Release: v2.18.0 prep#803
Merged
Merged
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThis PR updates dev/runtime dependency versions across workspace packages, bumps ChangesDependency and Configuration Updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
💼 Build Files |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/extension/src/libs/utils/screening.ts (1)
2-10:⚠️ Potential issue | 🟠 Major | ⚡ Quick winGeo-restriction check is fail-open, which can bypass compliance gating on endpoint errors.
With the new
/o/ipcomply/enkryptendpoint, any non-OK response or fetch failure currently returnsfalse, effectively allowing restricted traffic when the service is unavailable.Suggested hardening
const isGeoRestricted = async (): Promise<boolean> => { return fetch('https://partners.mewapi.io/o/ipcomply/enkrypt') .then(async res => { if (res.ok) { const json = await res.json(); return json.isRestricted; } - return false; + return true; }) - .catch(() => false); + .catch(() => true); };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/extension/src/libs/utils/screening.ts` around lines 2 - 10, The current fetch to 'https://partners.mewapi.io/o/ipcomply/enkrypt' is fail-open (non-OK responses and fetch errors return false), which can bypass restrictions; change the behavior to fail-closed by returning true (or throwing) on non-ok responses and in the catch block so failures default to "restricted". Locate the fetch call in screening.ts (the block that awaits res.json() and returns json.isRestricted) and modify both the "if (!res.ok) ..." path and the .catch(...) to return true (or rethrow an error) and optionally add a processLogger/console.error message including the response status/error to aid debugging. Ensure the rest of the codebase expects a boolean or handles thrown errors and update callers if needed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/signers/polkadot/package.json`:
- Line 25: The package.json for the polkadot signer lists the dev tool
"`@commitlint/cli`" under "dependencies"; move the "`@commitlint/cli`": "^20.5.3"
entry from the dependencies section into devDependencies so it is not shipped as
a production dependency (edit the packages/signers/polkadot package.json, remove
the entry under "dependencies" and add it under "devDependencies").
---
Outside diff comments:
In `@packages/extension/src/libs/utils/screening.ts`:
- Around line 2-10: The current fetch to
'https://partners.mewapi.io/o/ipcomply/enkrypt' is fail-open (non-OK responses
and fetch errors return false), which can bypass restrictions; change the
behavior to fail-closed by returning true (or throwing) on non-ok responses and
in the catch block so failures default to "restricted". Locate the fetch call in
screening.ts (the block that awaits res.json() and returns json.isRestricted)
and modify both the "if (!res.ok) ..." path and the .catch(...) to return true
(or rethrow an error) and optionally add a processLogger/console.error message
including the response status/error to aid debugging. Ensure the rest of the
codebase expects a boolean or handles thrown errors and update callers if
needed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 90fc22ee-1f38-4c35-a4fb-3fed0e9b8d8c
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (17)
package.jsonpackages/extension-bridge/package.jsonpackages/extension/package.jsonpackages/extension/src/libs/utils/screening.tspackages/hw-wallets/package.jsonpackages/keyring/package.jsonpackages/name-resolution/package.jsonpackages/request/package.jsonpackages/signers/bitcoin/package.jsonpackages/signers/ethereum/package.jsonpackages/signers/kadena/package.jsonpackages/signers/massa/package.jsonpackages/signers/polkadot/package.jsonpackages/storage/package.jsonpackages/swap/package.jsonpackages/types/package.jsonpackages/utils/package.json
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/extension/src/libs/background/index.ts`:
- Around line 92-96: The geo-check currently only caches the resolved boolean in
this.#geoRestricted, causing repeated calls while the first promise is pending;
change the logic to store the in-flight promise (e.g., a new private field like
`#geoRestrictedPromise` or reuse `#geoRestricted` to hold Promise<boolean> until
resolution), set that promise when calling isGeoRestricted(), have all callers
await that shared promise, and when it resolves assign the final boolean to
this.#geoRestricted (or a separate boolean field) and clear the promise; also
handle promise rejection by logging/setting a safe default so subsequent calls
can retry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 06d9401f-e01c-4784-916e-8496ff421041
📒 Files selected for processing (1)
packages/extension/src/libs/background/index.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Chores
Bug Fixes