[mcmire]

This commit makes some related changes:

• Upgrade Yarn to v4, which is required by our various internal GitHub actions (e.g. action-npm-publish).
• Sync .yarnrc.yml with the module template (to enable various security-related settings).
• Upgrade development version of Node to 26. Node 26 is required in order to enable @lavamoat/harden, a tool the Core Platform team is rolling out which prevents repo-specific scripts from performing operations (network access, filesystem access, etc.) outside of their intended purpose.
• Upgrade the minimum required version of Node to 22 (versions prior to this are EOL).
• Update GitHub workflows to ensure that Corepack is installed before installing Node/Yarn (modern versions of Yarn are installed via Corepack, and modern versions of Node do not ship with Corepack)
  • This step will be cleaned up and made more automatic in a future PR
• Bump @metamask/allow-scripts to v5 (which includes a fix for Node 26 and yargs).
• Add @metamask/preinstall-always-fail (which should always accompany @metamask/allow-scripts, and which package.json referenced but which did not actually exist).
• Bump @metamask/auto-changelog to v7 (which includes a fix for Node 26 and yargs).

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​lavamoat/​preinstall-always-fail@​2.1.1
	playwright@​1.44.1 ⏵ 1.64.1	+1	+16	+1		-9
	@​lavamoat/​allow-scripts@​3.0.4 ⏵ 5.1.0				+1
	@​metamask/​auto-changelog@​3.4.4 ⏵ 7.1.0			+1	+6
	@​playwright/​test@​1.44.1 ⏵ 1.64.1				+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• @arcanis/slice-ansi@1.1.1
• @gar/promise-retry@1.0.3
• @isaacs/fs-minipass@4.0.1
• @lavamoat/preinstall-always-fail@2.1.1
• @octokit/auth-token@4.0.0
• @octokit/core@5.2.2
• @octokit/endpoint@9.0.6
• @octokit/graphql@7.1.1
• @octokit/openapi-types@24.2.0
• @octokit/plugin-paginate-rest@11.4.4-cjs.2
• @octokit/plugin-request-log@4.0.1
• @octokit/plugin-rest-endpoint-methods@13.3.2-cjs.1
• @octokit/request@8.4.1
• @octokit/request-error@5.1.1
• @octokit/rest@20.1.2
• @octokit/types@13.10.0
• @sindresorhus/is@4.6.0
• @szmarczak/http-timer@4.0.6
• @types/cacheable-request@6.0.3
• @types/emscripten@1.41.6
• @types/http-cache-semantics@4.2.0
• @types/keyv@3.1.4
• @types/responselike@1.0.3
• @types/semver@7.8.0
• @types/treeify@1.0.3
• @yarnpkg/core@4.9.1
• @yarnpkg/fslib@3.1.5
• @yarnpkg/libzip@3.2.2
• @yarnpkg/parsers@3.1.0
• @yarnpkg/shell@4.1.3
• before-after-hook@2.2.3
• cacheable-lookup@5.0.4
• cacheable-request@7.0.4
• camelcase@5.3.1
• ci-info@4.4.0
• clipanion@4.0.0-rc.4
• clone-response@1.0.3
• decompress-response@6.0.0
• mimic-response@3.1.0
• mimic-response@1.0.1
• defer-to-connect@2.0.1
• deprecation@2.3.1
• dotenv@16.6.1
• es-errors@1.3.0
• es-toolkit@1.53.1
• got@11.8.6
• grapheme-splitter@1.0.4
• hpagent@1.2.0
• http2-wrapper@1.0.3
• ini@6.0.0
• json-buffer@3.0.1
• keyv@4.5.4
• lowercase-keys@2.0.0
• normalize-url@6.1.0
• p-cancelable@2.1.1
• pump@3.0.4
• quick-lru@5.1.1
• resolve-alpn@1.2.1
• responselike@2.0.1
• tinyglobby@0.2.17
• fdir@6.5.0
• tinylogic@2.0.0
• treeify@1.1.0
• undici@6.29.1
• universal-user-agent@6.0.1
• semver@7.8.5
• yallist@5.0.0
• minipass@7.1.3
• argparse@2.0.1
• balanced-match@4.0.4
• brace-expansion@5.0.12
• chownr@3.0.0
• diff@5.2.2
• end-of-stream@1.4.5
• fast-glob@3.3.3
• hasown@2.0.4
• http-cache-semantics@4.3.0
• is-core-module@2.18.0
• is-stream@3.0.0
• js-yaml@4.3.2
• minizlib@3.1.0
• npm-normalize-package-bin@5.0.0
• p-limit@2.3.0
• p-try@2.2.0
• path-key@4.0.0
• picomatch@4.0.7
• resolve@1.22.12
• spdx-expression-parse@4.0.0
• tar@7.5.22
• type-fest@4.41.0
• tslib@2.9.1
• lru-cache@11.5.3
• @lavamoat/aa@5.0.1
• @lavamoat/allow-scripts@5.1.0
• @metamask/auto-changelog@7.1.0
• @npmcli/git@7.0.2
• @npmcli/node-gyp@5.0.0
• @npmcli/package-json@7.0.5
• glob@13.0.6
• minimatch@10.2.6
• @npmcli/promise-spawn@9.0.2
• @npmcli/run-script@10.0.4
• node-gyp@12.4.0
• proc-log@6.1.0
• @playwright/test@1.64.1
• abbrev@4.0.0
• bin-links@4.0.4
• isexe@4.0.0
• which@6.0.1
• execa@8.0.1
• get-stream@8.0.1
• get-stream@5.2.0
• hosted-git-info@9.0.3
• human-signals@5.0.0
• json-parse-even-better-errors@5.0.0
• mimic-fn@4.0.0
• nopt@9.0.0
• npm-install-checks@8.0.0
• npm-package-arg@13.0.2
• npm-pick-manifest@11.0.3
• npm-run-path@5.3.0
• onetime@6.0.0
• path-scurry@2.0.2
• playwright@1.64.1
• playwright-core@1.64.1
• strip-final-newline@3.0.0
• validate-npm-package-name@7.0.2
• yargs@17.7.3

View full report

[mcmire]

@SocketSecurity ignore npm/tslib@2.9.1

New author is OK. microsoft1es is a bot account that publishes NPM packages on behalf of Microsoft.

[mcmire]

@SocketSecurity ignore npm/playwright-core@1.64.1

It is a bit silly that this package installs browsers via playwright install, but this is the only way to cache them. We also use this approach in Extension as well.

[mcmire]

@SocketSecurity ignore-all

All of these warnings are coming from upgrades that we initiated. I'll check the security code scanner tab after this to address any vulnerabilities separately.