feat: replace `keytar` with `@github/keytar` by congminh1254 · Pull Request #688 · box/boxcli · GitHub
Skip to content

feat: replace keytar with @github/keytar#688

Merged
congminh1254 merged 10 commits into
mainfrom
replace_github_keytar
Jun 1, 2026
Merged

feat: replace keytar with @github/keytar#688
congminh1254 merged 10 commits into
mainfrom
replace_github_keytar

Conversation

@congminh1254

@congminh1254 congminh1254 commented May 29, 2026

Copy link
Copy Markdown
Member

No description provided.

@congminh1254 congminh1254 requested a review from a team May 29, 2026 08:37
@socket-security

socket-security Bot commented May 29, 2026 •
edited
Loading

Copy link
Copy Markdown

@coveralls

coveralls commented May 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Coverage Report for CI Build 26748832470

Coverage decreased (-0.005%) to 84.967%

Details

  • Coverage decreased (-0.005%) from the base build.
  • Patch coverage: 3 uncovered changes across 1 file (18 of 21 lines covered, 85.71%).
  • No coverage regressions found.

Uncovered Changes

File Changed Covered %
src/secure-storage.js 21 18 85.71%

Coverage Regressions

No coverage regressions found.

Coverage Stats

Coverage Status
Relevant Lines: 6051
Covered Lines: 5392
Line Coverage: 89.11%
Relevant Branches: 2151
Covered Branches: 1577
Branch Coverage: 73.31%
Branches in Coverage %: Yes
Coverage Strength: 643.35 hits per line
💛 - Coveralls

@socket-security

socket-security Bot commented Jun 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm js-yaml is 85.0% likely obfuscated

Confidence: 0.85

Location: Package overview

From: package-lock.json → npm/js-yaml@4.2.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

arjankowski
arjankowski reviewed Jun 1, 2026
View reviewed changes
Comment thread src/secure-storage.js

@arjankowski arjankowski Jun 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add some logs here via DEBUG.init ?

@congminh1254 congminh1254 Jun 1, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added the logs, it will only show up when run something like:

DEBUG=box-cli:*  ./bin/run users:get

but not

./bin/run users:get  --verbose

because at the moment we parse the verbose flag, the log already emitted.

arjankowski
arjankowski approved these changes Jun 1, 2026
View reviewed changes

@arjankowski arjankowski left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@congminh1254 congminh1254 merged commit eb0a40d into main Jun 1, 2026
19 checks passed
@congminh1254 congminh1254 deleted the replace_github_keytar branch June 1, 2026 10:43
@congminh1254 congminh1254 restored the replace_github_keytar branch June 1, 2026 11:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arjankowski arjankowski arjankowski approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@congminh1254 @coveralls @arjankowski