Skip to content

ci: build, test, lint only changed packages and dependants - #48

Draft
mikesposito wants to merge 2 commits into
mainfrom
me/cherry-pick-9373
Draft

ci: build, test, lint only changed packages and dependants#48
mikesposito wants to merge 2 commits into
mainfrom
me/cherry-pick-9373

Conversation

@mikesposito

Copy link
Copy Markdown
Member

Explanation

Cherry-picking these two commits from core to optimize CI:

References

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Mrtenz added 2 commits July 24, 2026 19:05
Currently, every CI run rebuilds all packages from scratch and runs
tests, changelog validation, and ESLint across the entire monorepo,
regardless of how many packages actually changed.

This PR scopes TypeScript builds, tests, changelog validation, and
ESLint to only the packages that changed plus their transitive
dependants, by:

- Using the GitHub Compare API to find the exact merge base between the
PR head and the target branch.
- Running `git diff --name-only` against that merge base to find changed
files.
- Expanding the changed set to transitive dependants (so
type-correctness across package boundaries is preserved), and also to
transitive dependencies when building (so `ts-bridge` has all referenced
`dist/` outputs available).
- Falling back to a full run when any file outside a package directory
changes (e.g., root config files or workflow files), or when there is no
merge base (push to `main`).

A new `scripts/get-changed-workspaces.mts` script computes the changed
package set and is called from the `prepare` job (24.x matrix run only).
Downstream jobs read the outputs from `prepare` directly — the separate
`get-changed-packages` job has been removed, saving one sequential job
hop.

The `changed-paths` output gates both ESLint scope and TypeScript build
scope: when it is `"full"`, both run against all packages; when it is a
JSON array of paths, each runs only against that subset.

Four benchmark PRs target this branch to verify the expected behaviour:

| PR | Change | Expected |
|---|---|---|
| [#9486](MetaMask/core#9486) | CI-only change
(workflow file comment) | Full run — workflow files are not in
`IGNORED_ROOT_FILES` |
| [#9487](MetaMask/core#9487) | Single package
(`@metamask/logging-controller`) | 3 packages (`logging-controller` + 2
transitive dependants) |
| [#9488](MetaMask/core#9488) | Three packages
(`accounts-`, `gas-fee-`, `network-controller`) | 38 packages (those 3 +
transitive dependants) |
| [#9489](MetaMask/core#9489) | `README.md`
(ignored) + `logging-controller` | 3 packages — `README.md` does not
trigger a full run |

- [ ] I've updated the test suite for new or updated code as appropriate
- [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [ ] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes how every PR is validated; incorrect workspace expansion or
root-change detection could skip builds or tests, though impact is
limited to CI, not shipped product code.
>
> **Overview**
> **CI runs only what the PR touches** instead of rebuilding and testing
the whole monorepo on every run.
>
> The `prepare` job (Node 24.x) resolves the merge base via the GitHub
Compare API, runs `get-changed-workspaces.mts`, and exports
`package-names`, `changed-paths`, and `merge-base`. Downstream jobs use
those outputs: changelog validation and per-Node test matrices iterate
only affected workspace names; `wallet-cli` e2e runs only when that
package is in the set.
>
> **ESLint** moves to a dedicated `lint-eslint` job that runs `yarn
lint:eslint` on all packages when `changed-paths` is `full`, otherwise
only on the listed workspace paths.
>
> **Build** uses `generate-partial-build-tsconfig.mts` plus `ts-bridge`
for a partial TypeScript reference graph (changed packages plus
transitive dependants and dependencies) when a merge base exists and
there is no root-level change; otherwise it keeps `yarn build`. Root or
workflow changes outside ignored files (e.g. not `README.md`) still
force a full run; pushes without a merge base fall back to all packages.
>
> New shared logic lives in `scripts/lib/workspaces.mts` (git diff,
dependency graph, root-change detection); `tsconfig.scripts.json` now
includes `*.mts` for those scripts.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
b910c315f2667f29cca128d10fd37f2615d8b6c5. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
…ces in incremental CI (#9643)

Previously, any PR that touched `yarn.lock` would fall through to a full
rebuild and test run of all packages, because the script had no way to
know which packages were actually affected by the lockfile change.
Similarly, any change to the root `package.json` (including version-only
bumps from release PRs) triggered a full run.

This PR adds smart diffing for both files:

**`yarn.lock` diffing:** When `yarn.lock` appears in the changed files,
it is parsed using `@yarnpkg/parsers` and compared against the
merge-base version. Entry checksums are compared (rather than
resolutions) so that any change to installed package content is
detected, including the rare case of a package being re-released under
the same version. The changed package names are then cross-referenced
against each workspace's full transitive dependency closure (built by
walking the resolved lockfile graph via `@yarnpkg/core`) to produce the
minimal set of workspaces that need to be rebuilt and tested.

**Root `package.json` diffing:** When `package.json` changes, both sides
are parsed and compared with the `version` field stripped. A
version-only diff (e.g. a release PR bump) is ignored; any other change
(scripts, dependencies, etc.) still triggers a full run.

**Refactored `computeChangedWorkspaces`:** The function now fetches
workspaces and changed files internally, and returns `{ workspaces:
Workspace[], hasRootChange: boolean }` instead of `Set<string>`. This
removes boilerplate from both callers and allows
`get-changed-workspaces` to short-circuit before doing any workspace
computation when `hasRootChange` is true.

- Part of the incremental CI build work from #9373

- [ ] I've updated the test suite for new or updated code as appropriate
- [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [ ] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes how CI decides what to build/test; incorrect lockfile or
package.json diff logic could skip needed workspaces or over-build. New
Yarn Berry APIs in scripts add maintenance surface but no runtime
product impact.
>
> **Overview**
> **Incremental CI** no longer treats every `yarn.lock` touch as a full
monorepo run. When the lockfile changes, the script diffs merge-base vs
head checksums, maps changed packages to workspaces whose **transitive**
closure includes them (via `@yarnpkg/core`), then applies the usual
dependant/dependency expansion.
>
> **Root `package.json`** is ignored for “root change” unless something
besides `version` changed (release-only bumps stay incremental).
`yarn.lock` is also excluded from the generic root-change path so
lockfile logic handles it.
>
> **`computeChangedWorkspaces`** now takes `{ mergeBase, headRef,
includeDependencies }`, loads workspaces and git diffs internally, and
returns `{ workspaces, hasRootChange }` with dependency graph edges as
`Workspace` objects. Callers `get-changed-workspaces.mts` and
`generate-partial-build-tsconfig.mts` were simplified to match.
>
> Adds `@yarnpkg/cli`, `@yarnpkg/core`, `@yarnpkg/fslib`, and
`@yarnpkg/parsers` dev deps (large `yarn.lock` churn). **`foundryup`**
gets a `@ts-expect-error` on `tar` extract `transform` for `tar@7.5.12`
typing.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
4bf933e12ddfbec50acecf0b6c175b9bd6bfce68. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@mikesposito
mikesposito requested review from a team as code owners July 24, 2026 17:10
CHANGED_PATHS="full"
fi
echo "package-names=$PACKAGES" >> "$GITHUB_OUTPUT"
echo "changed-paths=$CHANGED_PATHS" >> "$GITHUB_OUTPUT"
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​yarnpkg/​cli@​4.17.1971006795100
Added@​yarnpkg/​parsers@​3.0.31001007382100
Added@​yarnpkg/​core@​4.9.0951007490100
Updated@​types/​semver@​7.5.8 ⏵ 7.7.11001007481100
Added@​yarnpkg/​fslib@​3.1.51001007984100
Updated@​metamask/​superstruct@​3.2.1 ⏵ 3.3.0100 +110010089 -4100
Updatedsemver@​7.8.2 ⏵ 7.8.5100 +1100100 +191100

View full report

@socket-security

Copy link
Copy Markdown

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
Network access: npm @algolia/requester-node-http in module http

Module: http

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@algolia/requester-node-http@4.27.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-node-http@4.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-node-http in module https

Module: https

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@algolia/requester-node-http@4.27.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-node-http@4.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @sigstore/sign in module http2

Module: http2

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@sigstore/sign@3.1.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sigstore/sign@3.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm @yarnpkg/cli in module child_process

Module: child_process

Location: Package overview

From: package.jsonnpm/@yarnpkg/cli@4.17.1

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/cli@4.17.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/core in module https

Module: https

Location: Package overview

From: package.jsonnpm/@yarnpkg/core@4.9.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/core in module http

Module: http

Location: Package overview

From: package.jsonnpm/@yarnpkg/core@4.9.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/core in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/@yarnpkg/core@4.9.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-essentials in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-essentials@4.6.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-essentials@4.6.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-exec in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-exec@3.1.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-exec@3.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-file in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-file@3.0.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-file@3.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-git in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-git@3.2.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-git@3.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-github in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-github@3.0.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-github@3.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-http in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-http@3.0.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-http@3.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-jsr in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-jsr@1.1.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-jsr@1.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-link in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-link@3.0.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-link@3.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-npm in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-npm@3.7.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-npm@3.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @yarnpkg/plugin-patch in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@yarnpkg/cli@4.17.1npm/@yarnpkg/plugin-patch@4.0.5

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/plugin-patch@4.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm cacheable-lookup in module dns

Module: dns

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/cacheable-lookup@5.0.4

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cacheable-lookup@5.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm got in module http

Module: http

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/got@11.8.6

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/got@11.8.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm got in module https

Module: https

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/got@11.8.6

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/got@11.8.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm got in module net

Module: net

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/got@11.8.6

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/got@11.8.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm hpagent in module https

Module: https

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/hpagent@1.2.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/hpagent@1.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm hpagent in module http

Module: http

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/hpagent@1.2.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/hpagent@1.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http2-wrapper in module tls

Module: tls

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/http2-wrapper@1.0.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http2-wrapper@1.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http2-wrapper in module http2

Module: http2

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/http2-wrapper@1.0.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http2-wrapper@1.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http2-wrapper in module http

Module: http

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/http2-wrapper@1.0.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http2-wrapper@1.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http2-wrapper in module https

Module: https

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/http2-wrapper@1.0.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http2-wrapper@1.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http2-wrapper in module net

Module: net

Location: Package overview

From: ?npm/@yarnpkg/core@4.9.0npm/http2-wrapper@1.0.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http2-wrapper@1.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 38 more rows in the dashboard

View full report

@mikesposito
mikesposito marked this pull request as draft July 24, 2026 17:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants