Version v10.14.7 RC #14834
Merged
Version v10.14.7 RC #14834
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is a rollback release to v10.13.0
This version includes a build system fix that ensures our builds are deterministic.
This version is equivalent to v10.14.2. This release is just intended to fix build configuration issues.
An externally hosted phishing warning page is now used rather than the built-in phishing warning page.The phishing page warning URL is set via configuration file or environment variable. The default URL is either the expected production URL or `http://localhost:9999/` for e2e testing environments. The new external phishing page includes a design change when it is loaded within an iframe. In that case it now shows a condensed message, and prompts the user to open the full warning page in a new tab to see more details or bypass the warning. This is to prevent a clickjacking attack from safelisting a site without user consent. The new external phishing page also includes a simple caching service worker to ensure it continues to work offline (or if our hosting goes offline), as long as the user has successfully loaded the page at least once. We also load the page temporarily during the extension startup process to trigger the service worker installation. The old phishing page and all related lines have been removed. The property `web_accessible_resources` has also been removed from the manifest. The only entry apart from the phishing page was `inpage.js`, and we don't need that to be web accessible anymore because we inject the script inline into each page rather than loading the file directly. New e2e tests have been added to cover more phishing warning page functionality, including the "safelist" action and the "iframe" case.
* Create `.zip` files deterministically Our build system now creates `.zip` archives deterministically. Previously the `.zip` file would differ between builds even when the files being archived were identical. This was because the order the files were passed in was non-deterministic, and the `mtime` for each file was different between builds. The files are now sorted before being zipped, and the `mtime` for each file has been set to the unix epoch. * Update lavamoat build policy
Two CI validation errors have been fixed: * A duplcate entry has been removed from the lockfile * `@metamask/phishing-warning` has been added to the depcheck config, so that it knows that dependency is being used (in e2e tests)
The e2e tests have been updated for `@metamask/phishing-warning@1.1.0`. The iframe case was updated with a new design, which required test changes. The third test that was meant to ensure the phishing page can't redirect to an extension page has been updated to navigate directly to the phishing warning page and setting the URL manually via query parameters, as that was the only way to test that redirect.
The phishing warning page URL environment variable has been renamed from `PHISHING_PAGE_URL` to `PHISHING_WARNING_PAGE_URL`. We call this page the "phishing warning page" everywhere else, and this name seemed better suited (it's not a phishing page itself). The variable has been listed and documented in `.metamaskrc.dist` as well.
A patch has been added to ensure lavapack no longer includes the path for each module as part of each serialized module. This path was originally added for debugging purposes, and is not used for anything at runtime. The module path was an absolute path, not a relative one, so it was an obstacle to having reproducible builds between environments.
* origin/master: (101 commits) Updating changelog Add token standard to custom token details (#14506) Revert "Dark Mode: What's New Announcement (#14346)" Ensure network name in confirm page container is defined (#14520) Updating lavamoat policies Fix the alerts toggles in settings (#14498) Disable swaps whenever the environment is not development or testing, so that behaviour follows production for QA purposes (#14499) [skip e2e] Updating changelog for v10.14.0 (#14487) Version v10.14.0 Docs - segment metrics (#14435) Add snaps view search (#14419) Run main, flask and beta in sequence in generate-lavamoat-policies.sh (#14470) Modify import SRP page (#14425) Dark Mode: Implement Metrics (#14455) HoldToRevealButton component (#13785) e2e test import json file as import account strategy (#14449) MetaMetrics: Identify 'number_of_tokens' user trait (#14427) MetaMetrics: Identify 'nft_autodetection_enabled' & 'opensea_api_enabled' (#14367) Swaps: Sort "token_from" dropdown tokens by their fiat value first and "token_to" by top tokens (#14436) Update segment instantiation check. Only check if SEGMENT_WRITE_KEY exists (#14407) ...
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Check warning
Code scanning / CodeQL
Inclusion of functionality from an untrusted source
Contributor
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
Collaborator
Author
Member
|
The yarn audit failure is on develop, so we can ignore it here. It will get fixed on develop. This release is already out. |
Gudahtt
approved these changes
Jun 2, 2022
tmashuang
approved these changes
Jun 2, 2022
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
📦 🚀