Release/v225

[dbeal-eth]

No description provided.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​jest@​29.5.14
	fast-deep-equal@​3.1.3
	deepmerge@​4.3.1
	prompts@​2.4.2
	buffer@​6.0.3
	@​types/​ms@​2.1.0
	rfdc@​1.4.1
	cors@​2.8.5
	lodash@​4.17.21
	@​cypress/​webpack-preprocessor@​6.0.2 ⏵ 6.0.4	+1			-1
	chalk@​4.1.2
	@​bahmutov/​cypress-esbuild-preprocessor@​2.2.2 ⏵ 2.2.4				+2
	@​cypress/​code-coverage@​3.13.11 ⏵ 3.14.0				+3
	dotenv@​16.4.5

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		safer-buffer@2.1.2 has Obfuscated code. Confidence: 0.94 Location: Package overview From: pnpm-lock.yaml → npm/@changesets/cli@2.27.7 → npm/safer-buffer@2.1.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/safer-buffer@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[claude]

Code Review for Release v2.25.0

This is a comprehensive release PR with 17 commits. Overall, the changes demonstrate good engineering practices. Here is my detailed feedback:

Strengths

1. Infrastructure Improvements

   • CLAUDE.md: Excellent documentation for AI-assisted development
   • GitHub Workflows: Well-structured with proper permissions
   • Progress Spinners: Great UX with TTY detection

2. Memory & Performance

   • Increased Node memory to 8192MB addresses build issues

3. Security & Robustness

   • Cycle Detection fix: Critical fix preventing infinite loops
   • Improved error handling for forge builds

4. Feature Enhancements

   • CREATE2 support for router step
   • Chain-specific build steps
   • Improved fetch command with better validation

Concerns & Recommendations

1. Console Utility (packages/cli/src/util/console.ts)

   • Issue: Spinner created as module-level singleton with immediate start
   • Side effects on import are an anti-pattern
   • Recommendation: Use lazy initialization function instead

2. Router CREATE2 (packages/builder/src/steps/router.ts)

   • Missing validation for templated CREATE2 addresses
   • Recommendation: Add viem.isAddress() check after templating

3. Cycle Detection Timing (packages/builder/src/definition.ts)

   • Happens after expensive dependency computation
   • Consider early detection during computation

4. Test Coverage

   • Missing tests for console.ts utilities
   • CREATE2 template injection needs error scenario tests
   • Add tests for spinner in non-TTY environments

5. Package Lock Churn

   • Significant unrelated changes in pnpm-lock.yaml
   • Consider pinning pnpm version

Security Considerations

• GitHub workflow permissions: Well-scoped ✅
• CREATE2 factory: Validate/whitelist custom addresses
• IPFS validation: Proper checks in place ✅

Priority Action Items

High:

• Fix spinner initialization pattern
• Add CREATE2 address validation
• Add console utility tests

Medium:

• Optimize cycle detection
• Improve IPFS error messages
• Add JSDoc for CREATE2

Low:

• Document memory increase rationale
• Investigate pnpm-lock churn

Overall Assessment

Solid release with valuable features and important fixes. Code quality is high. Main concerns are around console utility pattern and test coverage.

Recommendation: Approve with minor revisions

Issues are refinements, not blockers. Critical fixes (cycle detection, RPC errors) and UX improvements provide clear value.

Risk: Low-Medium

• Cycle detection: well-implemented
• Spinner changes: isolated with fallbacks
• CREATE2: backward compatible

Great work! 🎉