Metamask-extension: Stop injecting web3.js

[danfinlay]

Update: window.web3 will be removed on November 16, 2020. Please follow #8077 for details.

For discussion, I am presenting an issue we have considered but postponed a long time.

Web3.js is more of a convenience library than a core API that we export, and the 0.20.x version that we currently have been providing to sites no longer receives fixes or updates, according to Samuel Furter, current maintainer of web3.js.

This exacerbates my concern from a recent user loss, where our injected web3 version lacks some safety validations that the maintained branch has received:
https://github.com/ethereum/web3.js/issues/3065

The maintained branch includes breaking changes, so in order to receive security updates related to web3, we will need to break many applications relying on it.

This is also a heavy file to inject into every frame we ever load.

The Mist project also formerly had planned to stop injecting the web3 API itself, and we also announced we would follow in their path.

This means that either:

• We should update our injected web3.js, which has undocumented breaking changes and is itself scheduled to be replaced with a breaking change.
• We stop injecting the web3 API altogether, will give us performance benefits, and force better developer practices (bring your own abstraction), and dodge the coming breaking changes of web3.js 2.0.

Right now the latter option is looking the safer, more performant, and lower-maintenance path to me, and so I propose we move forward with deprecating the injection of the web3.js library into pages.

[danfinlay]

Action proposed:

• [ ] Propose/Set a date
• [ ] Compose deprecation blog post announcing the date and clarifying the reasoning (this thread may be sufficient).
• [ ] Add a deprecation warning to the console whenever the web3 global is accessed (maybe leave exception for web3.currentProvider, which we can continue to support).
• [ ] After the date: Remove the injected web3, except for web3.currentProvider, which === ethereum.

[bdresser]

can add this warning for the next release

Add a deprecation warning to the console whenever the web3 global is accessed (maybe leave exception for web3.currentProvider, which we can continue to support).

[rekmarks]

window.web3 will be removed on November 16, 2020. Please follow #8077 for details.

[colonelgk]

Layman question here. Does this explain possibly why I cannot get Metamask to pop up a second window in order to approve the second of two transactions to deposit tokens to my node? Regards.

[rekmarks]

Hi @colonelgk. We haven't shipped this changed yet, only merged it into our development branch. For updates on when this will ship, please see #8077.

To answer your question, that sounds unrelated. MetaMask only ever shows one pop-up at a time. If multiple transactions are queued, this will be indicated at the top of the transaction confirmation page.

If you continue to have problems with this, please don't hesitate to open a new issue.