Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: lattice sign typed signature verification error #28694

Merged
merged 2 commits into from
Nov 26, 2024

Conversation

Akaryatrh
Copy link
Contributor

@Akaryatrh Akaryatrh commented Nov 25, 2024

Description

Open in GitHub Codespaces

Related issues

Fixes:

Manual testing steps

  1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Copy link
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

Copy link

socket-security bot commented Nov 25, 2024

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/elliptic@6.5.4, npm/@noble/secp256k1@1.6.3, npm/exit-on-epipe@1.0.1, npm/crc-32@1.2.0, npm/printj@1.1.2, npm/ethereum-cryptography@1.1.2, npm/@noble/hashes@1.1.2, npm/@scure/bip32@1.1.0, npm/@scure/bip39@1.1.0, npm/@chainsafe/as-sha256@0.3.1, npm/@chainsafe/persistent-merkle-tree@0.4.2, npm/@chainsafe/ssz@0.9.4, npm/case@1.6.3, npm/bitwise@2.1.0, npm/@ethereumjs/tx@4.1.1, npm/@ethereumjs/common@3.1.1, npm/eth-eip712-util-browser@0.0.3, npm/gridplus-sdk@2.5.1, npm/@scure/base@1.1.7, npm/eth-chainlist@0.0.498

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

@Akaryatrh Akaryatrh force-pushed the fix/lattice-sign-typed-error branch 2 times, most recently from 6346bb3 to 1dc1748 Compare November 25, 2024 21:35
@Akaryatrh Akaryatrh changed the base branch from develop to Version-v12.7.2 November 25, 2024 21:35
@danjm danjm force-pushed the fix/lattice-sign-typed-error branch from 1dc1748 to 8c1945e Compare November 26, 2024 00:51
@danjm danjm force-pushed the fix/lattice-sign-typed-error branch from 8c1945e to 02ff1ab Compare November 26, 2024 01:20
@danjm danjm marked this pull request as ready for review November 26, 2024 01:42
@danjm danjm requested review from a team as code owners November 26, 2024 01:42
@danjm
Copy link
Contributor

danjm commented Nov 26, 2024

@SocketSecurity ignore-all

This returns these dependencies to the state they were in on v12.6.2, and these issues are fixed in develop

@danjm danjm merged commit c40c1a5 into Version-v12.7.2 Nov 26, 2024
73 of 74 checks passed
@danjm danjm deleted the fix/lattice-sign-typed-error branch November 26, 2024 02:01
@github-actions github-actions bot locked and limited conversation to collaborators Nov 26, 2024
@metamaskbot
Copy link
Collaborator

Builds ready [02ff1ab]
Page Load Metrics (2079 ± 90 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint40524942002412198
domContentLoaded17342421204017986
load18032499207918790
domInteractive28120562512
backgroundConnect9104332813
firstReactRender542981154923
getState5285386029
initialActions01000
loadScripts12731931151616780
setupStore12104332713
uiStartup198829102340245117

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants