chore(tools): update geckodriver to 4.0.4 #19558

HowardBraham · 2023-06-10T08:02:40Z

Updating the Firefox testing tool to the newest version

github-actions · 2023-06-10T08:02:54Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

socket-security · 2023-06-10T08:06:33Z

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] bar@* or ignore all packages with @SocketSecurity ignore-all

socket-security · 2023-06-10T08:06:36Z

New and updated dependency changes detected. Learn more about Socket for GitHub ↗︎

Packages		Version	New capabilities	Transitives¹	Size	Publisher
geckodriver	⬆️	3.2.0...4.0.4	network	`+21/-3`	8.89 MB	wdio-user

https://docs.socket.dev ↩

codecov · 2023-06-10T08:43:47Z

Codecov Report

Merging #19558 (13c2cbe) into develop (9acd4b4) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           develop   #19558   +/-   ##
========================================
  Coverage    70.79%   70.79%           
========================================
  Files          988      988           
  Lines        38365    38365           
  Branches     10041    10041           
========================================
  Hits         27160    27160           
  Misses       11205    11205

metamaskbot · 2023-06-10T08:51:16Z

Builds ready [b0e12e4]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4, 5
- common: 0, 1, 2, 3, 4
- content-script: 0
- contentscript: contentscript
- disable-console: disable-console
- inpage: inpage
- policy-load: policy-load
- sentry-install: sentry-install
- ui: 0, 1, 10, 11, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (1517 ± 33 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	107	151	119	11	5
		domContentLoaded	1396	1602	1499	52	25
		load	1396	1649	1517	70	33
		domInteractive	1396	1602	1499	52	25

Bundle size diffs

background: 0 bytes
ui: 0 bytes
common: 0 bytes

metamaskbot · 2023-06-20T19:52:46Z

Builds ready [13c2cbe]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4
- common: 0, 1, 2, 3, 4, 5
- content-script: 0
- contentscript: contentscript
- disable-console: disable-console
- inpage: inpage
- policy-load: policy-load
- sentry-install: sentry-install
- ui: 0, 1, 10, 11, 12, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (1680 ± 35 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	112	266	134	35	17
		domContentLoaded	1536	1817	1656	79	38
		load	1577	1838	1680	72	35
		domInteractive	1536	1817	1656	79	38

Bundle size diffs

background: 0 bytes
ui: 0 bytes
common: 0 bytes

brad-decker

LGTM. i'll see if i can resolve the socket-security stuff.

brad-decker · 2023-06-22T19:06:18Z

These all look harmless to me, but maybe @legobeat or someone from @MetaMask/supply-chain could take a look? This is a DEV only dependency so probably not high priority to investigate -- no lavamoat changes required.

HowardBraham · 2023-06-22T19:19:10Z

This is a DEV only dependency so probably not high priority to investigate -- no lavamoat changes required.

That reminds me... are we sure that our devDependencies do not leak into the release? I have not investigated here, but I have seen other projects that are misconfigured in this way.

I don't know the Yarn 3 way to do this, but the Yarn 1 way was yarn install --production on the build machine.

Gudahtt · 2023-06-22T20:01:10Z

@SocketSecurity ignore [email protected]

It does seem to be unmaintained, which is not ideal. But the author was substack, a reputable developer who deleted their account intentionally.

Gudahtt · 2023-06-22T20:01:53Z

@SocketSecurity ignore [email protected]

This package is supposed to have filesystem access, that is expected and not concerning

Gudahtt · 2023-06-22T20:02:49Z

@SocketSecurity ignore [email protected]

It does seem to be unmaintained, but the filesystem access is expected and not concerning.

Gudahtt · 2023-06-22T20:04:00Z

@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]

More substack, same situation there.

Gudahtt · 2023-06-22T20:06:52Z

@SocketSecurity ignore [email protected]

Geckodriver uses this to make network requests, so it should have network access

Gudahtt · 2023-06-22T20:07:04Z

@SocketSecurity ignore [email protected]

More substack, also this one is ancient

Gudahtt · 2023-06-22T20:09:41Z

@SocketSecurity ignore [email protected]

This package is supposed to have network access, and it uses install scripts to ensure the driver is installed.

@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]

All unmaintained, not ideal but not a reason to object to their usage in geckodriver.

Gudahtt · 2023-06-22T20:12:39Z

@SocketSecurity ignore [email protected]

Another unmaintained package

Gudahtt · 2023-06-22T20:13:37Z

@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]
@SocketSecurity ignore [email protected]

Regular expression denial of service attacks aren't a concern for our development tools.

Gudahtt

LGTM!

HowardBraham requested a review from a team as a code owner June 10, 2023 08:02

HowardBraham requested a review from vinistevam June 10, 2023 08:02

HowardBraham force-pushed the chore/update_geckodriver branch from 5d29258 to b0e12e4 Compare June 10, 2023 08:09

HowardBraham force-pushed the chore/update_geckodriver branch from b0e12e4 to da4546f Compare June 20, 2023 19:14

chore(tools): update geckodriver to 4.0.4

13c2cbe

HowardBraham force-pushed the chore/update_geckodriver branch from da4546f to 13c2cbe Compare June 20, 2023 19:22

brad-decker approved these changes Jun 22, 2023

View reviewed changes

Gudahtt approved these changes Jun 22, 2023

View reviewed changes

HowardBraham merged commit ed06926 into develop Jun 23, 2023

HowardBraham deleted the chore/update_geckodriver branch June 23, 2023 04:00

github-actions bot locked and limited conversation to collaborators Jun 23, 2023

metamaskbot added the release-10.34.0 Issue or pull request that will be included in release 10.34.0 label Jun 23, 2023

HowardBraham added the contributor experience An issue that impacts, or planned improvement to, the contributor experience. label Oct 29, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(tools): update geckodriver to 4.0.4 #19558

chore(tools): update geckodriver to 4.0.4 #19558

HowardBraham commented Jun 10, 2023

github-actions bot commented Jun 10, 2023

socket-security bot commented Jun 10, 2023 •

edited

Loading

socket-security bot commented Jun 10, 2023

codecov bot commented Jun 10, 2023 •

edited

Loading

metamaskbot commented Jun 10, 2023

metamaskbot commented Jun 20, 2023

brad-decker left a comment

brad-decker commented Jun 22, 2023

HowardBraham commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt left a comment

chore(tools): update geckodriver to 4.0.4 #19558

chore(tools): update geckodriver to 4.0.4 #19558

Conversation

HowardBraham commented Jun 10, 2023

github-actions bot commented Jun 10, 2023

socket-security bot commented Jun 10, 2023 • edited Loading

Next steps

socket-security bot commented Jun 10, 2023

Footnotes

codecov bot commented Jun 10, 2023 • edited Loading

Codecov Report

metamaskbot commented Jun 10, 2023

metamaskbot commented Jun 20, 2023

brad-decker left a comment

Choose a reason for hiding this comment

brad-decker commented Jun 22, 2023

HowardBraham commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt commented Jun 22, 2023

Gudahtt left a comment

Choose a reason for hiding this comment

socket-security bot commented Jun 10, 2023 •

edited

Loading

codecov bot commented Jun 10, 2023 •

edited

Loading