metamask-extension/.yarnrc.yml at main · BearNetwork-BRNKC/metamask-extension · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
compressionLevel: mixed

enableGlobalCache: false

enableScripts: false

enableTelemetry: false

logFilters:
  - code: YN0004
    level: discard

nodeLinker: node-modules

npmAuditIgnoreAdvisories:
  ### Advisories:

  # Issue: Regular Expression Denial of Service (ReDOS)
  # URL: https://github.com/advisories/GHSA-257v-vj4p-3w2h
  # color-string is listed as a dependency of 'color' which is brought in by
  # @metamask/jazzicon v2.0.0 but there is work done on that repository to
  # remove the color dependency. We should upgrade
  - 1089718

  # Issue: Issue: Babel has inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups
  # We are ignoring this on April 24, 2025 to unblock CI, we will follow with a proper fix or confirmation this does not affect our users
  - 1104001

  # Issue: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
  # URL: https://github.com/advisories/GHSA-w5hq-g745-h8pq
  # This advisory only applies when uuid.v3, uuid.v5, or uuid.v6 are called
  # with a caller-provided output buffer. A static reachability scan of the
  # workspace and installed packages found no such calls; the only v5 usage
  # calls v5(text, namespace) without a buffer.
  - 1119441

  # Issue: Elliptic Uses a Cryptographic Primitive with a Risky Implementation
  # URL: https://github.com/advisories/GHSA-848j-6mx2-7j84
  # There is no fix for this low-severity advisory
  - 1112030

  # Issue: React Router: Open redirect via backslash in <Link> and useNavigate
  # URL: https://github.com/advisories/GHSA-wrjc-x8rr-h8h6
  # The extension uses HashRouter rather than BrowserRouter, so it does not
  # process attacker-controlled paths from a web server.
  - 1124268

  # Issue: React Router: Open redirect leading to XSS
  # URL: https://github.com/advisories/GHSA-jjmj-jmhj-qwj2
  # The extension uses HashRouter rather than BrowserRouter, so it does not
  # use browser-history paths supplied by a web server.
  - 1124270

  # Issue: React Router: Arbitrary Constructor Injection via deserializeErrors()
  # in React Router SSR Hydration
  # URL: https://github.com/advisories/GHSA-337j-9hxr-rhxg
  # The extension does not use server-side rendering or React Router hydration.
  - 1124272

  ### Package Deprecations:

  # React-tippy brings in popper.js and react-tippy has not been updated in
  # three years.
  - 'popper.js (deprecation)'

  # Dependencies brought in by @truffle/decoder that are deprecated:
  - 'cids (deprecation)' # via @ensdomains/content-hash
  - 'multibase (deprecation)' # via cids
  - 'multicodec (deprecation)' # via cids

  # Currently in use for the network list drag and drop functionality.
  # Maintenance has stopped and the project will be archived in 2025.
  - 'react-beautiful-dnd (deprecation)'

  # New package name format for new versions: @ethereumjs/wallet.
  - 'ethereumjs-wallet (deprecation)'

plugins:
  - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
    spec: 'https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js'
  - path: .yarn/plugins/@yarnpkg/plugin-engines.cjs
    spec: 'https://raw.githubusercontent.com/devoto13/yarn-plugin-engines/main/bundles/%40yarnpkg/plugin-engines.js'
  - path: .yarn/plugins/@yarnpkg/plugin-preview-builds.cjs

# Allowlist of git dependencies. Empty to block all git deps.
approvedGitRepositories: []

# Configure the NPM minimal age gate to 3 days, meaning packages must be at
# least 3 days old to be installed.
npmMinimalAgeGate: 4320 # 3 days (in minutes)

# Override the minimal age gate, allowing certain packages to be installed
# regardless of their publish age.
npmPreapprovedPackages:
  # BNES PQC Snap is produced by BearNetwork-BRNKC's OIDC trusted-publishing
  # workflow; retain the minimal-age gate for every other package.
  - '@bearnetwork/bnes-pqc-snap'
  - '@bearnetwork/bnes-token-list'
  - '@metamask/*'
  - '@metamask-previews/*'
  - '@lavamoat/*'
  - 'lavamoat-core'
  - 'lavamoat-tofu'
  - 'lavamoat-node'
  - 'lavamoat'
  - 'extension-port-stream'