chore(lavamoat/lavadome): bump to v0.0.20

[weizman]

Introduce LavaMoat/LavaDome#56 + LavaMoat/LavaDome#59

This should go with #25653

Also, bump snow version LavaMoat/snow#162 which fixes a bug that clashed with this new LavaDome version

[socket-security]

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@babel/code-frame@7.25.9	environment	0	24.1 kB	nicolo-ribaudo
npm/@babel/parser@7.25.9	None	0	1.89 MB	nicolo-ribaudo
npm/@endo/env-options@1.1.0 🔁 npm/@endo/env-options@1.1.8	None	0	28 kB	kriskowal
npm/@lavamoat/lavadome-core@0.0.20 🔁 npm/@lavamoat/lavadome-core@0.0.17	None	0	0 B
npm/@lavamoat/lavadome-react@0.0.20 🔁 npm/@lavamoat/lavadome-react@0.0.17	None	0	0 B
npm/@lavamoat/snow@2.0.3 🔁 npm/@lavamoat/snow@2.0.2	None	0	307 kB	weizman
npm/@sovpro/delimited-stream@1.1.0	None	0	7.18 kB	sovpro
npm/acorn@8.11.3	None	0	531 kB	marijn
npm/bitwise@2.2.1 🔁 npm/bitwise@2.1.0	None	0	131 kB	florianwendelborn
npm/borc@3.0.0	None	0	162 kB	achingbrain
npm/eth-chainlist@0.0.519 🔁 npm/eth-chainlist@0.0.498	None	0	1.17 MB	zanechua
npm/follow-redirects@1.15.6 🔁 npm/follow-redirects@1.15.9	None	0	29.4 kB	rubenverborgh
npm/gridplus-sdk@2.7.1 🔁 npm/gridplus-sdk@2.5.1	None	+11	2.43 MB	asmiller1989
npm/iso-url@1.2.1	None	0	13.5 kB	hugomrdias
npm/json-text-sequence@0.3.0	None	0	7.66 kB	hildjj
npm/secp256k1@5.0.0	None	+1	2.52 MB	fanatid
npm/ses@1.1.0 🔁 npm/ses@1.9.0	None	0	3.2 MB	kriskowal

🚮 Removed packages: npm/eth-eip712-util-browser@0.0.3

View full report↗︎

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[weizman]

Found the on going bug with test-e2e-firefox, it's in snow, will be fixed by LavaMoat/snow#161

[metamaskbot]

Builds ready [0f4450e]

• builds: chrome, firefox
• builds (beta): chrome
• builds (flask): chrome, firefox
• builds (MMI): chrome, firefox
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• build viz: Build System
• mv3: Background Module Init Stats
• mv3: UI Init Stats
• mv3: Module Load Stats
• mv3: Bundle Size Stats
• mv2: E2e Actions Stats
• code coverage: Report
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts
• bundle viz:

  • background: 0, 1, 2, 3, 4, 5, 6
  • common: 0, 1, 10, 11, 2, 3, 4, 5, 6, 7, 8, 9
  • content-script: 0
  • offscreen: 0
  • ui: 0, 1, 10, 11, 12, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (1947 ± 68 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	195	2250	1711	553	266
		domContentLoaded	1746	2414	1910	146	70
		load	1790	2421	1947	141	68
		domInteractive	17	189	49	38	18
		backgroundConnect	8	94	39	29	14
		firstReactRender	52	117	89	19	9
		getState	4	65	18	17	8
		initialActions	0	1	0	0	0
		loadScripts	1269	1949	1412	148	71
		setupStore	12	68	33	23	11
		uiStartup	1959	2636	2149	154	74

Bundle size diffs [🚨 Warning! Bundle size has increased!]

• background: 68 Bytes (0.00%)
• ui: 917 Bytes (0.01%)
• common: 0 Bytes (0.00%)

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
High CVE	npm/secp256k1@5.0.0	CVE: GHSA-584q-6j8j-r5pm secp256k1-node allows private key extraction over ECDH (HIGH) Affected versions: = 5.0.0 Patched version: 5.0.1	yarn.lock	🚫
Native code	npm/secp256k1@5.0.0	Location: Package overview	yarn.lock	🚫
New author	npm/borc@3.0.0	New Author: achingbrain Previous Author: dignifiedquire	yarn.lock	🚫

View full report↗︎

Next steps

What is a CVE?

Contains a high severity Common Vulnerability and Exposure (CVE).

Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Why is native code a concern?

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

What is new author?

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/secp256k1@5.0.0
• @SocketSecurity ignore npm/borc@3.0.0

[metamaskbot]

Builds ready [4e13597]

• builds: chrome, firefox
• builds (flask): chrome, firefox
• builds (MMI): chrome
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• build viz: Build System
• mv3: Bundle Size Stats
• mv2: E2e Actions Stats
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts
• bundle viz:

  • background: 0, 1, 2, 3, 4, 5, 6, 7
  • common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12
  • ui: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13
  • content-script: 0
  • offscreen: 0

Page Load Metrics (1633 ± 81 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	1371	1998	1643	160	77
		domContentLoaded	1364	1991	1609	166	80
		load	1372	1997	1633	168	81
		domInteractive	17	69	32	14	7
		backgroundConnect	7	83	26	21	10
		firstReactRender	16	98	52	32	15
		getState	4	91	15	21	10
		initialActions	0	1	0	0	0
		loadScripts	976	1451	1176	131	63
		setupStore	6	71	18	22	10
		uiStartup	1607	2498	2000	243	116

Bundle size diffs [🚨 Warning! Bundle size has increased!]

• background: 91.26 KiB (1.60%)
• ui: 917 Bytes (0.01%)
• common: -3.73 KiB (-0.04%)

[weizman]

ditched in favor of #29691