Repository navigation
Conversation
- CODEOWNERS: give examples/ to the product team - PR template: add Motivation and Context section - Dependabot: npm and github-actions, weekly, 3-day cooldown Co-authored-by: Cursor <cursoragent@cursor.com>
- Node >=24.22.0, npm >=12, .nvmrc 26, @types/node ^26 - Replace torus-scripts 8, ESLint and Prettier with vp pack/lint/fmt, @toruslabs/oxlint-config-typescript and formatPreset() - @toruslabs/config 5 (library profile, DOM libs added) - Add .npmrc policy (min-release-age, allow-scripts-pin) and @lavamoat/harden - Changesets config (baseBranch master, public access) - Fix strictNullChecks errors surfaced by config 5 - Remove legacy torus.config.js, eslint/prettier/vitest configs - Pin vite and vitest overrides to vite-plus 1.5.0 Co-authored-by: Cursor <cursoragent@cursor.com>
…590) - validate: Node 24.22.0 and 26, npm 12, npm ci, harden check, check, build, typecheck, tests, changeset status (PRs), pack dry-run - release-pr: manual Changesets release PR on master, does not publish - security-code-scanner: MetaMask reusable scanner pinned to v2.1.1 - vue-app demo deploy moved to validate on master, using STS role from vars.AWS_ROLE_ARN plus Wiz sensor; static AWS keys removed Co-authored-by: Cursor <cursoragent@cursor.com>
- bowser ^2.14.1 -> ^2.15.0 - @sentry/core ^10.45.0 -> ^10.78.0 (dev and optional peer) - typescript ^7 -> ^7.0.2 - npm audit fix for in-range advisories; remaining advisories are transitive or need a major (deepmerge, minimatch via eslint-plugin-tsdoc) Co-authored-by: Cursor <cursoragent@cursor.com>
- @babel/runtime peer removed: no build step or source import needs it - Changeset for @toruslabs/customauth (major): Node/npm engines, Vite+ build, types path move, babel peer removal Co-authored-by: Cursor <cursoragent@cursor.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- Replaced the S3 sync action with a direct AWS CLI command for improved reliability and simplicity. - Removed unnecessary permissions for id-token in the workflow configuration. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
Modernize CustomAuth to the 2026 Q4 stack policy: Node 24/26, npm 12, LavaMoat harden, TypeScript + Oxlint/Oxfmt via
@toruslabs/torus-scripts@9, Changesets release PR, and MetaMask security scanner. Shared acceptance criteria live in EMBED-573.Jira Link
Description
Step 4 is blocking this PR
Runtime prerequisite majors are not adopted. This draft stays blocked until both release-adoption gates publish a new release:
17.2.3(2026-08-17)13.3.0(2026-08-17)Those two still depend on eccrypto 7, constants 16, http-helpers 9, and metadata-helpers 8. Bumping CustomAuth's own copies now (
eccrypto8,constants17,http-helpers10,metadata-helpers9,fetch-node-details17,session-manager6) would install two majors of each side by side. Tooling and CI landed without them. Resume step 4 withnpm viewand--min-release-age=0once both gates publish.What landed
examples/), PR template Motivation section, Dependabot (npm and github-actions, weekly, 3-day cooldown)torus-scripts@8/ ESLint / Prettier → Vite+ (vp),@toruslabs/config@5, Oxlint/Oxfmt,@lavamoat/hardenmoderatenode >=24.22.0,npm >=12,.nvmrc26,@types/node^26.6.6main/module/unpkg/jsdelivrunchanged;typesmoved fromdist/lib.cjs/types/index.d.tstodist/lib.cjs/index.d.ts@babel/runtimepeervalidate(Node 24.22.0 and 26),release-pr(Changesets, no publish),security-code-scanner; vue-app S3/CloudFront deploy on master uses STSvars.AWS_ROLE_ARNplus Wiz sensorMajors taken
@toruslabs/torus-scripts8 → 9.0.1,@toruslabs/config4 → 5, Oxlint presets replace ESLint configs, TypeScript 5 → 7,@types/node25 → 26, vite-plus / Changesets / harden addedMajors skipped (step 4)
@toruslabs/torus.js,@toruslabs/broadcast-channel, and the dependent majors listed aboveScan / audit
npm audit: 12 left (7 low / 5 moderate) — deepmerge prototype advisory (no in-range fix without an API change); toruslabs stack waiting on step 4; minimatch viaeslint-plugin-tsdoctransitive from the oxlint presetvitest(require-mock-type-parameters)warnings only (0 errors)Settings this PR cannot change
release-pr)vars.AWS_ROLE_ARNandsecrets.WIZ_SENSOR_TOKENbefore the first master deployrelease-packagesstays manual after the release PR merges.How has this been tested?
npm ci, harden, check, build, typecheck, tests (42)dist/lib.{cjs,esm}/index.{js,d.ts}andserviceworker/requireand ESMimportof the packed buildexamples/vue-appbuild with a local packScreenshots (if appropriate)
N/A
Types of changes
Checklist
Made with Cursor