Upgrade celo deps #227

palango · 2024-03-04T16:03:27Z

Description

The main focus of this PR is updating @celo/contractkit and related packages, in order to not send deprecated legacy celo transactions.

In prior versions, contractkit sends legacy celo transactions when just the gas price is passed as is the case here. @carterqw2 updated contractkit to send legacy ethereum transactions instead.

In future updates it might make sense to update the oracle to send EIP-1559 transactions.

Some changes include upgrading node and the dockerfiles.

Tested

yarn test
Tested on a local chain
Tested on Baklava

Backwards compatibility

Yes

socket-security · 2024-03-04T16:09:07Z

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

socket-security · 2024-03-04T16:25:17Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@celo/[email protected]	Transitive: environment, network	`+80`	15.3 MB	app-tooling
npm/@celo/[email protected]	filesystem, network Transitive: environment	`+147`	29.3 MB	app-tooling
npm/@celo/[email protected]	Transitive: environment, filesystem, shell	`+45`	5.57 MB	aaron-clabs
npm/@celo/[email protected]	Transitive: environment, filesystem, network	`+89`	17.3 MB	app-tooling
npm/@celo/[email protected]	Transitive: environment, eval, filesystem, network, shell	`+180`	123 MB	app-tooling
npm/@celo/[email protected]	Transitive: environment, filesystem, network, shell	`+189`	42.8 MB	app-tooling
npm/@types/[email protected]	None	`+2`	2.09 MB	types
npm/@types/[email protected]	None	`+12`	2.19 MB	types
npm/@types/[email protected]	None	`+1`	486 kB	types
npm/@types/[email protected]	Transitive: filesystem, network	`+8`	2.4 MB	types
npm/[email protected]	None	`0`	351 kB	mikemcl
npm/[email protected]	environment, filesystem, network Transitive: eval, unsafe	`+63`	2.11 MB	ulisesgascon
npm/[email protected]	eval Transitive: environment, filesystem	`+3`	757 kB	vitaly
npm/[email protected]	None	`+8`	11.2 MB	josdejong
npm/[email protected]	network	`+3`	493 kB	node-fetch-bot
npm/[email protected]	filesystem Transitive: environment, shell	`+36`	3.41 MB	palantir
npm/[email protected]	None	`0`	32.4 MB	typescript-bot
npm/[email protected]	Transitive: network	`+24`	4.67 MB	jdevcs
npm/[email protected]	Transitive: environment, eval, filesystem, network	`+97`	11.7 MB	jdevcs
npm/[email protected]	Transitive: environment, filesystem, network	`+136`	23.9 MB	jdevcs
npm/[email protected]	Transitive: environment, eval, filesystem, network, shell, unsafe	`+218`	22.2 MB	jdevcs

View full report↗︎

palango · 2024-03-04T17:24:16Z

@SocketSecurity ignore npm/[email protected]

package.json

palango · 2024-03-12T10:31:16Z

This is on hold until we figure out if we want to do the changes required in contractkit or here.

nvtaveras · 2024-03-12T12:49:54Z

@palango Do you mind adding more context on why are these changes being made, consequences of not adding them, timelines, etc?

aaronmgdr · 2024-03-12T13:28:46Z

strongly advice merging this as its upgrading very very very old dependencies.

bowd · 2024-03-14T21:10:04Z

@SocketSecurity ignore npm/[email protected]

This reverts commit 2a95b30.

.circleci/config.yml

aaronmgdr

would have said in description that it also moves to pnpm (besides the upgrade) but code seems good

ps only reviewed as there was a request specifically for me to

palango · 2024-04-03T08:55:23Z

@bowd @sissnad @nvtaveras From our side this is ready to be merged, but we'd like to have some review from you as well. Regarding the rollout, can we help with that somehow or will you talk to the oracle operators?

nvtaveras · 2024-04-09T15:52:57Z

Hey @palango, we've been busy lately with other work but would like to deploy this to one of the testnets and have them run there for a bit before merging. Are you fine holding off until then? My current guess is that we will have capacity to test this in around two weeks from now

palango · 2024-04-10T09:25:56Z

@nvtaveras Thanks for the update.
Ideally I'd like to get feedback sooner. One idea @carterqw2 brought up was that we could take care of the test deployment on alfajores ourselves. Would that be ok with you?

palango · 2024-04-10T09:27:00Z

@SocketSecurity ignore npm/[email protected]

palango · 2024-04-10T09:27:16Z

@SocketSecurity ignore npm/[email protected]

nvtaveras · 2024-04-11T14:57:51Z

@nvtaveras Thanks for the update.
Ideally I'd like to get feedback sooner. One idea @carterqw2 brought up was that we could take care of the test deployment on alfajores ourselves. Would that be ok with you?

@palango Sure, go for it, but please do it in Baklava instead, as Alfajores it's supposed to be the stable testnet, in case something breaks :) Also feel free to reach out on discord if you need help

palango · 2024-04-12T15:51:50Z

@nvtaveras Thanks for the update.
Ideally I'd like to get feedback sooner. One idea @carterqw2 brought up was that we could take care of the test deployment on alfajores ourselves. Would that be ok with you?

@palango Sure, go for it, but please do it in Baklava instead, as Alfajores it's supposed to be the stable testnet, in case something breaks :) Also feel free to reach out on discord if you need help

We're running this branch on baklava now. Everything seems to work fine and the transactions are now eth compatible.

palango · 2024-04-17T12:54:04Z

This is running fine since last Friday, therefore merging.

palango added 4 commits March 4, 2024 17:00

chore: update vscode settings

6ebf78b

upgrade celo dependencies to current versions

421fadd

chore: update lockfile

a5a3c51

ci: upgrade to latest node LTS

d6d8b94

run yarn upgrade

ff37d55

palango force-pushed the palango/upgrade-celo-deps branch 2 times, most recently from 189ca49 to 6e07d1a Compare March 4, 2024 16:21

palango force-pushed the palango/upgrade-celo-deps branch from dbcc061 to 6aeb878 Compare March 4, 2024 16:28

palango added 4 commits March 4, 2024 18:02

upgrade jest

5a341c6

fix expected error

76d636b

fix style

3170eca

remove react lints

71c50ed

palango force-pushed the palango/upgrade-celo-deps branch from 2002b97 to 71c50ed Compare March 4, 2024 17:03

palango added 2 commits March 4, 2024 18:05

ci: Update action config

894dbfd

fix linting

1729d6f

palango requested review from nvtaveras, aaronmgdr, sissnad and bowd March 4, 2024 17:40

aaronmgdr reviewed Mar 5, 2024

View reviewed changes

package.json Show resolved Hide resolved

aaronmgdr approved these changes Mar 5, 2024

View reviewed changes

bowd added 2 commits March 14, 2024 23:42

fix: update yarn -> pnpm

0a7fc08

fix: update yarn -> pnpm in CI

34f2ce8

bowd and others added 9 commits March 14, 2024 23:59

fix: remove redundant circleci

2a95b30

fix: remove yarn from package.json

4f510a2

fix: yarn -> pnpm

f96d563

Revert "fix: remove redundant circleci"

e3ea45d

This reverts commit 2a95b30.

fix: make a NOOP circleci

f43014a

fix: broken circleci config

70d4da8

fix: broken circleci config fix try 3

07a65b7

fix: wrong script

0d9aec1

Merge branch 'main' into palango/upgrade-celo-deps

93e0b8d

palango commented Mar 15, 2024

View reviewed changes

.circleci/config.yml Outdated Show resolved Hide resolved

bowd mentioned this pull request Mar 15, 2024

fix: Docker build failing #230

Merged

carterqw2 mentioned this pull request Mar 20, 2024

Added Ethereum-compatible legacy TXs support celo-org/developer-tooling#182

Merged

carterqw2 and others added 4 commits March 22, 2024 13:55

Contractkit version supporting Eth-compatible TXs

d56cedd

Merge branch 'main' into palango/upgrade-celo-deps

72ebe6a

Updated versions

8e1590d

Updated versions

b51ff37

carterqw2 marked this pull request as ready for review April 2, 2024 16:35

palango requested a review from aaronmgdr April 2, 2024 17:54

aaronmgdr approved these changes Apr 3, 2024

View reviewed changes

Fix Dockerfile building

1b4ddb8

palango merged commit 28ecb4b into main Apr 17, 2024
4 checks passed

palango deleted the palango/upgrade-celo-deps branch April 17, 2024 12:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade celo deps #227

Upgrade celo deps #227

palango commented Mar 4, 2024 •

edited

Loading

socket-security bot commented Mar 4, 2024 •

edited

Loading

socket-security bot commented Mar 4, 2024 •

edited

Loading

palango commented Mar 4, 2024

palango commented Mar 12, 2024

nvtaveras commented Mar 12, 2024

aaronmgdr commented Mar 12, 2024

bowd commented Mar 14, 2024

aaronmgdr left a comment •

edited

Loading

palango commented Apr 3, 2024

nvtaveras commented Apr 9, 2024

palango commented Apr 10, 2024

palango commented Apr 10, 2024

palango commented Apr 10, 2024

nvtaveras commented Apr 11, 2024

palango commented Apr 12, 2024

palango commented Apr 17, 2024

Upgrade celo deps #227

Upgrade celo deps #227

Conversation

palango commented Mar 4, 2024 • edited Loading

Description

Tested

Backwards compatibility

socket-security bot commented Mar 4, 2024 • edited Loading

Next steps

socket-security bot commented Mar 4, 2024 • edited Loading

palango commented Mar 4, 2024

palango commented Mar 12, 2024

nvtaveras commented Mar 12, 2024

aaronmgdr commented Mar 12, 2024

bowd commented Mar 14, 2024

aaronmgdr left a comment • edited Loading

Choose a reason for hiding this comment

palango commented Apr 3, 2024

nvtaveras commented Apr 9, 2024

palango commented Apr 10, 2024

palango commented Apr 10, 2024

palango commented Apr 10, 2024

nvtaveras commented Apr 11, 2024

palango commented Apr 12, 2024

palango commented Apr 17, 2024

palango commented Mar 4, 2024 •

edited

Loading

socket-security bot commented Mar 4, 2024 •

edited

Loading

socket-security bot commented Mar 4, 2024 •

edited

Loading

aaronmgdr left a comment •

edited

Loading