Closed alfetopito closed 1 week ago
vercel[bot]
commented
4 weeks ago The latest updates on your projects. Learn more about Vercel for Git ↗︎
| Name | Status | Preview | Updated (UTC) |
|---|---|---|---|
| cosmos | ✅ Ready (Inspect) | Visit Preview | May 24, 2024 9:56am |
| cowfi | ✅ Ready (Inspect) | Visit Preview | May 24, 2024 9:56am |
| explorer-dev | ✅ Ready (Inspect) | Visit Preview | May 24, 2024 9:56am |
| swap-dev | ✅ Ready (Inspect) | Visit Preview | May 24, 2024 9:56am |
| widget-configurator | ✅ Ready (Inspect) | Visit Preview | May 24, 2024 9:56am |
socket-security[bot]
commented
4 weeks ago New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
🚮 Removed packages: npm/@cowprotocol/ethflowcontract@1.1.1, npm/@types/istanbul-lib-coverage@2.0.4, npm/@types/json-schema@7.0.15, npm/@types/lodash@4.17.0, npm/@ungap/structured-clone@1.2.0, npm/abab@2.0.6, npm/acorn-walk@8.3.2, npm/acorn@8.11.3, npm/address@1.2.2, npm/agent-base@6.0.2, npm/anymatch@3.1.3, npm/arch@2.2.0, npm/argparse@1.0.10, npm/assert-plus@1.0.0, npm/ast-types-flow@0.0.8, npm/available-typed-arrays@1.0.7, npm/base64-js@1.5.1, npm/bluebird@3.7.2, npm/bn.js@5.2.1, npm/brorand@1.1.0, npm/buffer@6.0.3, npm/camelcase@6.3.0, npm/chai@4.4.1, npm/check-error@1.0.3, npm/cli-cursor@3.1.0, npm/clsx@1.2.1, npm/color-name@1.1.4, npm/colorette@2.0.20, npm/confusing-browser-globals@1.0.11, npm/content-disposition@0.5.4, npm/cross-env@7.0.3, npm/d3-color@3.1.0, npm/d3-dispatch@3.0.1, npm/d3-ease@3.0.1, npm/d3-format@3.1.0, npm/d3-quadtree@3.0.1, npm/d3-selection@3.0.0, npm/d3-timer@3.0.1, npm/date-fns@2.30.0, npm/decamelize@1.2.0, npm/decimal.js@10.4.3, npm/deep-eql@4.1.3, npm/deepmerge@4.3.1, npm/defer-to-connect@2.0.1, npm/define-data-property@1.1.4, npm/define-properties@1.2.1, npm/depd@2.0.0, npm/dequal@2.0.3, npm/diff-sequences@29.6.3, npm/encoding@0.1.13, npm/entities@4.5.0, npm/es-errors@1.3.0, npm/es-shim-unscopables@1.0.2, npm/es6-promise@4.2.8, npm/eslint-config-prettier@9.1.0, npm/esprima@4.0.1, npm/esquery@1.5.0, npm/estraverse@5.3.0, npm/eventemitter3@4.0.7, npm/events@3.3.0, npm/exponential-backoff@3.1.1, npm/extend@3.0.2, npm/fast-deep-equal@3.1.3, npm/fast-json-stable-stringify@2.1.0, npm/fast-safe-stringify@2.1.1, npm/flatted@3.3.1, npm/fsevents@2.3.2, npm/function.prototype.name@1.1.6, npm/functions-have-names@1.2.3, npm/get-caller-file@2.0.5, npm/get-func-name@2.0.2, npm/glob-parent@6.0.2, npm/graceful-fs@4.2.11, npm/has-symbols@1.0.3, npm/has-tostringtag@1.0.2, npm/iconv-lite@0.6.3, npm/icss-utils@5.1.0, npm/ieee754@1.2.1, npm/inherits@2.0.4, npm/internal-slot@1.0.7, npm/internmap@2.0.3, npm/is-arguments@1.1.1, npm/is-callable@1.2.7, npm/is-date-object@1.0.5, npm/is-docker@2.2.1, npm/is-glob@4.0.3, npm/is-negative-zero@2.0.3, npm/is-path-inside@3.0.3, npm/is-plain-obj@1.1.0, npm/is-string@1.0.7, npm/is-symbol@1.0.4, npm/is-typedarray@1.0.0, npm/istanbul-lib-coverage@3.2.0, npm/istanbul-lib-instrument@5.2.1, npm/js-tokens@4.0.0, npm/json-stringify-safe@5.0.1, npm/json5@2.2.3, npm/keyv@4.5.4, npm/kind-of@6.0.3, npm/language-tags@1.0.9, npm/loader-utils@2.0.4, npm/lodash-es@4.17.21, npm/lodash.isequal@4.5.0, npm/lodash@4.17.21, npm/log-symbols@4.1.0, npm/loupe@2.3.7, npm/lowercase-keys@2.0.0, npm/magic-string@0.30.10, npm/merge2@1.4.1, npm/mime-db@1.52.0, npm/mime-types@2.1.35, npm/mime@1.6.0, npm/mimic-response@1.0.1, npm/minimalistic-assert@1.0.1, npm/minimist@1.2.8, npm/minipass@4.2.8, npm/ms@2.1.3, npm/nanoid@3.3.7, npm/node-releases@2.0.14, npm/normalize-path@3.0.0, npm/object-assign@4.1.1, npm/object-inspect@1.13.1, npm/once@1.4.0, npm/os-tmpdir@1.0.2, npm/path-parse@1.0.7, npm/picomatch@2.3.1, npm/pirates@4.0.6, npm/postcss-modules-extract-imports@3.1.0, npm/postcss-modules-local-by-default@4.0.5, npm/postcss-modules-scope@3.2.0, npm/postcss-value-parser@4.2.0, npm/prettier@2.8.8, npm/pretty-bytes@5.6.0, npm/psl@1.9.0, npm/punycode@2.3.0, npm/q@1.5.1, npm/randombytes@2.1.0, npm/react-is@18.2.0, npm/regenerator-runtime@0.13.11, npm/resolve-alpn@1.2.1, npm/resolve-from@5.0.0, npm/rimraf@3.0.2, npm/safe-buffer@5.2.1, npm/safer-buffer@2.1.2, npm/semver@6.3.1, npm/setimmediate@1.0.5, npm/signal-exit@4.1.0, npm/slash@3.0.0, npm/std-env@3.7.0, npm/strip-json-comments@3.1.1, npm/svg-parser@2.0.4, npm/tapable@2.2.1, npm/through@2.3.8, npm/tinybench@2.8.0, npm/type-detect@4.0.8, npm/typescript@5.1.6, npm/wcwidth@1.0.1, npm/web-vitals@2.1.4, npm/xtend@4.0.2, npm/yallist@4.0.0, npm/yaml@1.10.2, npm/yargs-parser@21.1.1
socket-security[bot]
commented
4 weeks ago 🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
| Alert | Package | Note | Source |
|---|---|---|---|
| Install scripts | npm/@sentry/cli@2.20.5 |
| |
| Install scripts | npm/@sentry/cli@2.21.3 |
| |
| Install scripts | npm/@fortawesome/fontawesome-svg-core@6.5.1 |
| |
| Install scripts | npm/@fortawesome/fontawesome-common-types@6.5.1 |
| |
| Install scripts | npm/@fortawesome/free-regular-svg-icons@6.5.1 |
| |
| Install scripts | npm/@fortawesome/free-solid-svg-icons@6.5.1 |
|
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all
@SocketSecurity ignore npm/@sentry/cli@2.20.5@SocketSecurity ignore npm/@sentry/cli@2.21.3@SocketSecurity ignore npm/@fortawesome/fontawesome-svg-core@6.5.1@SocketSecurity ignore npm/@fortawesome/fontawesome-common-types@6.5.1@SocketSecurity ignore npm/@fortawesome/free-regular-svg-icons@6.5.1@SocketSecurity ignore npm/@fortawesome/free-solid-svg-icons@6.5.1
elena-zh
commented
2 weeks ago Hey @alfetopito ,great job! Here I will list issues I've faced (n addition to the ones reported in https://cowservices.slack.com/archives/C0361CDG8GP/p1715876405779169
When I open Favourites tokens in Account page. I see loaders for USDT token
(not sure), but for the Surplus in Arb it would be great to change the tooltip saying from May 2024 :)
Should we change 'View on Etherscan' to 'View on Arbiscan' everywhere in the app?
ETH-flow is not working
Classic ETH-flow is also not proposed when fill in ETH token into the sell field
Same with Safe +WC: Swap button remains disabled instead of showing Wrap+Swap
Update tokens with the new network on cow.fi/tokens page? https://cow.fi/tokens/cow-protocol
Update widget configurator
Update docs
Partner fee?
Will continue tests in other networks tomorrow and will wait for all the rest fixes.
alfetopito
commented
2 weeks ago @elena-zh
elena-zh
commented
1 week ago Hey @alfetopito , great, great job!
For now, I've faced these issues during testing:
Tomorrow will proceed with tests in other networks. Thanks!
elena-zh
commented
1 week ago Hey @alfetopito , great job! All issues I've reported above are fixed. I'm waiting for other known issues to be fixed, then will approve the current PR :)
shoom3301
commented
1 week ago @alfetopito not part of this PR, but along with releasing it we should update docs: https://docs.cow.fi/governance/token
elena-zh
commented
1 week ago Great job!
Summary
Part of #4310
Add Arbitrum one support.
Mostly functional at this point.
Notes
To Test
Full regression testing on the whole app on all networks 😬
Known issues