[cryptodev-2s]

Replaces eslint and prettier with oxlint and oxfmt using the MetaMask oxlint configs and core's formatter settings, with existing violations recorded in a suppressions file.

---

Note

Low Risk
Tooling and formatting only; lint behavior is preserved via suppressions, with no product or runtime logic changes beyond style.

Overview
Replaces ESLint and Prettier with oxlint and oxfmt using the MetaMask oxlint config stack, including type-aware linting and Vitest/Node overrides (with node/no-process-env disabled under .github/**).

Removes .eslintrc.js and .prettierrc.js, adds oxlint.config.mts, .oxfmtrc.json, and a large oxlint-suppressions.json so current rule violations stay allowed until cleaned up. package.json lint scripts now run oxlint / oxfmt; changelog validation uses auto-changelog 7.1.0 with the oxfmt formatter. depcheck and tsconfig are updated for the new tooling.

Most other diff hunks are automated formatting and import sorting across .github workflow scripts and a few src entry points, with no intentional behavior change.

^{Reviewed by Cursor Bugbot for commit c973e63. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​oxlint-config-commonjs@​0.2.0
	@​metamask/​oxlint-config-nodejs@​0.2.0
	@​metamask/​oxlint-config-vitest@​0.2.0
	@​metamask/​oxlint-config-typescript@​0.2.0
	@​types/​semver@​7.7.0 ⏵ 7.8.0			+1
	@​metamask/​oxlint-config@​0.2.0
	oxfmt@​0.72.0
	oxlint@​1.93.0
	semver@​7.8.5 ⏵ 7.8.6	+1		+1
	eslint-plugin-n@​15.7.0 ⏵ 18.5.0
	oxlint-tsgolint@​7.0.2006
	@​metamask/​auto-changelog@​7.0.1 ⏵ 7.1.0	+1			+1

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Priority	Alert  (click "▶" to expand/collapse)	Action
	System shell access: npm oxfmt in module child_process Module: child_process Location: Package overview From: package.json → npm/oxfmt@0.72.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxfmt@0.72.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm tinypool in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/oxfmt@0.72.0 → npm/tinypool@2.2.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tinypool@2.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Network access: npm @yarnpkg/core in module https Module: https Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm @yarnpkg/core in module http Module: http Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm @yarnpkg/core in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm hpagent in module https Module: https Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/hpagent@1.2.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/hpagent@1.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm hpagent in module http Module: http Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/hpagent@1.2.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/hpagent@1.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @metamask/auto-changelog Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@7.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @metamask/auto-changelog reads npm_package_repository_url Env Vars: npm_package_repository_url Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@7.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @metamask/auto-changelog reads PROJECT_CWD Env Vars: PROJECT_CWD Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@7.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm @yarnpkg/core is 66.0% likely to have a medium risk anomaly Notes: No explicit embedded malware payload is evident in this fragment. However, it implements a high-impact supply-chain mechanism: it can download remote plugin code (HTTP(S)), persist it to disk, and dynamically require/activate it based on rc/environment-controlled configuration. If an attacker can influence configuration inputs (rc files, injected env files, or environment variables), this becomes a straightforward path to arbitrary code execution via plugin initialization. Review should focus on who can modify those inputs and what additional trust controls exist outside this module (e.g., signature verification or strict allowlisting of plugin sources). Confidence: 0.66 Severity: 0.68 From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core Env Vars: YARN_CACHE_CHECKPOINT_OVERRIDE Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads YARN_CACHE_VERSION_OVERRIDE Env Vars: YARN_CACHE_VERSION_OVERRIDE Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads GITHUB_EVENT_PATH Env Vars: GITHUB_EVENT_PATH Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads LOCALAPPDATA Env Vars: LOCALAPPDATA Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads XDG_DATA_HOME Env Vars: XDG_DATA_HOME Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads KONSOLE_VERSION Env Vars: KONSOLE_VERSION Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads YARN_IS_TEST_ENV Env Vars: YARN_IS_TEST_ENV Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads YARN_OS_OVERRIDE Env Vars: YARN_OS_OVERRIDE Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads YARN_CPU_OVERRIDE Env Vars: YARN_CPU_OVERRIDE Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads YARN_LIBC_OVERRIDE Env Vars: YARN_LIBC_OVERRIDE Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core Env Vars: YARN_LOCKFILE_VERSION_OVERRIDE Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @yarnpkg/core reads COREPACK_ROOT Env Vars: COREPACK_ROOT Location: Package overview From: package.json → npm/@metamask/auto-changelog@7.1.0 → npm/@yarnpkg/core@4.9.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yarnpkg/core@4.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
See 29 more rows in the dashboard

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d19483e. Configure here.}