Revert "refactor!: Synchronize dev toolchain with module template and core monorepo (#420)" #423

jiexi · 2025-10-15T17:21:44Z

This reverts commit 5391380.

This breaking change is blocking a release fix that will include:

Will readd this commit after those two PRs are merged and a patch release is cut

… core monorepo (#420)" This reverts commit 5391380.

socket-security · 2025-10-15T17:23:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality
	form-data@3.0.4 ⏵ 3.0.1	⁺¹	^-75
	has@1.0.3
	isarray@2.0.5
	node-releases@2.0.23 ⏵ 2.0.14
	side-channel@1.0.4
	has-proto@1.0.1
	array-buffer-byte-length@1.0.0
	typed-array-buffer@1.0.0
	gopd@1.2.0 ⏵ 1.0.1			^-1
	globalthis@1.0.3
	has-property-descriptors@1.0.0
	has-tostringtag@1.0.2 ⏵ 1.0.0	⁺¹
	object.groupby@1.0.1
	define-properties@1.2.0
	functions-have-names@1.2.3
	set-function-length@1.1.1
	object.fromentries@2.0.7
	available-typed-arrays@1.0.5
	is-negative-zero@2.0.2
	object-keys@1.1.1
	safe-regex-test@1.0.0
	get-symbol-description@1.0.0
	unbox-primitive@1.0.2
	is-date-object@1.0.5
	arraybuffer.prototype.slice@1.0.2
	is-shared-array-buffer@1.0.2
	has-symbols@1.1.0 ⏵ 1.0.3	⁺¹
	array.prototype.flat@1.3.2
	safe-array-concat@1.0.1
	is-bigint@1.0.4
	es-set-tostringtag@2.1.0 ⏵ 2.0.1	⁺¹		^-4
	typed-array-length@1.0.4
	internal-slot@1.0.5
	array.prototype.flatmap@1.3.2
See 145 more rows in the dashboard

View full report

socket-security · 2025-10-15T17:23:25Z

Warning

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		`@babel/helpers@7.23.5` has a Medium CVE. CVE: GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups (MODERATE) Affected versions: < 7.26.10; >= 8.0.0-alpha.0 < 8.0.0-alpha.17 Patched version: 7.26.10 From: yarn.lock → `npm/@babel/helpers@7.23.5` ℹ Read more on: This package \| This alert \| What is a medium CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/helpers@7.23.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@humanwhocodes/config-array@0.11.10` is Deprecated. Reason: Use @eslint/config-array instead From: yarn.lock → `npm/@humanwhocodes/config-array@0.11.10` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@humanwhocodes/config-array@0.11.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@humanwhocodes/object-schema@1.2.1` is Deprecated. Reason: Use @eslint/object-schema instead From: yarn.lock → `npm/@humanwhocodes/object-schema@1.2.1` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@humanwhocodes/object-schema@1.2.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`eslint@8.44.0` is Deprecated. Reason: This version is no longer supported. Please see https://eslint.org/version-support for other options. From: package.json → `npm/eslint@8.44.0` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint@8.44.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`eslint-plugin-import@2.29.0` is a AI-detected potential code anomaly. Notes: The source code is intended to be a linting rule for JavaScript projects, but the use of _vm2['default'].runInNewContext() to execute comment contents dynamically is potentially dangerous. Confidence: 1.00 Severity: 0.60 From: package.json → `npm/eslint-plugin-import@2.29.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-import@2.29.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

estraverse@4.3.0
for-each@0.3.3
ms@2.1.2
cross-spawn@7.0.3
form-data@3.0.1
source-map@0.7.4

View full report

Gudahtt

LGTM!

Gudahtt · 2025-10-15T17:28:27Z

@SocketSecurity ignore npm/form-data@3.0.1
@SocketSecurity ignore npm/cross-spawn@7.0.3

The critical CVE for these two versions are noted. We will update these in a separate PR immediately after this one.

@SocketSecurity ignore npm/estraverse@4.3.0
@SocketSecurity ignore npm/for-each@0.3.3
@SocketSecurity ignore npm/form-data@3.0.1
@SocketSecurity ignore npm/ms@2.1.2
@SocketSecurity ignore npm/source-map@0.7.4

"new author" OK (these are ancient, not really new).

Update dependencies that Socket warned about in #423

…d core monorepo (#420)" (#423) This reverts commit c591a5f.

Update dependencies that Socket warned about in #423

Update dependencies that Socket warned about in #423   --- > [!NOTE] > Updates yarn.lock to bump several packages (e.g., cross-spawn 7.0.6, form-data 3.0.4, get-intrinsic 1.3.1) and add required transitive deps to address audits. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit a6eefaa. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

…d core monorepo (#420)" (#423) (#426) This reverts commit c591a5f (Reapplies 5391380)   --- > [!NOTE] > Overhauls the dev toolchain: upgrades ESLint to v9 with new configs/plugins, moves to TypeScript 5.x, adds TypeDoc/depcheck/ts-bridge/ATTW tooling, updates Prettier to v3, and refreshes dependencies. > > - **Dev toolchain sync/upgrade** > - **ESLint 9**: Bump core and configs (MetaMask v14), migrate plugins/resolvers (e.g., `eslint-plugin-import-x`, `eslint-import-resolver-typescript`), and update related utilities. > - **TypeScript 5.x**: Update TypeScript, `typescript-eslint` (v8), `ts-node`, and supporting packages. > - **Formatting & docs**: Upgrade **Prettier** to v3 and `prettier-plugin-packagejson`; add **TypeDoc**. > - **New tooling**: Add `@arethetypeswrong/cli`, `@ts-bridge/cli`, and **depcheck** for dependency hygiene. > - **Dependencies**: Broad dependency updates and lockfile refresh to align with core template. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 5ef56a4. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Revert "refactor!: Synchronize dev toolchain with module template and…

c26a924

… core monorepo (#420)" This reverts commit 5391380.

jiexi requested review from a team as code owners October 15, 2025 17:21

Gudahtt mentioned this pull request Oct 15, 2025

Revert "refactor!: Synchronize dev toolchain with module template and core monorepo" #424

Closed

Gudahtt approved these changes Oct 15, 2025

View reviewed changes

Gudahtt merged commit c591a5f into main Oct 15, 2025
20 checks passed

Gudahtt deleted the jl/revert-5391380 branch October 15, 2025 17:29

Gudahtt added a commit that referenced this pull request Oct 15, 2025

chore: Update dependencies to resolve audit warnings

a6eefaa

Update dependencies that Socket warned about in #423

Gudahtt mentioned this pull request Oct 15, 2025

chore: Update dependencies to resolve audit warnings #425

Merged

jiexi added a commit that referenced this pull request Oct 15, 2025

Reapply "refactor!: Synchronize dev toolchain with module template an…

c2c6d29

…d core monorepo (#420)" (#423) This reverts commit c591a5f.

Gudahtt added a commit that referenced this pull request Oct 15, 2025

chore: Update dependencies to resolve audit warnings

d530228

Update dependencies that Socket warned about in #423

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Revert "refactor!: Synchronize dev toolchain with module template and core monorepo (#420)" #423

Revert "refactor!: Synchronize dev toolchain with module template and core monorepo (#420)" #423

Uh oh!

jiexi commented Oct 15, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Oct 15, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Oct 15, 2025 •

edited

Loading

Uh oh!

Gudahtt left a comment

Uh oh!

Gudahtt commented Oct 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Revert "refactor!: Synchronize dev toolchain with module template and core monorepo (#420)" #423

Revert "refactor!: Synchronize dev toolchain with module template and core monorepo (#420)" #423

Uh oh!

Conversation

jiexi commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Gudahtt left a comment

Choose a reason for hiding this comment

Uh oh!

Gudahtt commented Oct 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jiexi commented Oct 15, 2025 •

edited

Loading

socket-security bot commented Oct 15, 2025 •

edited

Loading

socket-security bot commented Oct 15, 2025 •

edited

Loading