5.1.0

[github-actions]

This is the release candidate for version 5.1.0.

Also fixes an incorrect entry for v5.0.0:

eth-simple-keyring/package.json

Line 56 in 1765fa0

"node": ">=14.0.0"

---

Blocked by:

• deps: @metamask/utils@^5.0.0->^5.0.2 #155
  • Add validateMessage option to signMessage #148
• deps: @metamask/eth-sig-util@^5.0.2->^6.0.1 #149

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
@types/ethereumjs-tx	1.0.1	None	+1	17.8 kB	types
@types/randombytes	2.0.0	None	+0	2.8 kB	types
ethereumjs-tx	1.3.7	filesystem	+36	6.38 MB	holgerd77
@metamask/eslint-config-typescript	11.1.0	None	+0	16.9 kB	metamaskbot
@metamask/utils	5.0.2	None	+3	438 kB	metamaskbot

🚮 Removed packages: @metamask/[email protected]

[socket-security]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], @types/[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], @types/[email protected], @types/[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], @types/[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], @types/[email protected], [email protected], @types/[email protected]

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] bar@* or ignore all packages with @SocketSecurity ignore-all

[legobeat]

@SocketSecurity ignore-all

[Mrtenz]

Looks like typedoc is missing? 🤔

[legobeat]

Looks like typedoc is missing? 🤔

Aah, you are right, that explains the failing "publish rc docs" jobs I guess.

Looks like this was never actually working: 4abfbe9#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519

Worth holding this one to wait for that to be sorted out?

EDIT: Moving forward with publish: Docs seem to never really have been advertised, available, or missed for this package. Addressing should be done but can be sorted out separately from this release.