chore: Deduplicate remaining dependencies; add deduplicate script

[legobeat]

#7123 but split up dedupes and rebased on:

• chore(deps): dedupe semver #7130
• fix(deps): Dedupe ethereum-cryptography #7129
  • deps: Dedupe ethers@5.* #7128
    • chore: Dedupe ethereumjs packages #7127
      • chore: dedupe babel packages #7118

Description

A deduplicate script has been added to package.json, which allows deduplicating dependencies in the lockfile. This feature is built-in as part of Yarn v3, but on Yarn v1 it's provided by the yarn-deduplicate package.

It has been run, so the lockfile has been purged of unnecessary copies of dependencies. This means many dependencies have been updated, but it should result in no breakages as long as all affected packages are SemVer-compliant or handled by one of our resolutions.

A CI check has been added to ensure dependencies are always deduplicated. If duplicates are detected, the error from CI will explain how to remove them.

Issue

No related issue

Checklist

• There is a related GitHub issue
• Tests are included if applicable
• Any added code is fully documented

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[socket-security]

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
yarn-deduplicate	6.0.2	None	+2	313 kB	scinos
socket.io-client	4.5.3...4.6.1	None	+2/-1	1.94 MB	darrachequesne
@types/react-native	0.64.11...0.64.13	None	+0/-0	386 kB	types
prettier	2.8.1...2.8.8	None	+0/-0	11.2 MB	prettier-bot
dotenv	16.0.3...16.3.1	environment	+0/-0	71.6 kB	motdotla

🚮 Removed packages: @types/lodash@4.14.186, @types/qs@6.9.7, @walletconnect/jsonrpc-types@1.0.2, eciesjs@0.3.15

[socket-security]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: rlp@2.2.7, exponential-backoff@3.1.1, cosmiconfig@7.1.0, define-properties@1.2.1

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

[legobeat]

dedupes-diff.txt
Diff vs #7123

[codecov-commenter]

Codecov Report

All modified lines are covered by tests ✅

Comparison is base (3f2af04) 34.62% compared to head (4079dc6) 34.62%.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7131   +/-   ##
=======================================
  Coverage   34.62%   34.62%           
=======================================
  Files        1019     1019           
  Lines       27192    27192           
  Branches     2217     2217           
=======================================
  Hits         9414     9414           
  Misses      17287    17287           
  Partials      491      491           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[legobeat]

@SocketSecurity ignore rlp@2.2.7
@SocketSecurity ignore exponential-backoff@3.1.1
@SocketSecurity ignore cosmiconfig@7.1.0

new author ok

[legobeat]

@SocketSecurity ignore define-properties@1.2.1

[leotm]

🧹🤖