Repository navigation
Remove Lint Rule "no-prototype-builtins" - #421
Merged
Merged
Conversation
Mrtenz
pushed a commit
that referenced
this pull request
Oct 16, 2025
This reverts commit 562d105. <!-- Thanks for your contribution! Take a moment to answer these questions so that reviewers have the information they need to properly understand your changes: * What is the current state of things and why does it need to change? * What is the solution your changes offer and how does it work? Are there any issues or other links reviewers should consult to understand this pull request better? For instance: * Fixes #12345 * See: #67890 --> <!-- CURSOR_SUMMARY --> --- > [!NOTE] > Remove `useCache: false` from `PollingBlockTracker.getLatestBlock()` calls across middlewares; update changelog and raise Jest coverage thresholds. > > - **Middleware**: > - Remove `useCache: false` from `PollingBlockTracker.getLatestBlock()` in `src/block-cache.ts`, `src/block-ref-rewrite.ts`, `src/block-ref.ts`, and `src/retryOnEmpty.ts`. > - **Changelog**: > - Add Unreleased “Fixed” note about preventing request delays and reverting `#416`. > - **Testing**: > - Increase Jest global coverage thresholds (`branches`, `functions`, `lines`, `statements`). > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 2edc83d1b17e5b36973d9807d8a98f89d5455520. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY -->
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Nov 7, 2026
## What is the current state of things and why does it need to change? `@metamask/eth-sig-util` currently supports Node.js 18 and 20 (`engines.node: ^18.18 || ^20.14 || >=22`). Node.js 18 is end-of-life and 20 is entering maintenance, and the current MetaMask module template has moved its baseline to Node.js 22. This bump is also a prerequisite for migrating npm publishing to OIDC trusted publishing via `MetaMask/action-npm-publish@v6`, which requires Node.js >= 22.14.0 (see MetaMask#421). Splitting it out here keeps that breaking, consumer-facing change isolated with its own changelog entry. ## What is the solution your changes offer and how does it work? Bump the minimum supported Node.js version to 22, aligning with the module template: - `engines.node`: `^18.18 || ^20.14 || >=22` → `^22 || ^24 || >=26` - `.nvmrc`: `v18` → `lts/*` - CI test matrix: `18.x` / `20.x` / `22.x` → `22.x` / `24.x` / `26.x` - README: Node 18 → 22 This PR intentionally does **not** touch the package manager (`yarn@3.2.2`) or the publishing workflow; those are handled in the OIDC migration PR (MetaMask#421), which will rebase on top of this once merged. ## Are there any smaller changes to this PR that you would like to highlight? - This is a **breaking change** for consumers on Node.js 18 or 20, hence the `!` in the commit and the `**BREAKING**` changelog entry. ## References - Required by the OIDC trusted-publishing migration: MetaMask#421 - Matches the [module template](https://github.com/MetaMask/metamask-module-template) Node.js baseline (`^22 || ^24 || >=26`, `.nvmrc` `lts/*`) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Policy and CI-only changes with no runtime code paths modified; the main impact is consumers still on Node 18 or 20 must upgrade before installing future releases. > > **Overview** > **Breaking change:** the package no longer supports Node.js 18 or 20. The minimum is **Node.js 22**, reflected in `package.json` `engines.node` (`^22 || ^24 || >=26`), contributor docs, and a **BREAKING** `[Unreleased]` changelog entry. > > CI **prepare**, **build**, and **test** matrices now run on **22.x / 24.x / 26.x** instead of 18.x / 20.x / 22.x. Local dev defaults move from `.nvmrc` `v18` to **`lts/*`**. README setup instructions now ask for Node **22**. > > No library source or signing behavior changes—only supported Node versions and how they are validated in CI. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit d43ef9c4b006b7b468312527c4a58c9862e49bc9. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Nov 7, 2026
…e template (MetaMask#421) ## What is the current state of things and why does it need to change? `@metamask/eth-sig-util`'s CI/publish setup had drifted from the [metamask-module-template](https://github.com/MetaMask/metamask-module-template): - npm publishing used `MetaMask/action-npm-publish@v1` (token-based) with no `id-token: write`, so it could not use OIDC. Core Platform is enforcing [trusted publishing via OIDC](https://docs.npmjs.com/trusted-publishers) and [staged publishing](https://docs.npmjs.com/staged-publishing/), and non-staged publishes will be rejected. - The workflows used manual `checkout` / `corepack enable` / `setup-node` / `yarn install` boilerplate instead of the shared `action-checkout-and-setup` action and the reusable `main.yml` orchestrator pattern. - `packageManager: yarn@3.2.2` was below what `action-npm-publish@v6` requires. > **Note:** The required Node.js bump (Node >= 22.14.0) landed separately in MetaMask#422 and is already on `main`. ## What is the solution your changes offer and how does it work? Aligns the GitHub Actions setup with the module template and adopts OIDC trusted publishing: - **Adopt OIDC trusted publishing**: upgrade `action-npm-publish` `@v1` → `@v6` (dry-run + publish), add `id-token: write`, and make `NPM_TOKEN` optional (only needed for the first publish, then deleted from the `npm-publish` environment). - **Switch Yarn to Corepack**: bump `packageManager` to `yarn@4.16.0` (integrity hash), remove `yarnPath` and the committed `.yarn/releases` binary. - **Restructure workflows to match the template**: add a `main.yml` orchestrator (runs `check-workflows` + `build-lint-test` on push/PR, gates the release via `is-release` → `publish-release`); convert `build-lint-test.yml` and `publish-release.yml` to reusable `workflow_call` workflows using `MetaMask/action-checkout-and-setup@v3` and artifact-based build/publish; update `create-release-pr.yml` (`action-create-release-pr@v5`), `publish-docs.yml`, and `publish-rc-docs.yml`. - **Bump `@metamask/auto-changelog`** `^3.1.0` → `^6.2.1` so `auto-changelog validate` works on the Node 22/24/26 CI matrix. - Regenerate `yarn.lock` in the Yarn 4 format. No dependency versions changed beyond `auto-changelog`. ### Intentional adaptations (vs a literal template copy) - Keep the existing standalone `security-code-scanner.yml` (not folded into `main.yml`). - Keep `GITHUB_TOKEN` for docs deploys (no `PUBLISH_DOCS_TOKEN` dependency). - Omit the Slack integration (the repo has no `SLACK_WEBHOOK_URL` secret). - Use `auto-changelog` for changelog validation (no `lint:changelog` script). - Keep a plain-string `release-type` input (no `type: choice`), which avoids needing an `actionlint.yml` config file. Once merged, trusted publishing must be configured for `@metamask/eth-sig-util` on the NPM side (via [@metamask-npm-publishers](https://consensys.slack.com/?subteam=S042S7RE4AE)) before the next release. ## References - Prerequisite (merged): MetaMask#422 (drop Node.js 18/20) - Reference diff: [metamask-module-template@193ed00](MetaMask/metamask-module-template@193ed00) - [NPM trusted publishing docs](https://docs.npmjs.com/trusted-publishers), [staged publishing docs](https://docs.npmjs.com/staged-publishing/) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > Changes npm publish flow (OIDC, artifacts, job ordering) and release gating on main, so a misconfiguration could block or mishandle releases. > > **Overview** > Replaces the monolithic **Build, Lint, and Test** workflow with a **`main.yml` orchestrator** on push/PR that runs **actionlint** (new matcher + config, including an ignore for intentional empty `release-type`), a **reusable security scan** (replacing the standalone scanner workflow), and a **`workflow_call` build/lint/test** pipeline using **`MetaMask/action-checkout-and-setup@v3`**. Build and lint now run on **Node 26.x** only (tests still matrix 22/24/26), and a new **compatibility-test** job reinstalls deps without the lockfile before restoring it. > > **Release publishing** is no longer triggered directly from `publish-release.yml` on `main` pushes; **`main.yml`** gates **`is-release`** → **`publish-release.yml`** (now callable). That workflow **builds once, uploads artifacts**, runs **npm dry-run + publish via `action-npm-publish@v6`** with **`id-token: write`**, optional **`NPM_TOKEN`**, then docs deploys and a separate **`action-publish-release@v3`** GitHub release step. **`create-release-pr`** moves to the shared checkout action and **`action-create-release-pr@v5`**, with **`release-type` as a choice** (including empty). Docs publishing adds **`github-pages` environment**, shared checkout/setup, and bumps **peaceiris/actions-gh-pages**. Adds **`.github/zizmor.yml`** for workflow lint policy tweaks. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 8b88ff0d45387fdc7e0b5b36bd36beca0b235c05. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Nov 7, 2026
## Explanation The `9.0.0` release ([MetaMask#420](MetaMask/eth-sig-util#420)) was tagged but **never published to npm** — the team decided to migrate publishing to OIDC trusted publishing ([MetaMask#421](MetaMask/eth-sig-util#421)) before cutting the release. This PR un-releases `9.0.0` so it can be re-cut cleanly on top of the OIDC migration. ## Changes - **`package.json`**: `9.0.0` → `8.2.0`. - **`CHANGELOG.md`**: - Remove the `## [9.0.0]` section heading and fold its entries back under `## [Unreleased]`: - **BREAKING**: Reject ambiguous `bool` values in `signTypedData` ([MetaMask#419](MetaMask/eth-sig-util#419)) - Add additional validation to EIP7702 methods ([MetaMask#410](MetaMask/eth-sig-util#410)) - Reset the `[Unreleased]` compare link to `v8.2.0...HEAD` and drop the `[9.0.0]` link. The Node.js 18/20 drop entry ([MetaMask#422](MetaMask/eth-sig-util#422)), which was added after `9.0.0` was cut, is preserved under `[Unreleased]`. ## Follow-ups (not in this PR) - The existing `v9.0.0` **git tag** (`cbc535a`) will be deleted separately before the new `release/9.0.0` PR (npm was never published, so nothing to unpublish). - After this merges, a fresh `release/9.0.0` PR will be created via the standard release workflow. ## References - Reverts the release portion of MetaMask#420 - Depends on OIDC migration MetaMask#421 (merged)
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Nov 7, 2026
## Summary Docs deploys to `gh-pages` were failing (GH013 ruleset rejection) because MetaMask#421 switched the deploy token to `GITHUB_TOKEN`, which isn't allowed to bypass the org's push-protection ruleset on `gh-pages`. Fixes it by switching to OIDC token-exchange (same pattern as [`MetaMask/snaps`](https://github.com/MetaMask/snaps/blob/main/.github/workflows/publish-github-pages.yml)): each deploy job exchanges its OIDC identity for a short-lived `contents: write` token via `MetaMask/github-tools/.github/actions/get-token@v1`, instead of using a stored secret. ## Why this approach over reverting to the old `PUBLISH_DOCS_TOKEN` secret That secret still exists and would also fix the immediate issue, but it's been unused/unrotated since MetaMask#421 — exactly the kind of staleness that let this regression go unnoticed. ## Validation - `actionlint v1.7.12`: 0 errors on all changed files - Matches `snaps`' working implementation exactly (permissions, `get-token` step, `personal_token` wiring) - `vars.TOKEN_EXCHANGE_URL` confirmed already inherited by this repo at the org level ## Caveat Can't verify from the API whether the token-exchange service's server-side trust policy already allows `eth-sig-util` to bypass the `gh-pages` ruleset (it evidently does for `snaps`). If not yet configured, the `Get access token` step will fail with a clear error rather than a silent bad push.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The rules of this lint rule is outlined here: https://eslint.org/docs/rules/no-prototype-builtins
I mimicked how they recommend we solve the lint issue.
Simple two-liner! Removed lint rule from eslint config, refactored line that was causing the issue according to docs.