From 8e13b192f93b6f788b71bb68a7207061cc19efc5 Mon Sep 17 00:00:00 2001 From: github-actions Date: Tue, 3 Nov 2026 00:12:30 +0000 Subject: [PATCH 1/3] 5.1.1 --- CHANGELOG.md | 54 +++++++++++++++++++++++++++++++++++++++++++++++++++- package.json | 2 +- 2 files changed, 54 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d3148f1..baa716b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,5 @@ # Changelog + All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), @@ -6,33 +7,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [5.1.1] + +### Uncategorized + +- Fix/new brand favicon ([#232](https://github.com/MetaMask/phishing-warning/pull/232)) +- fix: upgrade to action-npm-publish@v7 ([#229](https://github.com/MetaMask/phishing-warning/pull/229)) +- fix: update X share link and stub X in e2e test ([#230](https://github.com/MetaMask/phishing-warning/pull/230)) +- feat: update default font from CentraNo1 to Geist ([#210](https://github.com/MetaMask/phishing-warning/pull/210)) +- fix: github workflows ([#205](https://github.com/MetaMask/phishing-warning/pull/205)) + ## [5.1.0] + ### Changed + - Send the entire URL via the `safelistPhishingDomain` stream ([#203](https://github.com/MetaMask/phishing-warning/pull/203)) ## [5.0.1] + ### Fixed + - fix: add overflow protection on very long urls ([#198](https://github.com/MetaMask/phishing-warning/pull/198)) ## [5.0.0] + ### Added + - Update MetaMask phishing image ([#190](https://github.com/MetaMask/phishing-warning/pull/190)) ### Fixed + - **BREAKING**: `data:` and `vbscript:` are now disallowed protocols alongside `javascript:` ([#175](https://github.com/MetaMask/phishing-warning/pull/175)) - Resolve issues with deployment scripts ([#191](https://github.com/MetaMask/phishing-warning/pull/191)) - Avoid creating playwright artifact with same name across node versions ([#192](https://github.com/MetaMask/phishing-warning/pull/192)) ## [4.1.0] + ### Added + - Redesign UI of the phishing warning page ([#176](https://github.com/MetaMask/phishing-warning/pull/176)) ## [4.0.0] + ### Changed + - **BREAKING**: Update `phishingSafelistStream` to send `origin` instead of `hostname` as a parameter for `safelistPhishingDomain` method ([#165](https://github.com/MetaMask/phishing-warning/pull/165)) ## [3.0.4] + ### Changed + - Update index.html - update attribution copy ([#161](https://github.com/MetaMask/phishing-warning/pull/161)) - chore(devdeps): @lavamoat/allow-scripts@^2.3.1->^3.0.4 ([#157](https://github.com/MetaMask/phishing-warning/pull/157)) - Enabling MetaMask security code scanner ([#151](https://github.com/MetaMask/phishing-warning/pull/151)) @@ -40,29 +64,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Bump @metamask/post-message-stream from 7.0.0 to 8.0.0 ([#146](https://github.com/MetaMask/phishing-warning/pull/146)) ## [3.0.3] + ### Changed + - Update `ses` to `v1.1.0` ([#143](https://github.com/MetaMask/phishing-warning/pull/143)) ## [3.0.2] + ### Fixed + - change to hostname for Github issues ([#127](https://github.com/MetaMask/phishing-warning/pull/127)) ## [3.0.1] + ### Changed + - Using href url param only for suspect site ([#124](https://github.com/MetaMask/phishing-warning/pull/124)) ## [3.0.0] + ### Changed + - **BREAKING**: Increase minimum Node.js version to 16 ([#107](https://github.com/MetaMask/phishing-warning/pull/107)) - **BREAKING**: This package now returns streams conforming to the API of readable-stream@3.x. ([#122](https://github.com/MetaMask/phishing-warning/pull/122)) ([#104](https://github.com/MetaMask/phishing-warning/pull/104)) - Bump @metamask/post-message-stream from ^6.2.0 to ^7.0.0 ([#104](https://github.com/MetaMask/phishing-warning/pull/104)) - Upgrade obj-multiplex to @metamask/object-multiplex@^2.0.0 ([#122](https://github.com/MetaMask/phishing-warning/pull/122)) ### Fixed + - Bump ses from ^0.18.7 to ^0.18.8 ([#120](https://github.com/MetaMask/phishing-warning/pull/120)) ## [2.1.1] + ### Fixed + - Dependency updates ([#105](https://github.com/MetaMask/phishing-warning/pull/105)) - Move @types/punycode from dependencies to devDependencies - Update @metamask/design-tokens from ^1.6.0 to ^1.12.0 @@ -71,37 +106,51 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Update ses from ^0.18.1 to ^0.18.7 ## [2.1.0] + ### Changed + - "Back to safety" button now triggers a `backToSafetyPhishingWarning` message to be sent on the `phishingSafelistStream` ([#84](https://github.com/MetaMask/phishing-warning/pull/84)) ## [2.0.1] + ### Fixed + - Restore iframe warning and "open in new tab" link ([#73](https://github.com/MetaMask/phishing-warning/pull/73)) ## [2.0.0] + ### Changed + - **BREAKING:** Dynamically lookup the source of a block ([#57](https://github.com/MetaMask/phishing-warning/pull/57)) - The query parameter `newIssueUrl` is no longer accepted. Instead this page will look up the source of a block dynamically. - We no longer show on the page which project is responsible for the block. This will be restored in a future version. - Redesign the phishing warning page ([#52](https://github.com/MetaMask/phishing-warning/pull/52)) ## [1.2.2] + ### Changed + - Update `ses` version from v0.12.4 to v10.18.1 ([#53](https://github.com/MetaMask/phishing-warning/pull/53)) - Update @metamask/design-tokens from 1.9.0 to 1.11.1 ([#46](https://github.com/MetaMask/phishing-warning/pull/46)) - This includes minor color updates. ## [1.2.1] + ### Fixed + - Fix build script to exclude file imports from `@metamask/post-message-stream` which expect to only run in the context of a Web worker ([#27](https://github.com/MetaMask/phishing-warning/pull/27)) ## [1.2.0] [DEPRECATED] + ### Added + - Add a check for the protocol of the url being blocked. Remove `continue at your own risk` option if protocol is disallowed ([#16](https://github.com/MetaMask/phishing-warning/pull/16)) - Add optional arg `newIssueUrl` to `getUrl` function so that the correct link to direct disputes can be specified by a hash query param. ([#23](https://github.com/MetaMask/phishing-warning/pull/23)) ## [1.1.0] + ### Added + - Add service worker for offline caching ([#9](https://github.com/MetaMask/phishing-warning/pull/9)) - Add favicons ([#8](https://github.com/MetaMask/phishing-warning/pull/8)) - Add actions to publish to gh-pages ([#3](https://github.com/MetaMask/phishing-warning/pull/3)) @@ -114,11 +163,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - A script was added to the HTML file to detect when the frame is being embedded. If it detects that it is embedded, a separate design is used that prompts the user to open the warning page in a new tab to proceed. This ensures the blocked page cannot be added to the safelist via a clickjacking attack. ## [1.0.0] + ### Changed + - Initial implementation of the phishing warning page - This should behave identically to the phishing warning page built into the MetaMask extension. -[Unreleased]: https://github.com/MetaMask/phishing-warning/compare/v5.1.0...HEAD +[Unreleased]: https://github.com/MetaMask/phishing-warning/compare/v5.1.1...HEAD +[5.1.1]: https://github.com/MetaMask/phishing-warning/compare/v5.1.0...v5.1.1 [5.1.0]: https://github.com/MetaMask/phishing-warning/compare/v5.0.1...v5.1.0 [5.0.1]: https://github.com/MetaMask/phishing-warning/compare/v5.0.0...v5.0.1 [5.0.0]: https://github.com/MetaMask/phishing-warning/compare/v4.1.0...v5.0.0 diff --git a/package.json b/package.json index b154d33..225132a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@metamask/phishing-warning", - "version": "5.1.0", + "version": "5.1.1", "description": "A page to warn users about a suspected phishing site.", "repository": { "type": "git", From 1801c123a8d9b1a96635ba54d91694cf7f2b7733 Mon Sep 17 00:00:00 2001 From: mindofmar Date: Mon, 2 Nov 2026 18:43:45 -0600 Subject: [PATCH 2/3] chore: fix CHANGELOG --- CHANGELOG.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index baa716b..3d5106a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,13 +9,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [5.1.1] -### Uncategorized +### Changed + +- Update default font from CentraNo1 to Geist ([#210](https://github.com/MetaMask/phishing-warning/pull/210)) +- Upgrade to action-npm-publish@v7 ([#229](https://github.com/MetaMask/phishing-warning/pull/229)) + +### Fixed -- Fix/new brand favicon ([#232](https://github.com/MetaMask/phishing-warning/pull/232)) -- fix: upgrade to action-npm-publish@v7 ([#229](https://github.com/MetaMask/phishing-warning/pull/229)) -- fix: update X share link and stub X in e2e test ([#230](https://github.com/MetaMask/phishing-warning/pull/230)) -- feat: update default font from CentraNo1 to Geist ([#210](https://github.com/MetaMask/phishing-warning/pull/210)) -- fix: github workflows ([#205](https://github.com/MetaMask/phishing-warning/pull/205)) +- Update favicon to new brand ([#232](https://github.com/MetaMask/phishing-warning/pull/232)) +- Update X share link and stub X in e2e test ([#230](https://github.com/MetaMask/phishing-warning/pull/230)) +- Fix GitHub workflows ([#205](https://github.com/MetaMask/phishing-warning/pull/205)) ## [5.1.0] From 7c10ba89cf7493e50448a9fa2ce44029cdfe25c2 Mon Sep 17 00:00:00 2001 From: mindofmar Date: Mon, 2 Nov 2026 18:48:12 -0600 Subject: [PATCH 3/3] chore: fix CHANGELOG linting --- CHANGELOG.md | 44 -------------------------------------------- 1 file changed, 44 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3d5106a..2760ef2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,4 @@ # Changelog - All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), @@ -8,58 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ## [5.1.1] - ### Changed - - Update default font from CentraNo1 to Geist ([#210](https://github.com/MetaMask/phishing-warning/pull/210)) - Upgrade to action-npm-publish@v7 ([#229](https://github.com/MetaMask/phishing-warning/pull/229)) ### Fixed - - Update favicon to new brand ([#232](https://github.com/MetaMask/phishing-warning/pull/232)) - Update X share link and stub X in e2e test ([#230](https://github.com/MetaMask/phishing-warning/pull/230)) - Fix GitHub workflows ([#205](https://github.com/MetaMask/phishing-warning/pull/205)) ## [5.1.0] - ### Changed - - Send the entire URL via the `safelistPhishingDomain` stream ([#203](https://github.com/MetaMask/phishing-warning/pull/203)) ## [5.0.1] - ### Fixed - - fix: add overflow protection on very long urls ([#198](https://github.com/MetaMask/phishing-warning/pull/198)) ## [5.0.0] - ### Added - - Update MetaMask phishing image ([#190](https://github.com/MetaMask/phishing-warning/pull/190)) ### Fixed - - **BREAKING**: `data:` and `vbscript:` are now disallowed protocols alongside `javascript:` ([#175](https://github.com/MetaMask/phishing-warning/pull/175)) - Resolve issues with deployment scripts ([#191](https://github.com/MetaMask/phishing-warning/pull/191)) - Avoid creating playwright artifact with same name across node versions ([#192](https://github.com/MetaMask/phishing-warning/pull/192)) ## [4.1.0] - ### Added - - Redesign UI of the phishing warning page ([#176](https://github.com/MetaMask/phishing-warning/pull/176)) ## [4.0.0] - ### Changed - - **BREAKING**: Update `phishingSafelistStream` to send `origin` instead of `hostname` as a parameter for `safelistPhishingDomain` method ([#165](https://github.com/MetaMask/phishing-warning/pull/165)) ## [3.0.4] - ### Changed - - Update index.html - update attribution copy ([#161](https://github.com/MetaMask/phishing-warning/pull/161)) - chore(devdeps): @lavamoat/allow-scripts@^2.3.1->^3.0.4 ([#157](https://github.com/MetaMask/phishing-warning/pull/157)) - Enabling MetaMask security code scanner ([#151](https://github.com/MetaMask/phishing-warning/pull/151)) @@ -67,40 +50,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Bump @metamask/post-message-stream from 7.0.0 to 8.0.0 ([#146](https://github.com/MetaMask/phishing-warning/pull/146)) ## [3.0.3] - ### Changed - - Update `ses` to `v1.1.0` ([#143](https://github.com/MetaMask/phishing-warning/pull/143)) ## [3.0.2] - ### Fixed - - change to hostname for Github issues ([#127](https://github.com/MetaMask/phishing-warning/pull/127)) ## [3.0.1] - ### Changed - - Using href url param only for suspect site ([#124](https://github.com/MetaMask/phishing-warning/pull/124)) ## [3.0.0] - ### Changed - - **BREAKING**: Increase minimum Node.js version to 16 ([#107](https://github.com/MetaMask/phishing-warning/pull/107)) - **BREAKING**: This package now returns streams conforming to the API of readable-stream@3.x. ([#122](https://github.com/MetaMask/phishing-warning/pull/122)) ([#104](https://github.com/MetaMask/phishing-warning/pull/104)) - Bump @metamask/post-message-stream from ^6.2.0 to ^7.0.0 ([#104](https://github.com/MetaMask/phishing-warning/pull/104)) - Upgrade obj-multiplex to @metamask/object-multiplex@^2.0.0 ([#122](https://github.com/MetaMask/phishing-warning/pull/122)) ### Fixed - - Bump ses from ^0.18.7 to ^0.18.8 ([#120](https://github.com/MetaMask/phishing-warning/pull/120)) ## [2.1.1] - ### Fixed - - Dependency updates ([#105](https://github.com/MetaMask/phishing-warning/pull/105)) - Move @types/punycode from dependencies to devDependencies - Update @metamask/design-tokens from ^1.6.0 to ^1.12.0 @@ -109,51 +81,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Update ses from ^0.18.1 to ^0.18.7 ## [2.1.0] - ### Changed - - "Back to safety" button now triggers a `backToSafetyPhishingWarning` message to be sent on the `phishingSafelistStream` ([#84](https://github.com/MetaMask/phishing-warning/pull/84)) ## [2.0.1] - ### Fixed - - Restore iframe warning and "open in new tab" link ([#73](https://github.com/MetaMask/phishing-warning/pull/73)) ## [2.0.0] - ### Changed - - **BREAKING:** Dynamically lookup the source of a block ([#57](https://github.com/MetaMask/phishing-warning/pull/57)) - The query parameter `newIssueUrl` is no longer accepted. Instead this page will look up the source of a block dynamically. - We no longer show on the page which project is responsible for the block. This will be restored in a future version. - Redesign the phishing warning page ([#52](https://github.com/MetaMask/phishing-warning/pull/52)) ## [1.2.2] - ### Changed - - Update `ses` version from v0.12.4 to v10.18.1 ([#53](https://github.com/MetaMask/phishing-warning/pull/53)) - Update @metamask/design-tokens from 1.9.0 to 1.11.1 ([#46](https://github.com/MetaMask/phishing-warning/pull/46)) - This includes minor color updates. ## [1.2.1] - ### Fixed - - Fix build script to exclude file imports from `@metamask/post-message-stream` which expect to only run in the context of a Web worker ([#27](https://github.com/MetaMask/phishing-warning/pull/27)) ## [1.2.0] [DEPRECATED] - ### Added - - Add a check for the protocol of the url being blocked. Remove `continue at your own risk` option if protocol is disallowed ([#16](https://github.com/MetaMask/phishing-warning/pull/16)) - Add optional arg `newIssueUrl` to `getUrl` function so that the correct link to direct disputes can be specified by a hash query param. ([#23](https://github.com/MetaMask/phishing-warning/pull/23)) ## [1.1.0] - ### Added - - Add service worker for offline caching ([#9](https://github.com/MetaMask/phishing-warning/pull/9)) - Add favicons ([#8](https://github.com/MetaMask/phishing-warning/pull/8)) - Add actions to publish to gh-pages ([#3](https://github.com/MetaMask/phishing-warning/pull/3)) @@ -166,9 +124,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - A script was added to the HTML file to detect when the frame is being embedded. If it detects that it is embedded, a separate design is used that prompts the user to open the warning page in a new tab to proceed. This ensures the blocked page cannot be added to the safelist via a clickjacking attack. ## [1.0.0] - ### Changed - - Initial implementation of the phishing warning page - This should behave identically to the phishing warning page built into the MetaMask extension.