chore: package config lint by wenfix · Pull Request #110 · MetaMask/connect-monorepo

wenfix · 2026-01-14T13:02:31Z

Summary

This branch adds package configuration linting to the monorepo. It adds publint and @arethetypeswrong/cli as dev dependencies, creates lint:exports, lint:types, and lint:package-config scripts in the root package.json, and runs lint:package-config as part of the pre-push hook.

The attw and publint scripts for each package are enforced via yarn.config.cjs constraints (single source of truth, auto-fixable with yarn constraints --fix).

Some (benign) rules are being ignored per-package with the reasons detailed in the document included in this PR.

Package export fixes

Fixing linting issues required correcting several package export maps:

connect: main now points to ./dist/multichain/index.js (was an empty barrel at ./dist/index.js)
connect-evm: require/main/default now serve the Node CJS build instead of browser ESM; added browser export condition
connect-multichain: restored top-level browser field alongside exports.browser for browserify compat
multichain-ui: export paths updated to match actual Stencil output (.js/.cjs.js instead of .mjs/.cjs)

Changelog entries have been added for all affected packages.

References

Fixes WAPI-925

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

socket-security · 2026-02-05T19:42:43Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@arethetypeswrong/cli@0.18.2
	publint@0.2.12

View full report

socket-security · 2026-02-05T19:42:45Z

Warning

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm `glob` is 100.0% likely to have a medium risk anomaly Notes: The analyzed Glob library fragment implements standard, non-malicious filesystem globbing with proper asynchronous flow, error handling, and event emissions. It presents typical patterns for matching paths and optionally resolving real paths. Security risk is low to moderate as with any filesystem enumeration utility; no malicious activity detected in this fragment. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/publint@0.2.12` → `npm/glob@8.1.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/glob@8.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `npm-bundled` is 100.0% likely to have a medium risk anomaly Notes: The analyzed fragment is a filesystem-based dependency walker that traverses node_modules to gather package information and package.json contents. There is no evidence of data exfiltration, remote control, or code execution. The primary concerns are silent error swallowing and potential path normalization gaps, but these do not indicate malicious intent. Overall risk is low to moderate depending on external consumption of the emitted data. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/publint@0.2.12` → `npm/npm-bundled@2.0.1` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm-bundled@2.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

@arethetypeswrong/core@0.18.2
highlight.js@10.7.3
npm-normalize-package-bin@2.0.0

View full report

wenfix · 2026-02-05T19:47:11Z

@SocketSecurity ignore npm/@arethetypeswrong/core@0.18.2

Widely used package at ~400k weekly downloads.

Socket Security Analysis here

wenfix · 2026-02-06T15:18:55Z

@SocketSecurity ignore npm/npm-normalize-package-bin@2.0.0

Luke Karrys is a reputable package maintainer.

adonesky1

This PR is quietly bundling breaking package changes (entry points, exports, browser field removals, a new CJS build) under a chore: lint label. Those deserve their own PR with changelogs and semver bumps.

See inline comments for specifics.

adonesky1 · 2026-03-23T20:45:26Z

+    "lint:exports": "yarn workspaces foreach --all --no-private --parallel --interlaced --verbose run publint",
    "lint:fix": "yarn lint:eslint --fix && echo && yarn lint:misc --write && yarn constraints --fix && yarn lint:dependencies:fix",
    "lint:misc": "prettier --no-error-on-unmatched-pattern '**/*.json' '**/*.md' '**/*.yml' '!.yarnrc.yml' '!merged-packages/**' --ignore-path .gitignore",
+    "lint:package-config": "yarn lint:exports; yarn lint:types",


Bug: the ; here means if lint:exports fails but lint:types passes, the exit code is 0 — your pre-commit hook silently swallows the failure. Needs && instead of ;.

Fixed — changed ; to &&.

adonesky1 · 2026-03-23T20:45:26Z

    "workspaces:list-versions": "./scripts/list-workspace-versions.sh"
  },
  "simple-git-hooks": {
+    "pre-commit": "yarn lint:package-config",


attw --pack creates a tarball for every package on every commit — probably 20-40s. That's too heavy for a pre-commit hook. Move this to CI or at least pre-push (which already runs the full lint suite anyway).

Moved from pre-commit to pre-push: yarn lint && yarn lint:package-config.

adonesky1 · 2026-03-23T20:45:26Z

-  "main": "./dist/index.js",
-  "module": "./dist/index.mjs",
-  "types": "./dist/index.d.ts",
+  "main": "./dist/multichain/index.js",


This changes what legacy consumers (anything ignoring exports) get from require('@metamask/connect') — the old main was an empty barrel, now it's the real multichain module. Correct fix, but it's a behavioral change that needs a changelog entry

Added changelog entry under Unreleased.

adonesky1 · 2026-03-23T20:45:26Z

    "./package.json": "./package.json"
  },
-  "main": "./dist/browser/es/connect-evm.mjs",
+  "main": "./dist/node/cjs/connect-evm.js",


Three breaking changes stacked in one package:

require now serves a brand new CJS Node build instead of browser ESM

browser field removed (breaks browserify → falls back to main which is now Node CJS)

main flipped from browser ESM to Node CJS

Each is arguably the right fix, but this needs a changelog + semver bump — shouldn't be tucked into a linting PR.

Added changelog entry. These changes are needed to make the exports map correct — require was serving browser ESM which breaks Node consumers. Changelog now documents them as breaking.

adonesky1 · 2026-03-23T20:45:26Z

    "./package.json": "./package.json"
  },
  "main": "./dist/node/cjs/connect-multichain.js",
  "module": "./dist/browser/es/connect-multichain.mjs",


The browser field got removed right below this line. Browserify doesn't read exports — it'll fall back to main (Node CJS) instead of the browser build. Low risk since your consumers probably use modern bundlers, but trivially fixable: just keep the browser field alongside the new exports.browser condition.

Restored the top-level browser field alongside exports.browser.

adonesky1 · 2026-03-23T20:45:26Z

  ],
  "scripts": {
-    "build": "yarn clean && tsc -b --force tsconfig.build.json && npx tsup src/index.ts --format esm,cjs",
+    "attw": "attw --pack . --ignore-rules false-cjs no-resolution",


This exact script (same --ignore-rules) is copy-pasted into 5 other packages. You already have yarn.config.cjs with ~400 lines of constraint enforcement — attw and publint scripts should be enforced there instead. Single source of truth, auto-fixable with yarn constraints --fix, and you don't have to touch 6 files when the ignore list changes.

Moved both attw and publint script enforcement into yarn.config.cjs constraints. The multichain-ui exception (extra unexpected-module-syntax ignore rule) is handled there too. Single source of truth, auto-fixable with yarn constraints --fix.

adonesky1 · 2026-03-23T20:45:26Z

      "import": {
        "types": "./dist/types/index.d.ts",
-        "default": "./dist/index.mjs"
+        "default": "./dist/index.js"


Confirmed these now match what Stencil actually outputs (the old .mjs/.cjs paths were wrong). But since the exports map paths changed, any consumer whose toolchain resolved through those exact paths will break. Worth a changelog note.

Added changelog entry under Unreleased.

wenfix · 2026-03-24T10:32:57Z

@SocketSecurity ignore npm/highlight.js@10.7.3

popular JS syntax highlighter

wenfix added 2 commits January 14, 2026 11:34

setup publint and attw

2c87b19

adjust type generation

a561af9

wenfix added the no-changelog label Jan 14, 2026

wenfix added 4 commits January 14, 2026 16:08

revert build changes

d105ea5

Merge branch 'main' into chore/package-config-lint

941580e

add package linting to solana

311880d

ignore benign rules and add explanation doc

61e145a

wenfix added 6 commits February 5, 2026 19:50

update constraints

a6831a8

Merge branch 'main' into chore/package-config-lint

21e6619

revert multichain-ui package change

8711099

fix linting issue on connect-evm tsup.config

b6aa354

Merge branch 'main' into chore/package-config-lint

e2d3586

remove ignored cjs rule for solana

7af8cda

wenfix marked this pull request as ready for review February 6, 2026 15:19

wenfix requested a review from a team as a code owner February 6, 2026 15:19

lint doc

822fb4d

adonesky1 reviewed Mar 23, 2026

View reviewed changes

wenfix added 2 commits March 24, 2026 10:14

address review

260adc9

Merge branch 'main' into chore/package-config-lint

e68e6fe

github-advanced-security AI found potential problems Mar 24, 2026

View reviewed changes

lint

c71b307

wenfix and others added 3 commits March 24, 2026 10:34

remove direct npx usage

ce76873

Merge branch 'main' into chore/package-config-lint

19a042e

Merge branch 'main' into chore/package-config-lint

fae74b8

Uh oh!

Uh oh!

Conversation

wenfix commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Package export fixes

References

Checklist

Uh oh!

socket-security Bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wenfix commented Feb 5, 2026

Uh oh!

wenfix commented Feb 6, 2026

Uh oh!

adonesky1 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adonesky1 Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wenfix commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

wenfix commented Jan 14, 2026 •

edited

Loading

socket-security Bot commented Feb 5, 2026 •

edited

Loading

socket-security Bot commented Feb 5, 2026 •

edited

Loading

adonesky1 left a comment •

edited

Loading

adonesky1 Mar 23, 2026 •

edited

Loading