Release: v2.18.0 prep#803
Conversation
WalkthroughThis PR updates development and runtime dependency versions across the monorepo and bumps the extension package to 2.18.0. It also changes the extension geo-restriction request endpoint to an enkrypt-specific partners path and caches the result, calling the check only when unset. ChangesDependency and Configuration Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint skipped: no ESLint configuration detected in root package.json. To enable, add Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
💼 Build Files |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/extension/src/libs/utils/screening.ts (1)
2-10:⚠️ Potential issue | 🟠 Major | ⚡ Quick winGeo-restriction check is fail-open, which can bypass compliance gating on endpoint errors.
With the new
/o/ipcomply/enkryptendpoint, any non-OK response or fetch failure currently returnsfalse, effectively allowing restricted traffic when the service is unavailable.Suggested hardening
const isGeoRestricted = async (): Promise<boolean> => { return fetch('https://partners.mewapi.io/o/ipcomply/enkrypt') .then(async res => { if (res.ok) { const json = await res.json(); return json.isRestricted; } - return false; + return true; }) - .catch(() => false); + .catch(() => true); };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/extension/src/libs/utils/screening.ts` around lines 2 - 10, The current fetch to 'https://partners.mewapi.io/o/ipcomply/enkrypt' is fail-open (non-OK responses and fetch errors return false), which can bypass restrictions; change the behavior to fail-closed by returning true (or throwing) on non-ok responses and in the catch block so failures default to "restricted". Locate the fetch call in screening.ts (the block that awaits res.json() and returns json.isRestricted) and modify both the "if (!res.ok) ..." path and the .catch(...) to return true (or rethrow an error) and optionally add a processLogger/console.error message including the response status/error to aid debugging. Ensure the rest of the codebase expects a boolean or handles thrown errors and update callers if needed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/signers/polkadot/package.json`:
- Line 25: The package.json for the polkadot signer lists the dev tool
"`@commitlint/cli`" under "dependencies"; move the "`@commitlint/cli`": "^20.5.3"
entry from the dependencies section into devDependencies so it is not shipped as
a production dependency (edit the packages/signers/polkadot package.json, remove
the entry under "dependencies" and add it under "devDependencies").
---
Outside diff comments:
In `@packages/extension/src/libs/utils/screening.ts`:
- Around line 2-10: The current fetch to
'https://partners.mewapi.io/o/ipcomply/enkrypt' is fail-open (non-OK responses
and fetch errors return false), which can bypass restrictions; change the
behavior to fail-closed by returning true (or throwing) on non-ok responses and
in the catch block so failures default to "restricted". Locate the fetch call in
screening.ts (the block that awaits res.json() and returns json.isRestricted)
and modify both the "if (!res.ok) ..." path and the .catch(...) to return true
(or rethrow an error) and optionally add a processLogger/console.error message
including the response status/error to aid debugging. Ensure the rest of the
codebase expects a boolean or handles thrown errors and update callers if
needed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 90fc22ee-1f38-4c35-a4fb-3fed0e9b8d8c
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (17)
package.jsonpackages/extension-bridge/package.jsonpackages/extension/package.jsonpackages/extension/src/libs/utils/screening.tspackages/hw-wallets/package.jsonpackages/keyring/package.jsonpackages/name-resolution/package.jsonpackages/request/package.jsonpackages/signers/bitcoin/package.jsonpackages/signers/ethereum/package.jsonpackages/signers/kadena/package.jsonpackages/signers/massa/package.jsonpackages/signers/polkadot/package.jsonpackages/storage/package.jsonpackages/swap/package.jsonpackages/types/package.jsonpackages/utils/package.json
| }, | ||
| "dependencies": { | ||
| "@commitlint/cli": "^20.5.0", | ||
| "@commitlint/cli": "^20.5.3", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== scripts in packages/signers/polkadot/package.json =="
cat packages/signers/polkadot/package.json | jq '.scripts // {}'
echo
echo "== runtime/import references under packages/signers/polkadot =="
rg -n --type-add 'json:*.json' --type ts --type js --type json \
'`@commitlint/cli`|from\s+["'\'']`@commitlint/cli`["'\'']|require\(["'\'']`@commitlint/cli`["'\'']\)' \
packages/signers/polkadot
echo
echo "== workspace-level commitlint usage (likely CI/dev tooling) =="
rg -n --type-add 'json:*.json' --type json --type yaml --type toml --type md \
'commitlint' .Repository: enkryptcom/enKrypt
Length of output: 643
Move @commitlint/cli to devDependencies in packages/signers/polkadot
packages/signers/polkadot/package.json lists @commitlint/cli in dependencies (line 25), but there are no import/require references under packages/signers/polkadot—only the manifest entry. Since the workspace root already includes @commitlint/cli, this package shouldn’t ship the CLI as a production dependency.
"dependencies": {
"`@commitlint/cli`": "^20.5.3",
}Move that entry to devDependencies.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/signers/polkadot/package.json` at line 25, The package.json for the
polkadot signer lists the dev tool "`@commitlint/cli`" under "dependencies"; move
the "`@commitlint/cli`": "^20.5.3" entry from the dependencies section into
devDependencies so it is not shipped as a production dependency (edit the
packages/signers/polkadot package.json, remove the entry under "dependencies"
and add it under "devDependencies").
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/extension/src/libs/background/index.ts`:
- Around line 92-96: The geo-check currently only caches the resolved boolean in
this.#geoRestricted, causing repeated calls while the first promise is pending;
change the logic to store the in-flight promise (e.g., a new private field like
`#geoRestrictedPromise` or reuse `#geoRestricted` to hold Promise<boolean> until
resolution), set that promise when calling isGeoRestricted(), have all callers
await that shared promise, and when it resolves assign the final boolean to
this.#geoRestricted (or a separate boolean field) and clear the promise; also
handle promise rejection by logging/setting a safe default so subsequent calls
can retry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 06d9401f-e01c-4784-916e-8496ff421041
📒 Files selected for processing (1)
packages/extension/src/libs/background/index.ts
| if (this.#geoRestricted === undefined) { | ||
| isGeoRestricted().then(restricted => { | ||
| this.#geoRestricted = restricted; | ||
| }); | ||
| } |
There was a problem hiding this comment.
Cache the in-flight geo check, not only the resolved value.
this.#geoRestricted === undefined remains true until the first promise resolves, so repeated init/unload messages can still fire multiple isGeoRestricted() requests. Store a pending promise (or await a shared one) to truly dedupe calls.
Suggested adjustment
+ `#geoRestrictedPromise`: Promise<boolean> | undefined;
...
- if (this.#geoRestricted === undefined) {
- isGeoRestricted().then(restricted => {
- this.#geoRestricted = restricted;
- });
- }
+ if (this.#geoRestricted === undefined && !this.#geoRestrictedPromise) {
+ this.#geoRestrictedPromise = isGeoRestricted().then(restricted => {
+ this.#geoRestricted = restricted;
+ this.#geoRestrictedPromise = undefined;
+ return restricted;
+ });
+ }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/extension/src/libs/background/index.ts` around lines 92 - 96, The
geo-check currently only caches the resolved boolean in this.#geoRestricted,
causing repeated calls while the first promise is pending; change the logic to
store the in-flight promise (e.g., a new private field like
`#geoRestrictedPromise` or reuse `#geoRestricted` to hold Promise<boolean> until
resolution), set that promise when calling isGeoRestricted(), have all callers
await that shared promise, and when it resolves assign the final boolean to
this.#geoRestricted (or a separate boolean field) and clear the promise; also
handle promise rejection by logging/setting a safe default so subsequent calls
can retry.
1 participant
Summary by CodeRabbit
Chores
Bug Fixes