
62189d5
to
69477bb
Compare
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Instead of pulling in
react-native-aes-crypto-forkedfrom a git-commit and then patching it (!(?)), this migrates to a published version of the package under the name@metamask/react-native-aes-cryptowith the same effect.The separate dependency
react-native-aes-cryptois left unaddressed.Related issues
Manual testing steps
Screenshots/Recordings
Before
After
Pre-merge author checklist
Pre-merge reviewer checklist