chore: bump ESLint stack to v15 and migrate to flat config by cryptodev-2s · Pull Request #317 · MetaMask/utils

cryptodev-2s · 2026-09-04T06:17:53Z

Stacked on #314.

Replaces .eslintrc.js with a flat eslint.config.mjs and moves the ESLint stack to core's versions.

Dep	From	To
`eslint`	`^8.44.0`	`^9.39.1`
`@metamask/eslint-config{,-jest,-nodejs,-typescript}`	`^12.0.0`	`^15.0.0`
`@metamask/auto-changelog`	`^3.1.0`	`^6.1.0`
`eslint-plugin-jest`	`^27.2.2`	`^28.8.3`
`eslint-plugin-jsdoc`	`^39.9.1`	`^50.2.4`
`eslint-plugin-n`	`^15.7.0`	`^17.10.3`
`eslint-plugin-promise`	`^6.1.1`	`^7.1.0`

Drops eslint-plugin-import and @typescript-eslint/{parser,eslint-plugin} for eslint-plugin-import-x and typescript-eslint. Adds @types/semver@^7, which had been arriving transitively through @typescript-eslint/eslint-plugin and broke the build once that was removed.

Config v15 surfaced 351 problems v12 never enforced. Stylistic ones are off with TODO comments, matching core. The rest were stale directives naming rules that typescript-eslint v8 renamed or removed, so the code under them was going unchecked:

Directive	Fate	Sites
`@typescript-eslint/no-throw-literal`	renamed to `only-throw-error`	8
`@typescript-eslint/ban-types`	split in v8, no longer needed here	3
`import/no-nodejs-modules`	now `import-x/no-nodejs-modules`	1 block
`jest/no-if`	removed in eslint-plugin-jest v28	1

Two autofixes are reverted because they changed behaviour rather than style:

hasProperty's constraint was rewritten from Object to object. The original carried an explicit suppression, so Object was deliberate: it accepts boxed primitives, and narrowing it breaks callers passing a string or number.
json.test-d.ts lost as any and as number | undefined from its tsd assertions. In type tests the assertion is the test. no-unnecessary-type-assertion is now off for *.test-d.ts.

jsdoc/require-jsdoc stays off rather than suppressed: its autofixer inserted 193 empty JSDoc blocks on the first pass. Core disables it for the same reason.

Note

Medium Risk
Large toolchain bump touches most of the repo; export and toWei parsing changes could affect consumers, though runtime logic changes appear limited and intentional.

Overview
Migrates linting from .eslintrc.js to flat eslint.config.mjs, bumps ESLint 8 → 9 and @metamask/eslint-config v12 → v15, and swaps eslint-plugin-import / split @typescript-eslint/* for eslint-plugin-import-x and typescript-eslint. The lint:eslint script drops --ext js,ts; @types/semver is added explicitly after dropping the old typescript-eslint transitive dep; LavaMoat allows eslint-plugin-import-x>unrs-resolver.

The new config turns off several JSDoc rules (matching core, with TODOs), disables no-unnecessary-type-assertion for *.test-d.ts, and relaxes Node builtin checks in tests for crypto polyfill coverage. reportUnusedDisableDirectives: 'error' forces cleanup of stale eslint-disable comments across fixtures and tests.

Source edits are mostly rule compliance: explicit return types, renamed disables (only-throw-error, import-x/no-nodejs-modules), uuid named import in fs.ts, export type * for type-only barrels, and typing tweaks in FrozenMap/FrozenSet. Two autofix reversals preserve behavior: hasProperty keeps Object (boxed primitives), and type-test assertions stay intact. toWei now treats empty whole/fraction parts (e.g. .5, 5.) as 0, not only undefined.

^{Reviewed by Cursor Bugbot for commit 4fb3fb6. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-09-04T06:18:14Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
eslint@8.45.0 ⏵ 9.39.5
@types/semver@7.3.13 ⏵ 7.8.0
typescript-eslint@8.69.0
@metamask/eslint-config-jest@12.1.0 ⏵ 15.0.1		⁺⁵	⁺⁸
eslint-plugin-promise@6.1.1 ⏵ 7.3.0
debug@4.3.4 ⏵ 4.4.3	⁺¹	⁺¹
eslint-import-resolver-typescript@3.10.1
@metamask/eslint-config@12.2.0 ⏵ 15.0.1		⁺³	⁺⁸
@metamask/eslint-config-nodejs@12.1.0 ⏵ 15.0.1		⁺³	⁺⁸
@metamask/eslint-config-typescript@12.1.0 ⏵ 15.0.1		⁺²	⁺⁸
eslint-plugin-import-x@4.17.1
eslint-plugin-n@15.7.0 ⏵ 17.24.0			^-3
@metamask/auto-changelog@3.4.4 ⏵ 6.2.1		⁺¹	⁺⁶
eslint-plugin-jsdoc@39.9.1 ⏵ 50.8.0		⁺¹	⁺¹
eslint-plugin-jest@27.2.3 ⏵ 28.14.0	⁺¹	⁺¹	⁺³

View full report

socket-security · 2026-09-04T06:18:15Z

Warning

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm `@unrs/resolver-binding-wasm32-wasi` is 90.0% likely to have a medium risk anomaly Notes: This loader establishes a Node.js WASI/worker environment that: 1) passes the entire host process.env into the WASI instance (exposing all environment variables, including secrets, to loaded modules); 2) preopens the filesystem root (granting broad file read/write access under the host’s root directory); and 3) implements importScripts via synchronous fs.readFileSync + eval (allowing any local JS file to be executed in the loader context). If an untrusted or compromised WASM module or script is provided, it can read sensitive environment variables, access or modify arbitrary files, and execute arbitrary JavaScript—posing a moderate security risk. Recommended mitigations: restrict WASI preopens to a minimal directory, limit or sanitize environment variables passed into WASI, and replace or sandbox the eval-based importScripts mechanism. Confidence: 0.90 Severity: 0.60 From: package.json → `npm/eslint-plugin-import-x@4.17.1` → `npm/eslint-import-resolver-typescript@3.10.1` → `npm/@unrs/resolver-binding-wasm32-wasi@1.12.2` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@unrs/resolver-binding-wasm32-wasi@1.12.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@unrs/resolver-binding-wasm32-wasi` Location: Package overview From: package.json → `npm/eslint-plugin-import-x@4.17.1` → `npm/eslint-import-resolver-typescript@3.10.1` → `npm/@unrs/resolver-binding-wasm32-wasi@1.12.2` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@unrs/resolver-binding-wasm32-wasi@1.12.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@unrs/resolver-binding-wasm32-wasi` Env Vars: NAPI_RS_ASYNC_WORK_POOL_SIZE Location: Package overview From: package.json → `npm/eslint-plugin-import-x@4.17.1` → `npm/eslint-import-resolver-typescript@3.10.1` → `npm/@unrs/resolver-binding-wasm32-wasi@1.12.2` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@unrs/resolver-binding-wasm32-wasi@1.12.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@unrs/resolver-binding-wasm32-wasi` reads UV_THREADPOOL_SIZE Env Vars: UV_THREADPOOL_SIZE Location: Package overview From: package.json → `npm/eslint-plugin-import-x@4.17.1` → `npm/eslint-import-resolver-typescript@3.10.1` → `npm/@unrs/resolver-binding-wasm32-wasi@1.12.2` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@unrs/resolver-binding-wasm32-wasi@1.12.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 75.0% likely to have a medium risk anomaly Notes: The code represents a conventional, non-obfuscated part of AJV’s custom keyword support. No direct malicious actions are evident within this module. Security concerns mainly arise from the broader supply chain: the external rule implementation (dotjs/custom), the definition schema, and any user-supplied keyword definitions. The dynamic compilation path (compile(metaSchema, true)) should be exercised with trusted inputs. Recommended follow-up: review the contents of the external modules and monitor the inputs supplied to addKeyword/definitionSchema to ensure no unsafe behavior is introduced during validation or data handling. Confidence: 0.75 Severity: 0.55 From: package.json → `npm/eslint@9.39.5` → `npm/ajv@6.15.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@6.15.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 65.0% likely to have a medium risk anomaly Notes: The code is a straightforward build script to bundle and minify a specified package using Browserify and UglifyJS. The primary security concern is potential path manipulation: json.main is used to form a require path without validating that it stays within the target package directory. If a malicious or misconfigured package.json includes an absolute path or traversal outside the package, the script could bundle unintended files. Otherwise, the script does not perform network access, data exfiltration, or backdoor actions, and there is no hard-coded secrets or dynamic code execution beyond standard bundling/minification. Confidence: 0.65 Severity: 0.58 From: package.json → `npm/eslint@9.39.5` → `npm/ajv@6.15.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@6.15.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 61.0% likely to have a medium risk anomaly Notes: The code augments a meta-schema to permit remote dereferencing of keyword schemas via a hardcoded data.json resource. This introduces network dependency and potential changes to validation semantics at runtime. While not inherently malicious, the remote reference constitutes a notable security and reliability risk that should be mitigated with local fallbacks, input validation, and explicit remote-resource governance. Confidence: 0.61 Severity: 0.60 From: package.json → `npm/eslint@9.39.5` → `npm/ajv@6.15.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@6.15.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `flat-cache` is 61.0% likely to have a medium risk anomaly Notes: The code implements a filesystem-backed cache with potential path traversal vulnerabilities due to unvalidated docId/cacheDir inputs that influence file paths. While not inherently malicious, the lack of input sanitization creates risk of reading/writing/deleting arbitrary files, especially in a public package context where inputs could be user-controlled. No evidence of deliberate malware or obfuscated logic is present, but the security risk due to path handling is non-trivial and should be mitigated by validating and constraining input paths, using safe defaults, and isolating cache storage. Confidence: 0.61 Severity: 0.62 From: package.json → `npm/eslint@9.39.5` → `npm/flat-cache@4.0.1` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/flat-cache@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `graceful-fs` is 68.0% likely to have a medium risk anomaly Notes: The fragment is a legitimate Graceful FS implementation designed to gracefully handle EMFILE/ENFILE errors by queuing and retrying I/O operations. It coordinates across multiple instances via a shared queue and patches core fs APIs accordingly. Primary risks are complexity and potential unintended interactions in large apps due to global patches, not malicious activity or data exfiltration. Confidence: 0.68 Severity: 0.50 From: package.json → `npm/eslint-plugin-n@17.24.0` → `npm/@types/jest@28.1.8` → `npm/@lavamoat/allow-scripts@3.0.4` → `npm/jest@29.2.2` → `npm/ts-jest@29.0.3` → `npm/@types/jest-when@3.5.3` → `npm/graceful-fs@4.2.11` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/graceful-fs@4.2.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `tapable` is 62.0% likely to have a medium risk anomaly Notes: No overt malicious behavior (no IO, network, filesystem, credential access, or persistence) is present in this fragment. The main security concern is that it uses runtime code generation (`new Function`) and emits executable JavaScript assembled from `options`-driven metadata (args/taps/interceptors). If these configuration fields or any emitted expressions are attacker-influenced, it can enable arbitrary code execution in the host. Even with safe codegen, executing provided taps/interceptors means malicious plugins can run arbitrary code with the caller’s privileges. Confidence: 0.62 Severity: 0.56 From: package.json → `npm/eslint-plugin-n@17.24.0` → `npm/tapable@2.3.3` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tapable@2.3.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `tinyglobby` reads TINYGLOBBY_DEBUG Env Vars: TINYGLOBBY_DEBUG Location: Package overview From: package.json → `npm/eslint-plugin-import-x@4.17.1` → `npm/typescript-eslint@8.69.0` → `npm/eslint-import-resolver-typescript@3.10.1` → `npm/eslint-plugin-jest@28.14.0` → `npm/tinyglobby@0.2.17` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tinyglobby@0.2.17`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

eslint-import-resolver-typescript@3.10.1
eslint-plugin-import-x@4.17.1
unrs-resolver@1.12.2
napi-postinstall@0.3.4
@octokit/request@8.4.1
@emnapi/core@1.10.0
@emnapi/runtime@1.10.0
@emnapi/wasi-threads@1.2.1
@tybys/wasm-util@0.10.3
@metamask/auto-changelog@6.2.1
eslint-plugin-n@17.24.0

View full report

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6551ea9. Configure here.}

Replaces .eslintrc.js with eslint.config.mjs and moves the whole ESLint stack to the versions core uses. eslint ^8.44.0 -> ^9.39.1 @metamask/eslint-config* ^12.0.0 -> ^15.0.0 @metamask/auto-changelog ^3.1.0 -> ^6.1.0 eslint-plugin-jest ^27.2.2 -> ^28.8.3 eslint-plugin-jsdoc ^39.9.1 -> ^50.2.4 eslint-plugin-n ^15.7.0 -> ^17.10.3 eslint-plugin-promise ^6.1.1 -> ^7.1.0 eslint-plugin-import removed, replaced by import-x @typescript-eslint/{parser,plugin} removed, replaced by typescript-eslint Added: typescript-eslint ^8.48.0, eslint-plugin-import-x ^4.3.0, eslint-import-resolver-typescript ^3.6.3, @types/eslint ^9.6.1. The flat config carries over the prettier/prettier and import-x/order disables set in .eslintrc.js by the previous commit, since Oxfmt owns formatting. Also adds @types/semver ^7. It was previously reaching us transitively via @typescript-eslint/eslint-plugin, so dropping that package broke the build until it was declared directly. Config v15 surfaced problems v12 never enforced. Most are stylistic and are turned off with TODO comments, matching core. The rest were stale eslint-disable directives pointing at rules typescript-eslint v8 renamed or removed: @typescript-eslint/no-throw-literal -> only-throw-error (8 sites) @typescript-eslint/ban-types -> now unnecessary (3 sites) jest/no-if -> removed in v28 (1 site) Two autofixes were reverted because they changed behaviour rather than style: hasProperty's constraint was rewritten from `Object` to `object`. The original carried an explicit suppression, so it was deliberate: `Object` accepts boxed primitives, and narrowing it would break callers passing a string or number. In json.test-d.ts the fixer stripped `as any` and `as number | undefined` from tsd assertions. Those assertions are the test. no-unnecessary-type- assertion is now off for *.test-d.ts so it cannot happen again. jsdoc/require-jsdoc stays off for the same reason core keeps it off: its autofixer inserts empty JSDoc blocks and mangles the surrounding code. Verified: eslint, build, 23 suites / 1993 tests at 100% coverage, tsd, and the full yarn lint all pass.

It was copied from smart-transactions-controller#595 without checking whether this package needs it. It does not: nothing here imports eslint types, eslint.config.mjs carries no annotations, and it is only an optional peer of eslint-plugin-prettier. Core does not have it at its root either. Removing it changes nothing: eslint, build, tests and lint all still pass.

Removing the stale eslint-disable comments left their newlines in place, so 16 stray blank lines ended up between JSDoc blocks and the declarations they document, and inside parameter lists. The cause is the autofixer for reportUnusedDisableDirectives: it deletes the directive text but not the line it sat on. I ran eslint --fix and did not review the whitespace only part of the diff. Nothing in the toolchain flags this. lines-around-comment, @typescript-eslint/lines-around-comment and no-multiple-empty-lines are all off in the shared config, and Oxfmt only collapses two or more consecutive blank lines, treating a single one as deliberate. Cosmetic rather than functional: TypeScript still associates a JSDoc block with the declaration across a blank line, verified by emitting declarations for both shapes and confirming the comment survives in the .d.ts.

cryptodev-2s · 2026-09-09T16:25:53Z

 export * from './coercers';
 export * from './collections';
-export * from './encryption-types';
+export type * from './encryption-types';


@typescript-eslint/consistent-type-exports

…ion emit no-unnecessary-type-assertion flagged `JsonRpcErrorStruct as Struct<JsonRpcError>` and its autofixer removed it. The rule is right that the assertion does not change assignability, and wrong that it is unnecessary: it pins what TypeScript emits. Without it the declaration inlines the structure instead of referring to the named type, so JsonRpcFailure and JsonRpcResponse changed from error: JsonRpcError; to an anonymous object literal, which also pushed the unexported internal ExactOptionalGuard further into the published types (9 occurrences in json.d.cts before, 11 after). Restored with a suppression explaining why. json.d.cts is now byte identical to the one built from main. Found by diffing the emitted declarations against main rather than by any test: assignability is unchanged, so nothing fails. Only the shape of the published types differs.

mcmire

Thanks for doing this. This mostly looks good but I called out some things below. I need to do another pass on this but I do have a suggestion to consider below for now.

mcmire · 2026-09-09T16:54:27Z

 /**
 * Predefined sizes (in Bytes) of specific parts of JSON structure.
 */
+/* eslint-disable @typescript-eslint/no-duplicate-enum-values --


This is fine for now. When we ban enums finally this should go away, so nothing to worry about.

mcmire · 2026-09-09T16:55:58Z

+    rules: {
+      // TODO: Re-enable these rules.
+      // Newly surfaced by eslint-config v15; not enforced under v12.
+      '@typescript-eslint/explicit-function-return-type': 'off',


Hmm, I thought I fixed this already. I guess not. This is okay for now.

I don't follow why we're disabling this. It will be required for the migration to core, no?

@cryptodev-2s

fixed here 4fb3fb6

mcmire · 2026-09-09T16:58:54Z

+  {
+    files: ['**/*.test.{js,ts}'],
+    rules: {
+      // These tests deliberately reach for `crypto` and `crypto.webcrypto`,


Probably okay, but I need to double-check this is the right thing to do here.

The real reason is described here 8555d3c

cryptodev-2s · 2026-09-10T11:27:58Z

@SocketSecurity ignore npm/@emnapi/core@1.10.0
@SocketSecurity ignore npm/@emnapi/runtime@1.10.0
@SocketSecurity ignore npm/@emnapi/wasi-threads@1.2.1
@SocketSecurity ignore npm/@metamask/auto-changelog@6.2.1
@SocketSecurity ignore npm/@octokit/request@8.4.1
@SocketSecurity ignore npm/@tybys/wasm-util@0.10.3
@SocketSecurity ignore npm/eslint-import-resolver-typescript@3.10.1
@SocketSecurity ignore npm/eslint-plugin-import-x@4.17.1
@SocketSecurity ignore npm/eslint-plugin-n@17.24.0
@SocketSecurity ignore npm/napi-postinstall@0.3.4
@SocketSecurity ignore npm/unrs-resolver@1.12.2

cursor Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread src/json.ts Outdated

cryptodev-2s force-pushed the migrate/pr2c-eslint branch from 6551ea9 to 311128a Compare September 4, 2026 06:52

cryptodev-2s mentioned this pull request Sep 4, 2026

chore: replace Prettier formatting with Oxfmt #314

Merged

cryptodev-2s force-pushed the migrate/pr2c-eslint branch from 311128a to 4adc549 Compare September 4, 2026 08:07

cryptodev-2s mentioned this pull request Sep 4, 2026

chore: align remaining dev deps and tooling config with core #318

Open

Base automatically changed from migrate/pr2b-prettier to main September 4, 2026 11:00

cryptodev-2s force-pushed the migrate/pr2c-eslint branch 2 times, most recently from 16d390f to 9eb1d3a Compare September 4, 2026 11:03

cryptodev-2s mentioned this pull request Sep 7, 2026

chore(deps-dev): bump @metamask/auto-changelog from 3.4.4 to 6.2.1 #316

Closed

cryptodev-2s added 2 commits September 7, 2026 14:31

cryptodev-2s force-pushed the migrate/pr2c-eslint branch 2 times, most recently from 0418ea3 to cb576bc Compare September 7, 2026 12:31

cryptodev-2s removed this pull request from stack #329 September 9, 2026 11:46

cryptodev-2s added this pull request to stack #331 September 9, 2026 11:47

cryptodev-2s commented Sep 9, 2026

View reviewed changes

mcmire reviewed Sep 9, 2026

View reviewed changes

cryptodev-2s added 2 commits September 9, 2026 20:29

test: use as const instead of as Hex in the hex tables

f0063b3

fix: drop the global uuid import-x ignore

e99f95d

cryptodev-2s requested a review from mcmire September 9, 2026 20:39

chore: enforce explicit return types and nullish coalescing

4fb3fb6

cryptodev-2s force-pushed the migrate/pr2c-eslint branch from 0619330 to 4fb3fb6 Compare September 10, 2026 10:15

cryptodev-2s removed this pull request from stack #331 September 10, 2026 10:40

cryptodev-2s added this pull request to stack #335 September 10, 2026 10:41

cryptodev-2s requested a review from Mrtenz September 10, 2026 10:43

Mrtenz approved these changes Sep 10, 2026

View reviewed changes

Uh oh!

Uh oh!

Conversation

cryptodev-2s commented Sep 4, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cryptodev-2s Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mcmire Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

mcmire Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

Mrtenz Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mcmire Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s commented Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cryptodev-2s commented Sep 4, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Sep 4, 2026 •

edited

Loading

socket-security Bot commented Sep 4, 2026 •

edited

Loading