iframe-proxy

cryptodev-2s · 2026-09-04T10:50:51Z

Top of stack #315, on #317.

The typedoc bump fixes a live break. typedoc 0.23 caps at TypeScript 5.0, so once #311 moved us to ~5.3.3, yarn build:docs crashed with Cannot read properties of undefined (reading 'name'). Nothing caught it because PR CI never runs build:docs, only the docs publish workflow does.

Also .nvmrc v18 to lts/*, and @ts-bridge/* added to npmPreapprovedPackages. Both match core.

Left alone on purpose:

depcheck is not swapped for knip. Core's knip config is 292 lines of monorepo specific tuning, and PR#8 of the migration guide strips knip.config.* from the package anyway.
oxfmt stays at ^0.44.0 even though @metamask/auto-changelog@6.2.1 peer requests ^0.45.0. Core pins the same pair, so bumping would diverge from it.

Note

Low Risk
Tooling and devDependency-only changes with no runtime library or security-sensitive application logic touched.

Overview
Aligns Node and Yarn policy with MetaMask core and bumps several dev dependencies so docs and installs stay healthy after the TypeScript 5.3 upgrade.

.nvmrc now tracks lts/* instead of pinning v18. .yarnrc.yml pre-approves @ts-bridge/* for the npm minimal-age gate, matching core and the existing @ts-bridge/cli / @ts-bridge/shims usage.

typedoc moves from ^0.23.15 to ^0.25.13, which restores yarn build:docs (0.23 only supports TypeScript through 5.0 and was failing on ~5.3.3). @lavamoat/preinstall-always-fail and jest-when are bumped to ^2.1.0 and ^3.7.0 respectively; yarn.lock reflects the transitive updates (e.g. marked, shiki, minimatch for TypeDoc).

^{Reviewed by Cursor Bugbot for commit 2781215. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-09-04T10:51:17Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality
@lavamoat/preinstall-always-fail@1.0.0 ⏵ 2.1.1		⁺⁵
jest-when@3.6.0 ⏵ 3.7.0	⁺¹	⁺¹
typedoc@0.23.28 ⏵ 0.25.13	⁺²	^-2

View full report

socket-security · 2026-09-04T10:51:19Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Obfuscated code: npm `shiki` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → `npm/typedoc@0.25.13` → `npm/shiki@0.14.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/shiki@0.14.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Install-time scripts: npm `@lavamoat/preinstall-always-fail` during preinstall Install script: preinstall Source: `echo "Don't run npm lifecycle scripts by default! Create a .yarnrc or .npmrc and set enableScripts: false. Then, whitelist them with @lavamoat/allow-scripts" && exit 1` From: package.json → `npm/@lavamoat/preinstall-always-fail@2.1.1` ℹ Read more on: This package \| This alert \| What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@lavamoat/preinstall-always-fail@2.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

typedoc ^0.23.15 -> ^0.25.13 @lavamoat/preinstall-always-fail ^1.0.0 -> ^2.1.0 jest-when ^3.6.0 -> ^3.7.0 The typedoc bump is not cosmetic. typedoc 0.23 supports TypeScript up to 5.0, so after this package moved to ~5.3.3 `yarn build:docs` crashed outright with "Cannot read properties of undefined (reading 'name')". PR CI never runs build:docs, so nothing caught it. 0.25.13 is core's version and restores a clean run. Also: .nvmrc v18 -> lts/*, matching core .yarnrc.yml adds @ts-bridge/* to npmPreapprovedPackages, matching core Left alone deliberately: depcheck is not swapped for knip. Core uses knip, but its config is 292 lines of monorepo-specific tuning and PR#8 of the migration guide strips knip.config.* from the package anyway, so writing one here buys nothing. oxfmt stays at ^0.44.0 even though @metamask/auto-changelog@6.2.1 peer requests ^0.45.0. Core pins the same pair, so this mismatch already exists upstream and bumping would diverge from it. Changelog validation still passes. typedoc-plugin-missing-exports is not added. Core packages carry it, but typedoc.json here declares no plugins, so it would be an unused dependency. Verified on Node 24 (the new .nvmrc target): eslint, build, build:docs, 23 suites / 1993 tests, tsd, and full yarn lint all pass.

cryptodev-2s force-pushed the migrate/pr2d-devdeps branch from 8ce4a96 to d3522b0 Compare September 4, 2026 11:00

cryptodev-2s force-pushed the migrate/pr2d-devdeps branch from d3522b0 to 2781215 Compare September 4, 2026 11:03

cryptodev-2s mentioned this pull request Sep 4, 2026

chore: bump Jest to v30 #319

Open

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Uh oh!

Uh oh!

chore: align remaining dev deps and tooling config with core - #318

chore: align remaining dev deps and tooling config with core#318
cryptodev-2s wants to merge 1 commit into
migrate/pr2c-eslintfrom
migrate/pr2d-devdeps

cryptodev-2s commented Sep 4, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Dep	From	To
`typedoc`	`^0.23.15`	`^0.25.13`
`@lavamoat/preinstall-always-fail`	`^1.0.0`	`^2.1.0`
`jest-when`	`^3.6.0`	`^3.7.0`

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Uh oh!

Conversation

cryptodev-2s commented Sep 4, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cryptodev-2s commented Sep 4, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Sep 4, 2026 •

edited

Loading

socket-security Bot commented Sep 4, 2026 •

edited

Loading