fix: migrate from deprecated legacy packages by legobeat · Pull Request #11968 · MetaMask/metamask-mobile

legobeat · 2024-10-23T06:55:28Z

Description

fix: migrate from ethjs to @metamask/ethjs
fix(deps): unpin [email protected],x [email protected]
fix(deps): unpin [email protected]
fixup ethjs upgrade
deps: [email protected]>^4.2.2
fixup ethjs upgrade
deps: ethereumjs-util@^6.2.0->@ethereumjs/util@^8.1.0
deps: eth-json-rpc-middleware@^4.4.1->^7.0.1
deps: [email protected]>^5.1.0

Related issues

fix: replace legacy eth-json-rpc deps #11952

Blocked by / broken out into

fix(deps): unpin [email protected],x [email protected] #11972
- fix(deps): ethereumjs-util@6->^7.1.5 #11932
  - fix: ethereumjs-util -> @ethereumjs/util@^8.1.0 #11979
fix: @metamask/providers@16, @metamask/json-rpc-middleware-stream@8 #12085
fix: migrate from legacy ethjs to @metamask/ethjs #11969

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
I've completed the PR template to the best of my ability
I’ve included tests if applicable
I’ve documented my code using JSDoc format if applicable
I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

last still on readable-stream@2

github-actions · 2024-10-23T06:55:41Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

socket-security · 2024-10-23T06:58:06Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@types/[email protected]	None	`0`	13.9 kB	types
npm/[email protected]	None	`0`	27 kB	gudahtt
npm/[email protected]	network	`+1`	130 kB	rekmarks
npm/[email protected]	None	`0`	22.3 kB	gudahtt

View full report↗︎

socket-security · 2024-10-23T06:58:08Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
Network access	npm/[email protected]	Module: globalThis["fetch"] Location: Package overview	`package.json` `yarn.lock`	🚫

View full report↗︎

Next steps

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore npm/[email protected]

This is problematic due to the asynchronous callback potentially causing reace conditions

Why mixing v4 and v5 is A Bad Thing: ethereumjs/ethereumjs-util#250

github-actions · 2024-10-23T08:41:27Z

Bitrise

❌❌❌ pr_smoke_e2e_pipeline failed on Bitrise! ❌❌❌

Commit hash: 5d81074
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/885211b6-0973-4bb6-b0b7-b125f6589328

Note

You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request

Tip

Check the documentation if you have any doubts on how to understand the failure on bitrise

## **Description** - fix: migrate from legacy `ethjs-` packages to maintained and already used `@metamask/ethjs-` forks - Removes dependency on deprecated `babel-runtime` v6 - Bundle size reduction ## **Related issues** - #11952 - #11932 #### Blocking - #11968 ## **Manual testing steps** ## **Screenshots/Recordings** ### **Before** ### **After** ## **Pre-merge author checklist** - [x] I’ve followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

## **Description** Bump `eth-json-rpc-filters` ## **Related issues** - #11973 #### Blocking - #11968 ## **Manual testing steps** ## **Screenshots/Recordings** ### **Before** ### **After** ## **Pre-merge author checklist** - [x] I’ve followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

github-actions · 2025-03-03T14:34:33Z

This PR has been automatically marked as stale because it has not had recent activity in the last 90 days. It will be closed in 7 days. Thank you for your contributions.

legobeat · 2025-03-10T02:31:35Z

still relevant

## **Description** - Unpin and dedupe `ethereumjs-util` and `ethereumjs-abi` while staying on legacy v6 - Replace `import { BN } from 'ethereumjs-util'` with importing `BN` explicitly from either `bn.js@4` or `bn.js@5` - Mixing the two is not safe and can cause breakage. - [Some on why this is A Bad Thing](ethereumjs/ethereumjs-util#250) - We don't get complete and correct typings with importing the old re-export - This adds both v4 and v5 as explicit dependencies - ideally v4 will be removed as transition to v5 concludes - Add EIP-1191 address checksum algorithm support for `toChecksumAddress()` - Unblock relying on the ancient and deprecated `[email protected]` - [`ethereumjs-util` changelog](https://github.com/ethereumjs/ethereumjs-util/blob/master/CHANGELOG.md) - [`[email protected]`](ethereumjs/ethereumjs-util@v6.1.0...v6.2.0) ## **Related issues** - indutny/bn.js#209 - indutny/bn.js#295 - #12010 #### Blocking - #11932 - #12043 - #11968 ## **Manual testing steps** ## **Screenshots/Recordings** ### **Before** ### **After** ## **Pre-merge author checklist** - [x] I’ve followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots. --------- Co-authored-by: Nicolas MASSART <[email protected]> Co-authored-by: Nico MASSART <[email protected]>

NicolasMassart · 2025-10-29T10:30:51Z

deprecated

legobeat added 9 commits October 23, 2024 05:53

fix: migrate from ethjs to @metamask/ethjs

71b966d

fix(deps): unpin [email protected],x [email protected]

81bc78c

fix(deps): unpin [email protected]

5908aaf

fixup ethjs upgrade

947f834

deps: [email protected]>^4.2.2

7520a9f

last still on readable-stream@2

fixup ethjs upgrade

9af0b2d

deps: ethereumjs-util@^6.2.0->@ethereumjs/util@^8.1.0

8026d9c

deps: eth-json-rpc-middleware@^4.4.1->^7.0.1

1c7291d

deps: [email protected]>^5.1.0

b749b7e

github-actions bot added the team-lavamoat label Oct 23, 2024

legobeat mentioned this pull request Oct 23, 2024

fix: migrate from legacy ethjs to @metamask/ethjs #11969

Merged

7 tasks

chore: update iyarc

2d5cf18

legobeat changed the title ~~deps: migrate from legacy ethjs to @metamask/ethjs~~ fix: migrate from legacy ethjs to @metamask/ethjs Oct 23, 2024

legobeat added 5 commits October 23, 2024 07:19

fix: providerAsMiddleware import

af9a6e8

wip: use both bn.js@4 and bn.js@5

75f4c22

fix: don't reuse global fromAccBalance in useAddressBalance

8411d08

This is problematic due to the asynchronous callback potentially causing reace conditions

fix: vendor BNToHex and hexToBN in order to use bn.js v4

19f1896

fix: explicitly use BN4/BN5

5d81074

Why mixing v4 and v5 is A Bad Thing: ethereumjs/ethereumjs-util#250

legobeat force-pushed the deps-ethjs branch from b5e59a3 to 5d81074 Compare October 23, 2024 08:35

legobeat added dependencies Pull requests that update a dependency file team-application-security Application security team Run Smoke E2E labels Oct 23, 2024

legobeat added 4 commits October 23, 2024 08:42

chore: testfix

a678a01

fix: validateTokenAmount fix

713287a

REVERTME: debuglog

5890e43

lint:fix

bcf2f2d

legobeat added 2 commits October 23, 2024 09:42

REVERTME: debuglog

693467e

fixuP: remove unused lodash import

3fc9722

legobeat changed the title ~~fix: migrate from legacy ethjs to @metamask/ethjs~~ fix: migrate from deprecated legacy packages Oct 23, 2024

This was referenced Oct 23, 2024

fix(deps): unpin [email protected],x [email protected] #11972

Merged

fix(deps): [email protected]>^5.1.0 #11975

Merged

legobeat mentioned this pull request Oct 28, 2024

build(deps): bump @metamask/rpc-errors to ^7.0.1 #12006

Closed

7 tasks

NicolasMassart self-assigned this Dec 3, 2024

github-actions bot added the stale Issues that have not had activity in the last 90 days label Mar 3, 2025

github-actions bot removed the stale Issues that have not had activity in the last 90 days label Mar 10, 2025

metamaskbot added the external-contributor label Mar 10, 2025

EllusionN removed the team-application-security Application security team label Sep 25, 2025

metamaskbot added the INVALID-PR-TEMPLATE PR's body doesn't match template label Sep 25, 2025

georgewrmarshall removed the Run Smoke E2E label Oct 28, 2025

NicolasMassart closed this Oct 29, 2025

github-actions bot locked and limited conversation to collaborators Oct 29, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: migrate from deprecated legacy packages#11968

fix: migrate from deprecated legacy packages#11968
legobeat wants to merge 21 commits intomainfrom
deps-ethjs

legobeat commented Oct 23, 2024 •

edited

Loading

Uh oh!

github-actions bot commented Oct 23, 2024

Uh oh!

socket-security bot commented Oct 23, 2024 •

edited

Loading

Uh oh!

socket-security bot commented Oct 23, 2024 •

edited

Loading

Uh oh!

github-actions bot commented Oct 23, 2024 •

edited by metamaskbot

Loading

Uh oh!

github-actions bot commented Mar 3, 2025

Uh oh!

legobeat commented Mar 10, 2025

Uh oh!

NicolasMassart commented Oct 29, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

legobeat commented Oct 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related issues

Blocked by / broken out into

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

Uh oh!

github-actions bot commented Oct 23, 2024

Uh oh!

socket-security bot commented Oct 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Oct 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Next steps

Uh oh!

github-actions bot commented Oct 23, 2024 • edited by metamaskbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bitrise

Uh oh!

github-actions bot commented Mar 3, 2025

Uh oh!

legobeat commented Mar 10, 2025

Uh oh!

NicolasMassart commented Oct 29, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

legobeat commented Oct 23, 2024 •

edited

Loading

socket-security bot commented Oct 23, 2024 •

edited

Loading

socket-security bot commented Oct 23, 2024 •

edited

Loading

github-actions bot commented Oct 23, 2024 •

edited by metamaskbot

Loading