chore (cherry-pick): fix: nanoid audit issue (#29268) (#29398)

Cherry pick 0e10bab (#29268) to v12.9.3 Co-authored-by: Alejandro Garcia Anglada <[email protected]> Co-authored-by: MetaMask Bot <[email protected]>
MetaMask · Dec 20, 2024 · 611f3bb · 611f3bb
1 parent 1712e28
commit 611f3bb
Show file tree

Hide file tree

Showing 9 changed files with 34 additions and 42 deletions.
diff --git a/app/scripts/controllers/permissions/background-api.js b/app/scripts/controllers/permissions/background-api.js
@@ -1,4 +1,4 @@
-import nanoid from 'nanoid';
+import { nanoid } from 'nanoid';
 import {
   CaveatTypes,
   RestrictedMethods,

diff --git a/app/scripts/metamask-controller.js b/app/scripts/metamask-controller.js
@@ -47,7 +47,7 @@ import { rawChainData } from 'eth-chainlist';
 import { MetaMaskKeyring as QRHardwareKeyring } from '@keystonehq/metamask-airgapped-keyring';
 import EthQuery from '@metamask/eth-query';
 import EthJSQuery from '@metamask/ethjs-query';
-import nanoid from 'nanoid';
+import { nanoid } from 'nanoid';
 import { captureException } from '@sentry/browser';
 import { AddressBookController } from '@metamask/address-book-controller';
 import {

diff --git a/lavamoat/browserify/beta/policy.json b/lavamoat/browserify/beta/policy.json
@@ -629,9 +629,9 @@
         "console.info": true
       },
       "packages": {
-        "@metamask/approval-controller>nanoid": true,
         "@metamask/base-controller": true,
-        "@metamask/rpc-errors": true
+        "@metamask/rpc-errors": true,
+        "nanoid": true
       }
     },
     "@metamask/approval-controller>nanoid": {
@@ -2044,11 +2044,11 @@
         "@metamask/base-controller": true,
         "@metamask/controller-utils": true,
         "@metamask/json-rpc-engine": true,
-        "@metamask/permission-controller>nanoid": true,
         "@metamask/rpc-errors": true,
         "@metamask/utils": true,
         "deep-freeze-strict": true,
-        "immer": true
+        "immer": true,
+        "nanoid": true
       }
     },
     "@metamask/permission-controller>nanoid": {
@@ -2506,7 +2506,6 @@
         "@metamask/snaps-controllers>@xstate/fsm": true,
         "@metamask/snaps-controllers>concat-stream": true,
         "@metamask/snaps-controllers>get-npm-tarball-url": true,
-        "@metamask/snaps-controllers>nanoid": true,
         "@metamask/snaps-controllers>readable-web-to-node-stream": true,
         "@metamask/snaps-controllers>tar-stream": true,
         "@metamask/snaps-rpc-methods": true,
@@ -2517,6 +2516,7 @@
         "browserify>browserify-zlib": true,
         "eslint>fast-deep-equal": true,
         "immer": true,
+        "nanoid": true,
         "readable-stream": true,
         "semver": true
       }
@@ -4601,9 +4601,7 @@
     },
     "nanoid": {
       "globals": {
-        "crypto": true,
-        "msCrypto": true,
-        "navigator": true
+        "crypto.getRandomValues": true
       }
     },
     "nock>debug": {

diff --git a/lavamoat/browserify/flask/policy.json b/lavamoat/browserify/flask/policy.json
@@ -629,9 +629,9 @@
         "console.info": true
       },
       "packages": {
-        "@metamask/approval-controller>nanoid": true,
         "@metamask/base-controller": true,
-        "@metamask/rpc-errors": true
+        "@metamask/rpc-errors": true,
+        "nanoid": true
       }
     },
     "@metamask/approval-controller>nanoid": {
@@ -2044,11 +2044,11 @@
         "@metamask/base-controller": true,
         "@metamask/controller-utils": true,
         "@metamask/json-rpc-engine": true,
-        "@metamask/permission-controller>nanoid": true,
         "@metamask/rpc-errors": true,
         "@metamask/utils": true,
         "deep-freeze-strict": true,
-        "immer": true
+        "immer": true,
+        "nanoid": true
       }
     },
     "@metamask/permission-controller>nanoid": {
@@ -2506,7 +2506,6 @@
         "@metamask/snaps-controllers>@xstate/fsm": true,
         "@metamask/snaps-controllers>concat-stream": true,
         "@metamask/snaps-controllers>get-npm-tarball-url": true,
-        "@metamask/snaps-controllers>nanoid": true,
         "@metamask/snaps-controllers>readable-web-to-node-stream": true,
         "@metamask/snaps-controllers>tar-stream": true,
         "@metamask/snaps-rpc-methods": true,
@@ -2517,6 +2516,7 @@
         "browserify>browserify-zlib": true,
         "eslint>fast-deep-equal": true,
         "immer": true,
+        "nanoid": true,
         "readable-stream": true,
         "semver": true
       }
@@ -4601,9 +4601,7 @@
     },
     "nanoid": {
       "globals": {
-        "crypto": true,
-        "msCrypto": true,
-        "navigator": true
+        "crypto.getRandomValues": true
       }
     },
     "nock>debug": {

diff --git a/lavamoat/browserify/main/policy.json b/lavamoat/browserify/main/policy.json
@@ -629,9 +629,9 @@
         "console.info": true
       },
       "packages": {
-        "@metamask/approval-controller>nanoid": true,
         "@metamask/base-controller": true,
-        "@metamask/rpc-errors": true
+        "@metamask/rpc-errors": true,
+        "nanoid": true
       }
     },
     "@metamask/approval-controller>nanoid": {
@@ -2044,11 +2044,11 @@
         "@metamask/base-controller": true,
         "@metamask/controller-utils": true,
         "@metamask/json-rpc-engine": true,
-        "@metamask/permission-controller>nanoid": true,
         "@metamask/rpc-errors": true,
         "@metamask/utils": true,
         "deep-freeze-strict": true,
-        "immer": true
+        "immer": true,
+        "nanoid": true
       }
     },
     "@metamask/permission-controller>nanoid": {
@@ -2506,7 +2506,6 @@
         "@metamask/snaps-controllers>@xstate/fsm": true,
         "@metamask/snaps-controllers>concat-stream": true,
         "@metamask/snaps-controllers>get-npm-tarball-url": true,
-        "@metamask/snaps-controllers>nanoid": true,
         "@metamask/snaps-controllers>readable-web-to-node-stream": true,
         "@metamask/snaps-controllers>tar-stream": true,
         "@metamask/snaps-rpc-methods": true,
@@ -2517,6 +2516,7 @@
         "browserify>browserify-zlib": true,
         "eslint>fast-deep-equal": true,
         "immer": true,
+        "nanoid": true,
         "readable-stream": true,
         "semver": true
       }
@@ -4601,9 +4601,7 @@
     },
     "nanoid": {
       "globals": {
-        "crypto": true,
-        "msCrypto": true,
-        "navigator": true
+        "crypto.getRandomValues": true
       }
     },
     "nock>debug": {

diff --git a/lavamoat/browserify/mmi/policy.json b/lavamoat/browserify/mmi/policy.json
@@ -721,9 +721,9 @@
         "console.info": true
       },
       "packages": {
-        "@metamask/approval-controller>nanoid": true,
         "@metamask/base-controller": true,
-        "@metamask/rpc-errors": true
+        "@metamask/rpc-errors": true,
+        "nanoid": true
       }
     },
     "@metamask/approval-controller>nanoid": {
@@ -2136,11 +2136,11 @@
         "@metamask/base-controller": true,
         "@metamask/controller-utils": true,
         "@metamask/json-rpc-engine": true,
-        "@metamask/permission-controller>nanoid": true,
         "@metamask/rpc-errors": true,
         "@metamask/utils": true,
         "deep-freeze-strict": true,
-        "immer": true
+        "immer": true,
+        "nanoid": true
       }
     },
     "@metamask/permission-controller>nanoid": {
@@ -2598,7 +2598,6 @@
         "@metamask/snaps-controllers>@xstate/fsm": true,
         "@metamask/snaps-controllers>concat-stream": true,
         "@metamask/snaps-controllers>get-npm-tarball-url": true,
-        "@metamask/snaps-controllers>nanoid": true,
         "@metamask/snaps-controllers>readable-web-to-node-stream": true,
         "@metamask/snaps-controllers>tar-stream": true,
         "@metamask/snaps-rpc-methods": true,
@@ -2609,6 +2608,7 @@
         "browserify>browserify-zlib": true,
         "eslint>fast-deep-equal": true,
         "immer": true,
+        "nanoid": true,
         "readable-stream": true,
         "semver": true
       }
@@ -4693,9 +4693,7 @@
     },
     "nanoid": {
       "globals": {
-        "crypto": true,
-        "msCrypto": true,
-        "navigator": true
+        "crypto.getRandomValues": true
       }
     },
     "nock>debug": {

diff --git a/lavamoat/build-system/policy.json b/lavamoat/build-system/policy.json
@@ -6560,7 +6560,7 @@
         "process.env.NODE_ENV": true
       },
       "packages": {
-        "postcss>nanoid": true,
+        "nanoid": true,
         "postcss>picocolors": true,
         "postcss>source-map-js": true
       }

diff --git a/package.json b/package.json
@@ -397,7 +397,7 @@
     "loglevel": "^1.8.1",
     "lottie-web": "^5.12.2",
     "luxon": "^3.2.1",
-    "nanoid": "^2.1.6",
+    "nanoid": "^3.3.8",
     "pify": "^5.0.0",
     "promise-to-callback": "^1.0.0",
     "prop-types": "^15.6.1",

diff --git a/yarn.lock b/yarn.lock
@@ -26910,7 +26910,7 @@ __metadata:
     mocha: "npm:^10.2.0"
     mocha-junit-reporter: "npm:^2.2.1"
     mockttp: "npm:^3.10.1"
-    nanoid: "npm:^2.1.6"
+    nanoid: "npm:^3.3.8"
     nock: "patch:nock@npm%3A13.5.4#~/.yarn/patches/nock-npm-13.5.4-2c4f77b249.patch"
     node-fetch: "npm:^2.6.1"
     nyc: "npm:^15.1.0"
@@ -28062,19 +28062,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nanoid@npm:^2.0.0, nanoid@npm:^2.1.6":
+"nanoid@npm:^2.0.0":
   version: 2.1.11
   resolution: "nanoid@npm:2.1.11"
   checksum: 10/cf2a2eedcf9d8893a4687f11743ccf8381f047bc2b3d3887a23721bbef8fe64c5759b9cba6eb945e40efeb4a7e7379b3417e4dc5f6cc03050322d2c24a7ff69b
   languageName: node
   linkType: hard
 
-"nanoid@npm:^3.1.31, nanoid@npm:^3.3.7":
-  version: 3.3.7
-  resolution: "nanoid@npm:3.3.7"
+"nanoid@npm:^3.1.31, nanoid@npm:^3.3.7, nanoid@npm:^3.3.8":
+  version: 3.3.8
+  resolution: "nanoid@npm:3.3.8"
   bin:
     nanoid: bin/nanoid.cjs
-  checksum: 10/ac1eb60f615b272bccb0e2b9cd933720dad30bf9708424f691b8113826bb91aca7e9d14ef5d9415a6ba15c266b37817256f58d8ce980c82b0ba3185352565679
+  checksum: 10/2d1766606cf0d6f47b6f0fdab91761bb81609b2e3d367027aff45e6ee7006f660fb7e7781f4a34799fe6734f1268eeed2e37a5fdee809ade0c2d4eb11b0f9c40
   languageName: node
   linkType: hard