Bump LavaMoat and SES #20877

Mrtenz · 2023-09-14T10:07:21Z

Explanation

SES 0.18.7 is incompatible with Google Chrome 117, resulting in lockdown not fully working in the injected content script:

lockdown-run.js:17 Lockdown failed: TypeError: At intrinsics.Object.groupBy expected boolean not function
  at isAllowedPropertyValue (lockdown-install.js:1:53384)
  [...]
lockdown-more.js:99 Protecting intrinsics failed: ReferenceError: harden is not defined
  at lockdown-more.js:69:13
  [...]

This was fixed in SES 0.18.8. To make sure SES is up-to-date everywhere, we have to bump LavaMoat to the latest versions too.

Manual Testing Steps

Run the extension locally.
Ensure there are no errors in the page console.

Pre-merge author checklist

I've clearly explained:
- What problem this PR is solving
- How this problem was solved
- How reviewers can test my changes
Sufficient automated test coverage has been added

Pre-merge reviewer checklist

Manual testing (e.g. pull and build branch, run in browser, test code being changed)
PR is linked to the appropriate GitHub issue
IF this PR fixes a bug in the release milestone, add this PR to the release milestone

If further QA is required (e.g. new feature, complex testing steps, large refactor), add the Extension QA Board label.

In this case, a QA Engineer approval will be be required.

socket-security · 2023-09-14T10:13:09Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
eslint-plugin-storybook	0.6.13	None	`+0`	107 kB	yannbf

🚮 Removed packages: [email protected]

socket-security · 2023-09-14T15:21:40Z

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] bar@* or ignore all packages with @SocketSecurity ignore-all

FrederikBolding · 2023-09-14T17:08:36Z

@metamaskbot update-policies

metamaskbot · 2023-09-14T17:23:46Z

Policies updated

codecov · 2023-09-15T07:41:39Z

Codecov Report

Patch and project coverage have no change.

Comparison is base (6bb268b) 68.41% compared to head (fd51b92) 68.41%.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop   #20877   +/-   ##
========================================
  Coverage    68.41%   68.41%           
========================================
  Files         1006     1006           
  Lines        40188    40188           
  Branches     10740    10740           
========================================
  Hits         27492    27492           
  Misses       12696    12696

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

metamaskbot · 2023-09-15T07:51:49Z

Builds ready [7843b7f]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4
- common: 0, 1, 2, 3, 4, 5, 6
- content-script: 0
- contentscript: contentscript
- disable-console: disable-console
- inpage: inpage
- policy-load: policy-load
- sentry-install: sentry-install
- ui: 0, 1, 10, 11, 12, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (1678 ± 130 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	108	187	140	26	12
		domContentLoaded	1378	2330	1677	267	128
		load	1378	2345	1678	270	130
		domInteractive	1377	2330	1677	267	128

Bundle size diffs [🚨 Warning! Bundle size has increased!]

background: 12.84 KiB (0.36%)
ui: 0 Bytes (0.00%)
common: 0 Bytes (0.00%)

metamaskbot · 2023-09-15T09:21:49Z

Builds ready [51d666e]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4
- common: 0, 1, 2, 3, 4, 5, 6
- content-script: 0
- contentscript: contentscript
- disable-console: disable-console
- inpage: inpage
- policy-load: policy-load
- sentry-install: sentry-install
- ui: 0, 1, 10, 11, 12, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (1427 ± 22 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	103	153	116	12	6
		domContentLoaded	1351	1511	1427	46	22
		load	1351	1511	1427	45	22
		domInteractive	1351	1511	1426	46	22

Bundle size diffs [🚨 Warning! Bundle size has increased!]

background: 12.84 KiB (0.36%)
ui: 0 Bytes (0.00%)
common: 0 Bytes (0.00%)

Mrtenz · 2023-09-15T10:53:04Z

@SocketSecurity ignore [email protected]

This is ours.

Mrtenz · 2023-09-15T14:19:01Z

@metamaskbot update-policies

metamaskbot · 2023-09-15T14:24:43Z

Policy update failed. You can review the logs or retry the policy update here

github-actions · 2023-09-15T23:17:22Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

legobeat · 2023-09-15T23:43:33Z

@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]

unmaintained ok

legobeat · 2023-09-15T23:44:01Z

@SocketSecurity ignore [email protected]

new author ok

legobeat

Thank you, lgtm after the build-policy refresh!

metamaskbot · 2023-09-15T23:53:51Z

Builds ready [d9a2bd9]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4
- common: 0, 1, 2, 3, 4, 5, 6
- content-script: 0
- contentscript: contentscript
- disable-console: disable-console
- inpage: inpage
- policy-load: policy-load
- sentry-install: sentry-install
- ui: 0, 1, 10, 11, 12, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (1591 ± 49 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	116	184	135	14	7
		domContentLoaded	1471	1927	1591	101	49
		load	1471	1927	1591	101	49
		domInteractive	1471	1927	1591	101	49

Bundle size diffs [🚨 Warning! Bundle size has increased!]

background: 12.84 KiB (0.36%)
ui: 0 Bytes (0.00%)
common: 0 Bytes (0.00%)

legobeat · 2023-09-16T00:33:19Z

@metamaskbot update-policies

metamaskbot · 2023-09-16T00:34:16Z

Builds ready [4185cb7]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4
- common: 0, 1, 2, 3, 4, 5, 6
- content-script: 0
- contentscript: contentscript
- disable-console: disable-console
- inpage: inpage
- policy-load: policy-load
- sentry-install: sentry-install
- ui: 0, 1, 10, 11, 12, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (1430 ± 27 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	105	148	120	11	5
		domContentLoaded	1340	1547	1430	57	27
		load	1340	1548	1430	57	27
		domInteractive	1340	1547	1430	57	27

Bundle size diffs [🚨 Warning! Bundle size has increased!]

background: 12.84 KiB (0.36%)
ui: 0 Bytes (0.00%)
common: 0 Bytes (0.00%)

metamaskbot · 2023-09-16T00:45:05Z

No policy changes

danfinlay

Curious about the new lavamoat namespace.

package.json

yarn.lock

Mrtenz · 2023-09-21T09:24:10Z

@metamaskbot update-policies

metamaskbot · 2023-09-21T09:40:44Z

Policies updated

metamaskbot · 2023-09-21T11:11:47Z

Builds ready [fd51b92]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4
- common: 0, 1, 2, 3, 4, 5, 6
- content-script: 0
- contentscript: contentscript
- disable-console: disable-console
- inpage: inpage
- policy-load: policy-load
- sentry-install: sentry-install
- ui: 0, 1, 10, 11, 12, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (1571 ± 53 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	118	169	133	13	6
		domContentLoaded	1429	1890	1571	111	53
		load	1429	1890	1571	111	53
		domInteractive	1429	1890	1571	111	53

Bundle size diffs [🚨 Warning! Bundle size has increased!]

background: 12.84 KiB (0.36%)
ui: 0 Bytes (0.00%)
common: 0 Bytes (0.00%)

Mrtenz added the team-lavamoat label Sep 14, 2023

Mrtenz force-pushed the mrtenz/bump-lavamoat branch from 7843b7f to 51d666e Compare September 15, 2023 08:30

Mrtenz marked this pull request as ready for review September 15, 2023 08:30

Mrtenz requested review from a team as code owners September 15, 2023 08:30

legobeat requested review from naugtur and weizman September 15, 2023 22:32

legobeat previously approved these changes Sep 15, 2023

View reviewed changes

kevinghim mentioned this pull request Sep 16, 2023

[Bug]: Chrome console error related to lockdown-run.js and lockdown-more.js #20847

Closed

danfinlay reviewed Sep 20, 2023

View reviewed changes

package.json Show resolved Hide resolved

danjm added release-blocker This bug is blocking the next release release-11.1.0 Issue or pull request that will be included in release 11.1.0 labels Sep 20, 2023

weizman previously approved these changes Sep 20, 2023

View reviewed changes

FrederikBolding reviewed Sep 21, 2023

View reviewed changes

yarn.lock Show resolved Hide resolved

Mrtenz dismissed stale reviews from weizman and legobeat via f5a3f39 September 21, 2023 09:10

Mrtenz force-pushed the mrtenz/bump-lavamoat branch from 4185cb7 to f5a3f39 Compare September 21, 2023 09:10

legobeat self-requested a review September 21, 2023 09:18

Mrtenz and others added 7 commits September 21, 2023 11:23

Bump LavaMoat and SES

9f3bd23

Use latest versions

7e1c897

Use [email protected]

5f02190

Update LavaMoat policies

86e5f30

Unpin LavaMoat versions

81af21a

update lavamoat build policy

f81ccbf

Fix LavaMoat patch

6263056

Mrtenz force-pushed the mrtenz/bump-lavamoat branch from f5a3f39 to 6263056 Compare September 21, 2023 09:23

Update LavaMoat policies

fd51b92

legobeat approved these changes Sep 21, 2023

View reviewed changes

FrederikBolding approved these changes Sep 21, 2023

View reviewed changes

danjm merged commit baf0599 into develop Sep 21, 2023
9 checks passed

danjm deleted the mrtenz/bump-lavamoat branch September 21, 2023 17:31

github-actions bot locked and limited conversation to collaborators Sep 21, 2023

metamaskbot added the release-11.3.0 Issue or pull request that will be included in release 11.3.0 label Sep 21, 2023

danjm removed the release-11.3.0 Issue or pull request that will be included in release 11.3.0 label Sep 22, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump LavaMoat and SES #20877

Bump LavaMoat and SES #20877

Mrtenz commented Sep 14, 2023

socket-security bot commented Sep 14, 2023 •

edited

Loading

socket-security bot commented Sep 14, 2023 •

edited

Loading

FrederikBolding commented Sep 14, 2023

metamaskbot commented Sep 14, 2023

codecov bot commented Sep 15, 2023 •

edited

Loading

metamaskbot commented Sep 15, 2023

metamaskbot commented Sep 15, 2023

Mrtenz commented Sep 15, 2023

Mrtenz commented Sep 15, 2023

metamaskbot commented Sep 15, 2023

github-actions bot commented Sep 15, 2023

legobeat commented Sep 15, 2023

legobeat commented Sep 15, 2023

legobeat left a comment •

edited

Loading

metamaskbot commented Sep 15, 2023

legobeat commented Sep 16, 2023

metamaskbot commented Sep 16, 2023

metamaskbot commented Sep 16, 2023

danfinlay left a comment

Mrtenz commented Sep 21, 2023

metamaskbot commented Sep 21, 2023

metamaskbot commented Sep 21, 2023

Bump LavaMoat and SES #20877

Bump LavaMoat and SES #20877

Conversation

Mrtenz commented Sep 14, 2023

Explanation

Manual Testing Steps

Pre-merge author checklist

Pre-merge reviewer checklist

socket-security bot commented Sep 14, 2023 • edited Loading

socket-security bot commented Sep 14, 2023 • edited Loading

Next steps

FrederikBolding commented Sep 14, 2023

metamaskbot commented Sep 14, 2023

codecov bot commented Sep 15, 2023 • edited Loading

Codecov Report

metamaskbot commented Sep 15, 2023

metamaskbot commented Sep 15, 2023

Mrtenz commented Sep 15, 2023

Mrtenz commented Sep 15, 2023

metamaskbot commented Sep 15, 2023

github-actions bot commented Sep 15, 2023

legobeat commented Sep 15, 2023

legobeat commented Sep 15, 2023

legobeat left a comment • edited Loading

Choose a reason for hiding this comment

metamaskbot commented Sep 15, 2023

legobeat commented Sep 16, 2023

metamaskbot commented Sep 16, 2023

metamaskbot commented Sep 16, 2023

danfinlay left a comment

Choose a reason for hiding this comment

Mrtenz commented Sep 21, 2023

metamaskbot commented Sep 21, 2023

metamaskbot commented Sep 21, 2023

socket-security bot commented Sep 14, 2023 •

edited

Loading

socket-security bot commented Sep 14, 2023 •

edited

Loading

codecov bot commented Sep 15, 2023 •

edited

Loading

legobeat left a comment •

edited

Loading