Skip to content

fix: socket security vulnerabilities #468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 11, 2025
Merged

fix: socket security vulnerabilities #468

merged 1 commit into from
Mar 11, 2025

Conversation

georgewrmarshall
Copy link
Contributor

@georgewrmarshall georgewrmarshall commented Mar 6, 2025 •
edited
Loading

Description

This PR addresses critical security vulnerabilities identified by Socket Security scanning tool, particularly focusing on the critical and high issues that aren't supply chain attacks, which we are protected against by lavamoat

Related issues

Fixes: #467

Manual testing steps

  1. Go to the Socket Report
  2. Check that the versions that have been updated in the resolutions section address versions with vulnerabilities

Screenshots/Recordings

Vulnerabilities addressed

Screenshot 2025-03-06 at 2 56 59 PM Screenshot 2025-03-06 at 3 16 05 PM

Pre-merge author checklist

  • I've followed MetaMask Contributor Docs
  • I've completed the PR template to the best of my ability
  • I've included tests if applicable
  • I've documented my code using JSDoc format if applicable
  • I've applied the right labels on the PR (security, dependencies)

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Would you like me to make any adjustments to this PR description?

@georgewrmarshall georgewrmarshall self-assigned this Mar 6, 2025
@socket-security Socket Security
Copy link

socket-security bot commented Mar 6, 2025 •
edited
Loading

Updated and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/[email protected] ➜ 2.16.1 None 0 33.5 kB ljharb

🚮 Removed packages: npm/@babel/[email protected], npm/@babel/[email protected]

View full report↗︎

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"pre-push": "yarn lint"
},
"resolutions": {
"minimist": "1.2.8",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes GHSA-xvch-5gv4-984h

Screenshot 2025-03-06 at 3 01 04 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
},
"resolutions": {
"minimist": "1.2.8",
"plist": "3.0.5",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes GHSA-4cpg-3vgw-4877

Screenshot 2025-03-06 at 3 01 11 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"minimist": "1.2.8",
"plist": "3.0.5",
"@xmldom/xmldom": "0.7.7",
"@babel/traverse": "7.25.9",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes GHSA-67hx-6x53-jw92

Screenshot 2025-03-06 at 3 01 24 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"resolutions": {
"minimist": "1.2.8",
"plist": "3.0.5",
"@xmldom/xmldom": "0.7.7",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes GHSA-crh6-fp67-6883

Screenshot 2025-03-06 at 3 05 20 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"plist": "3.0.5",
"@xmldom/xmldom": "0.7.7",
"@babel/traverse": "7.25.9",
"simple-plist": "1.3.1",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes: GHSA-gff7-g5r8-mg8m

Screenshot 2025-03-06 at 3 01 30 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"@xmldom/xmldom": "0.7.7",
"@babel/traverse": "7.25.9",
"simple-plist": "1.3.1",
"shell-quote": "1.7.3",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes: GHSA-g4rg-993r-mgx7

Screenshot 2025-03-06 at 3 01 37 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"cross-spawn": "7.0.5",
"ws": "8.17.1",
"node-fetch": "3.1.1",
"json5": "2.2.2",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes: GHSA-9c47-m6qq-7p4h

Screenshot 2025-03-06 at 3 15 33 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"ws": "8.17.1",
"node-fetch": "3.1.1",
"json5": "2.2.2",
"merge": "2.1.1",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes: GHSA-7wpw-2hjm-89gp

Screenshot 2025-03-06 at 3 11 06 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"node-fetch": "3.1.1",
"json5": "2.2.2",
"merge": "2.1.1",
"semver": "7.5.2",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes: GHSA-c2qf-rxjj-qqgw

Screenshot 2025-03-06 at 3 13 13 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"json5": "2.2.2",
"merge": "2.1.1",
"semver": "7.5.2",
"braces": "^3.0.3",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Already fixed: GHSA-grv7-fg5c-xmjg

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"shell-quote": "1.7.3",
"cross-spawn": "7.0.5",
"ws": "8.17.1",
"node-fetch": "3.1.1",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes: GHSA-r683-j2x4-v87g

Screenshot 2025-03-06 at 3 08 51 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
package.json
"@babel/traverse": "7.25.9",
"simple-plist": "1.3.1",
"shell-quote": "1.7.3",
"cross-spawn": "7.0.5",
Copy link
Contributor Author

@georgewrmarshall georgewrmarshall Mar 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes: GHSA-3xgq-45jj-v275

Screenshot 2025-03-06 at 3 06 51 PM

georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
georgewrmarshall
georgewrmarshall commented Mar 6, 2025
View reviewed changes
@georgewrmarshall georgewrmarshall force-pushed the fix/467/socket-vulnerabilities branch from 1d81771 to 41b8ed6 Compare March 6, 2025 22:52
@georgewrmarshall georgewrmarshall marked this pull request as ready for review March 6, 2025 23:20
@georgewrmarshall georgewrmarshall requested a review from a team as a code owner March 6, 2025 23:20
@georgewrmarshall georgewrmarshall mentioned this pull request Mar 6, 2025
Closed
7 tasks
@georgewrmarshall georgewrmarshall merged commit 618c374 into main Mar 11, 2025
30 checks passed
@georgewrmarshall georgewrmarshall deleted the fix/467/socket-vulnerabilities branch March 11, 2025 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@brianacnguyen brianacnguyen brianacnguyen approved these changes

Assignees

@georgewrmarshall georgewrmarshall

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Fix socket security vulnerabilities
2 participants
@georgewrmarshall @brianacnguyen