Skip to content

Conversation

metamaskbot
Copy link
Collaborator

@metamaskbot metamaskbot commented Oct 17, 2025

🚀 v13.6.0 Testing & Release Quality Process

Hi Team,
As part of our new MetaMask Release Quality Process, here’s a quick overview of the key processes, testing strategies, and milestones to ensure a smooth and high-quality deployment.


📋 Key Processes

Testing Strategy

  • Developer Teams:
    Conduct regression and exploratory testing for your functional areas, including automated and manual tests for critical workflows.
  • QA Team:
    Focus on exploratory testing across the wallet, prioritize high-impact areas, and triage any Sentry errors found during testing.
  • Customer Success Team:
    Validate new functionalities and provide feedback to support release monitoring.

GitHub Signoff

  • Each team must sign off on the Release Candidate (RC) via GitHub by the end of the validation timeline (Tuesday EOD PT).
  • Ensure all tests outlined in the Testing Plan are executed, and any identified issues are addressed.

Issue Resolution

  • Resolve all Release Blockers (Sev0 and Sev1) by Tuesday EOD PT.
  • For unresolved blockers, PRs may be reverted, or feature flags disabled to maintain release quality and timelines.

Cherry-Picking Criteria

  • Only critical fixes meeting outlined criteria will be cherry-picked.
  • Developers must ensure these fixes are thoroughly reviewed, tested, and merged by Tuesday EOD PT.

🗓️ Timeline and Milestones

  1. Today (Friday): Begin Release Candidate validation.
  2. Tuesday EOD PT: Finalize RC with all fixes and cherry-picks.
  3. Wednesday: Buffer day for final checks.
  4. Thursday: Submit release to app stores and begin rollout to 1% of users.
  5. Monday: Scale deployment to 10%.
  6. Tuesday: Full rollout to 100%.

✅ Signoff Checklist

Each team is responsible for signing off via GitHub. Use the checkbox below to track signoff completion:

Team sign-off checklist

  • Extension Platform
  • Mobile UX
  • Confirmations
  • Core Extension UX
  • Web3Auth
  • Core Platform
  • Assets
  • Delegation
  • Swaps and Bridge
  • New Networks
  • Product Safety
  • Design System
  • Network Enablement
  • Accounts Framework
  • Transactions

This process is a major step forward in ensuring release stability and quality. Let’s stay aligned and make this release a success! 🚀

Feel free to reach out if you have questions or need clarification.

Many thanks in advance

Reference

metamaskbot and others added 30 commits October 3, 2025 07:14
## Version Bump After Release

This PR bumps the main branch version from 13.5.0 to 13.6.0 after
cutting the release branch.

### Why this is needed:
- **Nightly builds**: Each nightly build needs to be one minor version
ahead of the current release candidate
- **Version conflicts**: Prevents conflicts between nightlies and
release candidates
- **Platform alignment**: Maintains version alignment between MetaMask
mobile and extension
- **Update systems**: Ensures nightlies are accepted by app stores and
browser update systems

### What changed:
- Version bumped from `13.5.0` to `13.6.0`
- Platform: `extension`
- Files updated by `set-semvar-version.sh` script

### Next steps:
This PR should be **manually reviewed and merged by the release
manager** to maintain proper version flow.

### Related:
- Release version: 13.5.0
- Release branch: release/13.5.0
- Platform: extension
- Test mode: false

---
*This PR was automatically created by the
`create-platform-release-pr.sh` script.*

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Bumps `package.json` version from `13.5.0` to `13.6.0`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
844c895. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: metamaskbot <[email protected]>
## **Description**

`tar-fs` has a HIGH vulnerability that is breaking the audit step


```
└─ tar-fs
   ├─ ID: 1108293
   ├─ Issue: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
   ├─ URL: GHSA-vj76-c3g6-qr5v
   ├─ Severity: high
   ├─ Vulnerable Versions: >=2.0.0 <2.1.4
   │ 
   ├─ Tree Versions
   │  └─ 2.1.3
   │ 
   └─ Dependents
      └─ prebuild-install@npm:7.1.3

```

This updates it to 2.1.4

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36560?quickstart=1)

## **Changelog**

CHANGELOG entry: Update tar-fs to 2.1.4

## **Related issues**

Fixes: N/A

## **Manual testing steps**

N/A

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [X] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Bumps `tar-fs` from `2.1.3` to `2.1.4` in `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
8f8cf73. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36562?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Updates `tar-fs` to 2.1.4 and refreshes the lockfile entry.
> 
> - **Dependencies**:
> - Update `tar-fs` resolution in `package.json` from `^2.1.3` to
`^2.1.4`.
> - **Lockfile**:
>   - Regenerate `yarn.lock` to reflect `[email protected]` and new checksum.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
34a6cb6. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/34913?quickstart=1)

This PR focuses on preparing webpack plugin to work well with MetaMask
effort to integrate it (see
LavaMoat/LavaMoat#1526).

In order to do that, I had to:


b36e47a
- add to the webpack config support in scuttling and unsafe context
modules (this includes a new scuttling exception for webpack to avoid
clashing with core webpack logic)

6c0201e
- update policy json file

60239a4
- fix contentscript and inpage crashes so they don't clash with webpack
core logic nor scuttling logic (see more
#30134 (comment))
These make it so that when integrated with the MetaMask PR, compilation
and execution of the app works well

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes: #26256

## **Manual testing steps**

1. run `yarn webpack --env production --no-cache`
2. everything should work as usual

## **Screenshots/Recordings**

Not applicable

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Integrates LavaMoat into the webpack build (plugin, policies, CLI),
updates HTML/bootstrap and manifests, adjusts CI to build/test/validate
policies, and refactors tests and configs accordingly.
> 
> - **Build/Webpack**:
> - Add LavaMoat integration via new `LavamoatPlugin` and unsafe layer,
enable with `--lavamoat`, support `--lavamoatDebug` and
`--generatePolicy`; remove `--lockdown` flag and related env.
> - Wire plugin in `webpack.config.ts`, add scuttling exceptions and
self-inject only for MV2; tweak outputs and warnings.
> - Collect new `scripts/load/bootstrap.ts` as self-contained entry;
drop old `_initialize` path.
> - Move lockdown content scripts injection to build
(`applyLockdownContentScripts`).
> - **Policies**:
> - Add webpack LavaMoat policies `lavamoat/webpack/policy.json` and
`policy-override.json`; update various browserify/build policies.
> - **Manifests/HTML**:
> - Trim `content_scripts` to app scripts only; include
`scripts/load/bootstrap.ts` in `background.html` and
`partial-body.html`.
> - **CI/GitHub Actions**:
> - Add Firefox webpack E2E job; adjust Chrome E2E command; gate e2e on
webpack build.
> - Add jobs to update/validate/cache LavaMoat webpack policy and
include in commit step.
> - **CLI/Config**:
> - Update CLI flags and dry-run output; set env to `testing` when
`--test`; remove `ENABLE_LOCKDOWN` variable.
> - **Tests**:
> - Revise lockdown E2E to assert lockdown/scuttling; fix flaky
terms-of-use modal; update webpack tests for argument/manifest changes.
> - **Misc**:
> - Add `@lavamoat/webpack` dep and depcheck ignore; adjust
cookie-handler stream target; update build scripts to strip bootstrap
tag; tweak package scripts.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
c7e1365. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: naugtur <[email protected]>
Co-authored-by: MetaMask Bot <[email protected]>
Co-authored-by: lwin <[email protected]>
Co-authored-by: Howard Braham <[email protected]>
## **Description**

The "Manage Institutional Wallets" entrypoint would have been missing
from the 13.5.0 release with the activation of BIP-44 state 2, which
would deprive users of the ability to onboard.

This PR adds it back. It should be cherry-picked to the release.

## **Changelog**

CHANGELOG entry: Add "Manage Institutional Wallet" to the new add wallet
modal

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/MUL-866

## **Manual testing steps**

1. Go to advanced settings
2. Enable "Manage institutional wallets"
3. See that the option is now there when you go to account list / add
wallet

## **Screenshots/Recordings**


### **Before**

<img width="412" height="612" alt="Screenshot 2025-10-03 at 10 27 34"
src="https://github.com/user-attachments/assets/cbb0c6fa-4d5f-47f9-aa74-72f1c0a0277e"
/>

### **After**

<img width="412" height="612" alt="Screenshot 2025-10-03 at 10 27 16"
src="https://github.com/user-attachments/assets/b0abc025-028b-4803-b439-95569705c736"
/>

## **Pre-merge author checklist**

- [X] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds a conditional "Manage Institutional Wallets" option to
AddWalletModal (via Redux selector) routing to the institutional snap,
with updated and expanded tests.
> 
> - **UI**:
> - **AddWalletModal**: Conditionally appends `institutional-wallet`
option when `getManageInstitutionalWallets` is true; routes to
`/snaps/view/${encodeURIComponent(INSTITUTIONAL_WALLET_SNAP_ID)}`.
> - **Tests**:
> - Mock `react-redux` `useSelector` and i18n; switch to new
`renderWithProvider` helper.
> - Update assertions to translation keys and add coverage for
institutional option visibility (enabled/disabled).
>   - Preserve hardware wallet expanded-view navigation behavior.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
3e1fa21. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

This refactors the multichain router to use the modular init pattern.

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36572?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes: #36571.

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Replaces inline `MultichainRouter` setup with a modular init and
restricted messenger, adds tests, and wires it into the controller
initialization (gated by keyring-snaps).
> 
> - **Snaps / Multichain Router**:
> - Add `MultichainRouterInit`
(`app/scripts/controller-init/snaps/multichain-router-init.ts`) with
`withSnapKeyring` helper and no persisted state.
> - Introduce restricted messenger `getMultichainRouterMessenger` with
allowed actions in `messengers/snaps/multichain-router-messenger.ts` and
export from `snaps` messengers index.
>   - Add unit tests for messenger and init.
> - **Controller Wiring**:
> - Register `MultichainRouter` in `CONTROLLER_MESSENGERS` and expose
`getMultichainRouterMessenger` (///: ONLY_INCLUDE_IF(keyring-snaps)).
> - Export `MultichainRouterInit` from `controller-init/snaps/index.ts`
and include it in the controller init map in `metamask-controller.js`
(conditional).
> - **Cleanup**:
> - Remove direct `MultichainRouter` import and manual construction from
`metamask-controller.js`, deleting inline messenger/`withSnapKeyring`
setup.
> - **Types**:
> - Add `MultichainRouter` to unified controller list/type in
`controller-init/controller-list.ts`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
44b0719. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## **Description**

Controller state is currently sent from the background / service worker
to the UI via JSON-RPC using patches for each top-level property in each
controller, such as `transactions` and `internalAccounts`.

This means, for example, that changing a single transaction parameter
would result in the entire `transactions` array being re-sent, leading
to unchanged Redux selectors firing and unnecessary re-renders.

This PR instead sends the much smaller patches that are automatically
generated from the controllers, ensuring that only data that has
actually been updated is sent to the UI and ultimately reflected in the
Redux store.

For example:

```js
{
    op: 'replace',
    path: ['transactions', 35, 'txParams', 'data'],
    value: '0x12345678'
}
```

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36059?quickstart=1)

## **Changelog**

CHANGELOG entry: null

## **Related issues**

## **Manual testing steps**

Can be verified in the console via `DEBUG=metamask:patch-store` in
`.metamaskrc`.

## **Screenshots/Recordings**

### **Before**

### **After**

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Switches UI state syncing to controller-generated patches, emitting
them from stores, sanitizing/normalizing, and applying via Immer; adds
checksum token metadata lookup and tests.
> 
> - **State Sync via Patches**
> - `app/scripts/lib/ComposableObservableStore.js`: Include `patches` in
`stateChange` events and listeners; emit `{ controllerKey, newState,
oldState, patches }`.
> - `app/scripts/lib/PatchStore.ts`: Accept controller `patches`,
sanitize via `sanitizePatches`, normalize root-level patches to per-key
ops, fallback to generated patches; track pending patches as an array;
add `isInitialized` patch when `vault` present; type to `Json`.
> - `ui/store/actions.ts`: Apply background patches using
`Immer.applyPatches` (auto-freeze disabled), replacing manual logic.
> - **Sanitization Utilities**
> - `app/scripts/lib/state-utils.ts`: Expand `REMOVE_KEYS`; add
`sanitizePatches` to drop sensitive/large paths (e.g.,
`snaps.*.sourceCode`, `nodeAuthTokens.*.authToken`,
`srpSessionData.*.token.accessToken`); implement helpers to delete
matching paths in patch values.
> - **Token Utilities**
> - `ui/helpers/utils/token-util.js`: `getTokenMetadata` now resolves
using lowercase or checksum addresses.
> - **Tests**
> - Add/extend tests for emitting patches
(`ComposableObservableStore.test.js`), patch
handling/sanitization/normalization (`PatchStore.test.ts`,
`state-utils.test.ts`), token metadata lookup (`token-util.test.js`).
> - **E2E/Fixtures**
> - Update token fixtures and mocks to include `CHAI` (e.g.,
`import-tokens.spec.ts`).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
2951d3c. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## **Description**

The original shallow merge in the PreferencesController constructor:

```js
state: {
  ...getDefaultPreferencesControllerState(),
  ...state,
},
```

Would completely replace the defaults for state.preferences with the
persisted one, preventing any new properties like `avatarType` from
being added

## **Changelog**

CHANGELOG entry: fix issue where Preferences is not preserved during
updates

## **Related issues**

Fixes:

## **Manual testing steps**

1. Load 13.3
2. Update to 13.4
3. Should see new avatarType

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Deep-merges default state (including `preferences`) in
`PreferencesController` to preserve new keys like `avatarType`, with new
tests and updated state snapshot schemas.
> 
> - **Controller**:
> - Deep-merge defaults in `PreferencesController` constructor,
including nested `preferences`, to avoid overwriting new fields (e.g.,
`preferences.avatarType`).
> - **Tests**:
> - Add unit tests validating default `preferences.avatarType`
(`maskicon`) and preservation when provided (`jazzicon`).
> - **E2E/State Snapshots**:
> - Extend snapshot schemas to include new `preferences` fields:
`dismissSmartAccountSuggestionEnabled`, `featureNotificationsEnabled`,
`petnamesEnabled`, `privacyMode`, `skipDeepLinkInterstitial`,
`useNativeCurrencyAsPrimaryCurrency`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
6c5a696. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## **Description**

This PR adds JSDoc deprecation notices to component library components
that can be replaced by equivalent components from
`@metamask/design-system-react`. This encourages developers to migrate
to the new design system components and helps identify legacy code that
needs updating.

The following components now have deprecation notices:
- **Core Components:** Box, Icon, Text, Checkbox
- **Avatar Components:** AvatarBase, AvatarFavicon, AvatarIcon,
AvatarNetwork, AvatarToken
- **Button Components:** Button, ButtonBase, ButtonIcon, ButtonPrimary,
ButtonSecondary, ButtonLink
- **Other Components:** BadgeWrapper

Each deprecation notice follows the format:
```javascript
/**
 * @deprecated Please update your code to use `ComponentName` from `@metamask/design-system-react`
 */
```

## **Changelog**

CHANGELOG entry: null

## **Related issues**

This change supports the ongoing migration to the new design system by
making deprecated components more discoverable.

## **Manual testing steps**

1. Open any component file in `ui/components/component-library/` that
has been updated
2. Verify the JSDoc deprecation notice appears above the component
export
3. Check that IDEs and linters display deprecation warnings when using
these components
4. Confirm the deprecation message points to the correct replacement
component from `@metamask/design-system-react`

## **Screenshots/Recordings**

Not applicable - this change only adds JSDoc comments.

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds JSDoc @deprecated notices across component-library components,
pointing to replacements in @metamask/design-system-react.
> 
> - **Deprecation JSDoc added** (recommending
`@metamask/design-system-react` replacements):
> - *Avatars*: `AvatarBase`, `AvatarFavicon`, `AvatarIcon`,
`AvatarNetwork`, `AvatarToken`
> - *Buttons*: `Button`, `ButtonBase`, `ButtonIcon`, `ButtonPrimary`
(use `Button` with `ButtonVariant.Primary`), `ButtonSecondary` (use
`Button` with `ButtonVariant.Secondary`), `ButtonLink` (use
`TextButton`)
>   - *Core*: `Icon`, `Text`, `Checkbox`
>   - *Other*: `BadgeWrapper`
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
caf129c. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## **Description**

Remove the deprecated `IconColor.iconAlternativeSoft` color and replace
all usage with `IconColor.iconAlternative`. This addresses part of the
technical debt cleanup by removing another deprecated color that was
incorrectly added to the extension.

The changes include:
- Removing `iconAlternativeSoft = 'icon-alternative-soft'` from the
IconColor enum
- Replacing all component usage of `IconColor.iconAlternativeSoft` with
`IconColor.iconAlternative`
- Updating test snapshots to reflect the CSS class changes from
`mm-box--color-icon-alternative-soft` to
`mm-box--color-icon-alternative`

**Note:** This PR addresses only the `icon-alternative-soft` token.
Other deprecated tokens (`background-alternative-soft`,
`text-alternative-soft`) in `ui/pages/bridge/index.scss` still need to
be addressed in follow-up work.

## **Changelog**

CHANGELOG entry: null

## **Related issues**

Partly fixes:
#30144

## **Manual testing steps**

1. Verify all bridge components render correctly with proper icon colors
2. Check tooltip components display icons with appropriate styling 
3. Confirm gas fee modal icons appear as expected
4. Ensure settings page icons styling is unchanged visually

## **Screenshots/Recordings**

Not applicable - this is a technical debt cleanup with no visual changes
expected.

## **Pre-merge author checklist**

- [x] I've followed MetaMask Contributor Docs and MetaMask Extension
Coding Standards
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using JSDoc format if applicable
- [x] I've applied the right labels on the PR (see labeling guidelines).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Removes the deprecated `iconAlternativeSoft` token and CSS, updating
components to use `iconAlternative`.
> 
> - **Design System**:
> - Remove `IconColor.iconAlternativeSoft` from
`ui/helpers/constants/design-system.ts`.
> - **UI Components**:
> - Update `gas-fee-token-modal.tsx` and `transaction-shield.tsx` to use
`IconColor.iconAlternative` instead of `iconAlternativeSoft`.
> - **Styles**:
> - In `ui/pages/bridge/index.scss`, remove
`--color-icon-alternative-soft` variables and
`.mm-box--color-icon-alternative-soft` class.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
682c3f1. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

This PR imports [these
changes](MetaMask/github-tools#134) from
gihub-tools repo.

The list of sign off teams posted on the release PR was legacy and is
now removed.

Instead we now initialize the list with the appropriate platform teams
and the list will be completed dynamically by [another
automation](MetaMask/metamask-zaps#86), based on
the [content of the
release](https://docs.google.com/spreadsheets/d/1tsoodlAlyvEUpkkcNcbZ4PM9HuC9cEM80RZeoVv5OCQ/edit?gid=976491905#gid=976491905).

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36555?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: none

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Updates the `create-release-pr` workflow to use a newer pinned commit
of `MetaMask/github-tools` and aligns `github-tools-version`
accordingly.
> 
> - **CI**:
> - Update `.github/workflows/create-release-pr.yml` to pin
`MetaMask/github-tools/.github/workflows/create-release-pr.yml` to
`76945f3...` and set `github-tools-version` to the same commit.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
6524916. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

In this PR, changes based on the Design team’s review have been
implemented. These include updating the PIN Extension text padding and
modifying the header for the "Review and Confirm SRP" screen accessed
through settings during the backup process.

Jira Link: https://consensyssoftware.atlassian.net/browse/SL-208

Figma Link:
figma.com/design/pViOUcmjwhEzFsdrwknpNc/Onboarding?t=MQyF5o6A0WsOzeH9-0

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36523?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:  Design team’s review have been implemented.

## **Related issues**

Fixes:

## **Manual testing steps**

1. Open the extension.  
2. Create a wallet using SRP.  
3. Skip the backup process and continue with metametrics.  
4. Navigate to the "Wallet Ready" page and validate the PIN extension UI
against the Figma design.
5. Navigate to the home page.  
6. Go to **Settings > Security and Settings > Do Backup**.  
7. Check the updated header and validate it against the Figma design.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->



https://github.com/user-attachments/assets/4fa369df-9f3b-43af-8baf-9a54b98e3eaf

<img width="409" height="141" alt="Screenshot 2025-10-02 at 4 12 42 PM"
src="https://github.com/user-attachments/assets/e5882313-5a2c-438e-9802-552ffd40ecc4"
/>
<img width="1725" height="983" alt="Screenshot 2025-10-02 at 4 14 18 PM"
src="https://github.com/user-attachments/assets/45b037d9-57a5-4b97-b376-3d230bfee74a"
/>


## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Tweaks onboarding banner typography/padding, updates SRP
review/confirm titles for settings flow with new i18n keys, and changes
password help text color.
> 
> - **Onboarding UI**:
> - **Banner Tip**: Switch `titleProps.variant` to `bodyMdMedium` and
add right padding to description text in `onboarding-app-header.js`
(snapshot updates).
> - **Recovery Phrase (SRP) flow**:
> - **Titles (Settings flow)**: Use `confirmRecoveryPhraseTitleSettings`
and `seedPhraseReviewTitleSettings` keys for headers in
`confirm-recovery-phrase.js` and `review-recovery-phrase.js` (snapshots
reflect "Save Secret Recovery Phrase").
> - **i18n**:
> - Add `confirmRecoveryPhraseTitleSettings` and
`seedPhraseReviewTitleSettings` in `app/_locales/en*/messages.json`.
> - **Password form**:
> - Change help text color from `textMuted` to `textAlternative` in
`password-form.tsx` (snapshot updates).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
4349cfe. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

Add shield id to priority customer support url

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36495?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

1. After subscribed to shield
2. Go to settings menu
3. Click on support with priority label
4. You should be taken to customer support with the shield_id in url
param

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Include Shield customer ID in the support link when contacting
support; update tests and error page setup accordingly.
> 
> - **Support consent modal
(`ui/components/.../visit-support-data-consent-modal.tsx`)**:
> - Append `shield_id` (from `useUserSubscriptions()` → `customerId`) to
support URL query params.
> - Pass `shieldCustomerId` through click handler and tracking payload
URL.
> - **Tests**:
> - Update `visit-support-data.test.tsx` to mock `getUserSubscriptions`,
expect `shield_id` in URL, and handle undefined customer ID case.
> - Adjust `error-component.test.tsx` to configure mock store and mock
`getUserSubscriptions`; verify "Contact Support" opens the consent
modal.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
d47a17c. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

- Correct available token amount for shield subscription
- Don't show billing portal in shield settings if status provisional

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36494?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: show correct available token amount in shield
subscription plan

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to shield plan screen
2. only token with enough balance should show up

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Fix token approval/balance checks for Shield subscriptions and hide
billing history when subscription is provisional.
> 
> - **Shield Subscription token availability
(`ui/hooks/subscription/useSubscriptionPricing.ts`)**:
> - Skip tokens without `balance`; scale balance (stablecoin precision)
and require balance ≥ `approveAmount` before listing as available.
> - Use `amount.approveAmount` for `approvalAmount` and set correct
`AssetType`.
> - **Settings UI
(`ui/pages/settings/transaction-shield-tab/transaction-shield.tsx`)**:
> - Show “View billing history” button only when
`shieldSubscription.status` is not `provisional`.
> - **Store API types (`ui/store/actions.ts`)**:
> - Update `getSubscriptionCryptoApprovalAmount` return type to
`GetCryptoApproveTransactionResponse` and import it.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
8cf4d36. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
…ss (#36602)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

Fix in error message displayed while sending tokens to a contract
address

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes: #36462

## **Manual testing steps**

1. Send token to a contract address
2. Check the error displayed

## **Screenshots/Recordings**
TODO

## **Pre-merge author checklist**

- [X] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Return `tokenContractError` for token contract recipients, add i18n
strings, and update tests accordingly.
> 
> - **Validations**:
> - Update `validateEvmHexAddress` in
`ui/pages/confirmations/utils/sendValidations.ts` to return
`tokenContractError` when the recipient is a token contract (based on
`getTokenStandardAndDetailsByChain`).
> - Adjust unit test in
`ui/pages/confirmations/utils/sendValidations.test.ts` to expect
`tokenContractError`.
> - **i18n**:
> - Add `tokenContractError` message to `app/_locales/en/messages.json`
and `app/_locales/en_GB/messages.json` with a clear warning about
sending tokens to token contract addresses.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
39c2fdc. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
…6599)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The spec fails intermittently as we wait for the scope balance to be
different after `eth_SendTransaction`, but it's not.
We should wait for the dialog to close, before we perform the next
action/assertion, otherwise the previous action might not be fully
completed, leading to race conditions.

- Example of a failure:
https://github.com/MetaMask/metamask-extension/actions/runs/18234516437/job/51927383467

<img width="2306" height="466" alt="image"
src="https://github.com/user-attachments/assets/3cdb19d6-4e1d-4324-a6d8-584a41f8adf1"
/>


[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36599?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes:

## **Manual testing steps**

1. Check ci

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
…transaction Successfully speeds up a pending transaction` (#36601)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
This test is flaky because the following happens:
1. We confirm a transaction
2. We go to the activity list, while this transaction is pending
3. We click on the pending transaction, to open the transaction details
modal
4. We then click Speed up
5. And we confirm the modal

The problem is that in step 3, when we click on the pending tx, if that
tx updates after we click, the component is re-rendered and the tx
details modal is closed. Then we cannot find the speed up id button (the
one from the modal, not the one from the tx item - note they have 2
different ids: `speedup-button` and `speed-up-button`.

To fix this, instead of trying to open the tx details and then speed up,
we wait until the speed up button appears in the component (so no more
re-renders happen) and click on it.

Example of failure:
https://github.com/MetaMask/metamask-extension/actions/runs/18270673628/job/52012969962

<img width="1152" height="785" alt="image"
src="https://github.com/user-attachments/assets/e3d6329c-8e56-4a58-b4d9-20c7a6f56714"
/>

<img width="1818" height="1180" alt="image"
src="https://github.com/user-attachments/assets/62f34cfe-359c-47c6-93da-647d2d62e1dd"
/>



[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36601?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
7. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes:

## **Manual testing steps**

1. Check ci

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Fixes flakiness in the speed-up transaction test by waiting for the
inline speed-up button and using distinct selectors for inline vs modal
actions.
> 
> - **E2E Tests**:
> - In
`test/e2e/tests/confirmations/transactions/speed-up-and-cancel-confirmations.spec.ts`,
wait for inline `speed-up` availability via
`checkSpeedUpInlineButtonIsPresent()` before opening item and confirming
speed-up.
> - **Page Objects**:
>   - In `test/e2e/page-objects/pages/home/activity-list.ts`:
> - Split speed-up selectors: add `speedupInlineButton`
(`[data-testid="speed-up-button"]`) and `speedupModalButton`
(`[data-testid="speedup-button"]`).
>     - Add `checkSpeedUpInlineButtonIsPresent()` helper.
>     - Update `clickSpeedUpTransaction()` to use `speedupModalButton`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
93d103a. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

The PR is changing hook `useRedesignedSendFlow` in mainly 2 ways:
1. make check for redesigned send flag a kill switch
2. remove dependency on bip-44 flag

PR also remove send redesign flag check from route to send component.

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
4. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes: #36310

## **Manual testing steps**

1. Download build from PR and install extension
2. Trigger send in full page view
4. It should open in new designs

## **Screenshots/Recordings**
TODO

## **Pre-merge author checklist**

- [X] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Makes `sendRedesign` a kill switch (default on unless explicitly
disabled) and moves legacy vs redesigned send flow selection inside the
Send page, updating tests and mocks accordingly.
> 
> - **Send Flow**:
> - Convert `useRedesignedSendFlow` to a kill switch: enabled unless
`remoteFeatureFlags.sendRedesign.enabled === false`; remove dependency
on multichain accounts and env overrides.
> - Centralize routing: `routes.component` always mounts
`../confirmations/send`; the Send page now internally selects redesigned
(`SendInner`) vs legacy (`components/multichain/pages/send`) based on
the flag.
> - **Tests & Mocks**:
> - Update unit tests for `useRedesignedSendFlow` to reflect new logic
(undefined/null ⇒ enabled).
> - Adjust NFT send navigation to new route
`'/send/amount-recipient?asset=...&chainId=0x1'`.
> - Add `sendRedesign: { enabled: false }` to remote feature flag mocks
and state snapshots; consolidate related E2E mocks.
> - Temporarily skip a few flaky E2E tests (annotated with issue links).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
848aae7. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

Seemingly `sharp` is as efficient at optimizing GIFs as `imagemin` and
doesn't have the same install-script problems on some systems that
`gifsicle` brings. This PR proposes to use `sharp` for optimizing all
images.

Needs a sanity check.

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36563?quickstart=1)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Replaces imagemin/gifsicle with sharp for image optimization and
cleans up dependencies, lockfile, and LavaMoat policies accordingly.
> 
> - **Scripts**:
> - Update `development/optimize-media.mts` to use `sharp` for all
formats (including GIF); remove `imagemin`/`imagemin-gifsicle` logic.
> - **Dependencies**:
> - Remove `imagemin`, `imagemin-gifsicle`, and related `@types` from
`package.json` and `.depcheckrc.yml`.
> - Adjust Yarn "enableScripts"/allowlist (remove
`imagemin-gifsicle>gifsicle`).
>   - Prune transitive packages in `yarn.lock`.
> - **Security/Policies**:
> - Update LavaMoat policies (`lavamoat/*/policy.json`) to point
`is-plain-obj` to `mocha>yargs-unparser>is-plain-obj` under
`react-markdown>unified`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
3b269ee. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: MetaMask Bot <[email protected]>
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

See changelog

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36434?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixed a bug where first permitting accounts via the EVM
provider would cause all requests to the Solana Wallet Standard provider
to fail with an `The requested account and/or method has not been
authorized by the user.` error until the user fully revoked dapp
permissions and then permitted accounts using the Solana Wallet Standard
provider first.

## **Related issues**

See: MetaMask/core#6703

## **Manual testing steps**


1. Go to https://metamask.github.io/test-dapp-solana/staging/
(disconnect all accounts from this dapp first)
2. In console, `window.ethereum.request({method: eth_requestAccounts'})`
3. Grant accounts and chains, including Solana accounts and chains
4. You should be connected in the Solana test dapp now
5. Make a sign request
6. It should work without error

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**



https://github.com/user-attachments/assets/735a0daf-6740-49b7-9061-e7488d2057c8



### **After**




https://github.com/user-attachments/assets/db85b885-2784-422f-a6bc-8adc662da53b



## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Bumps `@metamask/multichain-api-middleware` to `1.2.0` and adds an e2e
test verifying `wallet_invokeMethod` works after granting permissions
via EIP-1193.
> 
> - **Dependencies**:
> - Bump `@metamask/multichain-api-middleware` from `1.1.0` to `1.2.0`
(lockfile updated; transitive `@metamask/utils` to `^11.8.1`).
> - **Tests (e2e)**:
> - Add test in
`test/e2e/flask/multichain-api/evm/wallet_invokeMethod.spec.ts` to
validate `wallet_invokeMethod` after `eth_requestAccounts` permission
via EIP-1193, checking `eth_getBalance` on scope `eip155:1337`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
13102b3. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

This bumps Snaps packages to the latest version. Notable changes
include:

- Reduce JSON validation during state updates
- Move JSON-RPC request inspection outside of the executor
- Simplify JSON-RPC failure validation
- Properly roll back `initialConnections`
- Display a warning instead of an error when Snaps fail to terminate

Generally this should help with ongoing performance regressions when
using Solana.
[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36613?quickstart=1)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Updates Snaps-related dependencies, switches iframe execution
environment to 10.2.2, removes an unused feature flag, adjusts LavaMoat
policies, and swaps blocked-snap update for registry refresh.
> 
> - **Snaps dependencies**:
> - Bump `@metamask/snaps-sdk` to `^10.0.0`,
`@metamask/snaps-controllers` to `^15.0.1`,
`@metamask/snaps-execution-environments` to `^10.2.2`,
`@metamask/snaps-rpc-methods` to `^13.5.2`, `@metamask/snaps-utils` to
`^11.6.0`; update transitive peers (e.g., `@metamask/providers@^22.1.1`,
`@metamask/slip44@^4.3.0`).
> - **Build/config**:
> - Update `IFRAME_EXECUTION_ENVIRONMENT_URL` to
`https://execution.metamask.io/iframe/10.2.2/index.html` in
`builds.yml`.
> - LavaMoat policies (browserify/webpack): allow
`@metamask/approval-controller`; add `TextEncoder` global for
`@metamask/snaps-utils`.
> - **Background behavior**:
> - Replace `controller.snapController.updateBlockedSnaps()` with
`controller.snapController.updateRegistry()` in
`app/scripts/background.js`.
> - **Controller init**:
> - Remove `useCaip25Permission` feature flag from
`snap-controller-init.ts` and its test.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
de1efa4. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: MetaMask Bot <[email protected]>
…support dynamic (#36587)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

This PR fixes an issue where the `accountsApiChainIds` parameter was
being initialized with stale/empty values from the remote feature flag
controller during controller initialization. The problem occurred
because the remote feature flag controller wasn't fully initialized when
the account tracker and token balances controllers were being set up.

**Changes made:**
1. **Converted `accountsApiChainIds` from static array to function**:
Changed the parameter from a static array to a function that dynamically
retrieves the current feature flag values from
`RemoteFeatureFlagController:getState()`.
2. **Updated both controllers**: Applied this change to both
`AccountTrackerController` and `TokenBalancesController` initialization.
3. **Updated controller implementations**: Modified the controllers to
call the function instead of accessing a static array.
4. **Updated tests**: Fixed all test cases to use the new function-based
approach.
5. **Updated patch file**: Applied corresponding changes to the
`@metamask/assets-controllers` patch to support the new function-based
approach.

**Why this change was needed:**
- The remote feature flag controller loads feature flags asynchronously
- During controller initialization, the feature flags might not be
available yet
- This resulted in empty arrays being passed to controllers, preventing
them from using the Account API for balance fetching
- By making it a function, the controllers can now get fresh feature
flag values each time they need to check which chains are supported

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36587?quickstart=1)

## **Changelog**

CHANGELOG entry: Fixed account API chain ID configuration to use dynamic
feature flag values instead of stale initialization values

## **Related issues**

Fixes: #36595 

## **Manual testing steps**

1. Start MetaMask extension with remote feature flags enabled
2. Navigate to the accounts page and verify that balances are loading
correctly
3. Check the network tab to confirm that Account API requests are being
made for supported chains
4. Verify that the feature flag `assetsAccountApiBalances` is being read
dynamically
5. Test with different network configurations to ensure the Account API
is used when the feature flag supports those chains

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->
- Account API requests were not being made due to empty chain ID
configuration
- Controllers were initialized with stale/empty feature flag values

### **After**

<!-- [screenshots/recordings] -->
- Account API requests are now properly made for supported chains
- Controllers dynamically retrieve current feature flag values

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Switch controllers to use a dynamic `accountsApiChainIds()` getter
(from `RemoteFeatureFlagController`) instead of static arrays, update
tests, and bump assets/bridge deps.
> 
> - **Controllers**:
> - `AccountTrackerControllerInit` and `TokenBalancesControllerInit`:
replace static `useAccountApiBalances` config with
`accountsApiChainIds()` function that reads
`remoteFeatureFlags.assetsAccountApiBalances` at call time.
> - `AccountTrackerController`: accept `accountsApiChainIds` func,
update internal checks to use it for feature-flagged Accounts API usage
across single/multichain paths.
> - **Tests**:
> - Update all controller init and controller tests to use the new
`accountsApiChainIds` function and expect dynamic behavior.
> - **Dependencies**:
> - Bump `@metamask/assets-controllers` to `78.0.0` and
`@metamask/bridge(-status)-controller` to `48.0.0`; update lockfile.
> - **UI**:
> - Minor cleanup in `ui/ducks/bridge/selectors.ts` (remove
ts-expect-error, rely on validated `bip44DefaultPairs`).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
e439309. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: MetaMask Bot <[email protected]>
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

Prevents passing an incorrectly balance field to eth-token-tracker.

EVM assets from the basic selector do not have a `balance` field, but
solana assets do, and it's a stringified decimal.

When that value is passed down to the `eth-token-tracker` library, which
has no types (footgun), it throws when trying to convert that value, so
we've changed the code to avoid passing it.

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36612?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixed a bug in which an error appeared when opening
solana tokens

## **Related issues**

Fixes: #36603

## **Manual testing steps**

1. Go to the home wallet page with an account that has Solana tokens
(not native assets)
2. Open asset details

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->
<img width="969" height="594" alt="image"
src="https://github.com/user-attachments/assets/39c67484-6fdc-450b-b8f5-7162f5489388"
/>


### **After**

<!-- [screenshots/recordings] -->
<img width="687" height="945" alt="image"
src="https://github.com/user-attachments/assets/383b3221-027b-4473-8a32-c6a25c737065"
/>


## **Pre-merge author checklist**

- [X] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
## **Description**

This PR expands on the gator permissions revocation feature. Introduces
the following:
- Provided implementation for the  gator permissions `TokenTransferPage`
- All UI changes are behind the `GATOR_PERMISSIONS_REVOCATION_ENABLED`
feature flag.
- Placeholder for gator `ReviewGatorPermissionsPage` to be implemented
fully #35845

## **Related issues**

is dependent on: #35219

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**


https://github.com/user-attachments/assets/42c541f5-8024-4be1-9c27-22d9c30600a6


### **After**


https://github.com/user-attachments/assets/07cbf0f2-e679-44f3-b6c0-761f4532c204

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.



<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Introduces the Gator Token Transfer page listing per-network
token-permission counts, a review page/route, supporting
selectors/helpers, i18n strings, and tests.
> 
> - **UI (Gator Permissions)**:
> - **Token Transfer Page**: Renders per-network permission counts using
`PermissionGroupListItem`; navigates to
`REVIEW_GATOR_PERMISSIONS_ROUTE/:chainId/:permissionGroupName`; shows
empty state when none.
> - **New Components/Helpers**: `PermissionGroupListItem`,
`extractNetworkName` (with graceful fallback); placeholder
`ReviewGatorPermissionsPage`.
> - **Routing**: Adds `REVIEW_GATOR_PERMISSIONS_ROUTE` and authenticated
route; updates header-visibility logic.
> - **Selectors**:
> - Adds `getPermissionGroupDetails` to aggregate counts per `chainId`
for `token-transfer`; comprehensive unit tests.
> - **i18n**:
> - Adds `tokenPermissionCount`/`tokenPermissionsCount` and
`unknownNetworkForGatorPermissions` strings (en, en_GB).
> - **Tests/Snapshots**:
> - New tests and snapshots for permission list item, token transfer
page, review page, and helper.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
6eaa99d. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Tadej Vengust <[email protected]>
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

While trying to add release-pr-approval to required status checks, I
noticed the release-pr-approval job is currently called `check` which is
not accurately describing what the job is doing. This PR renames it to
`release-pr-approval`.

Similar problem as this
[PR](#36028).

[Same PR for Mobile
repo](MetaMask/metamask-mobile#20856)

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36624?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Renames the GitHub Actions job in
`.github/workflows/release-pr-approval.yml` from `check` to
`release-pr-approval`.
> 
> - **CI/Workflows**:
> - **Release PR Approval workflow**
(`.github/workflows/release-pr-approval.yml`):
>     - Rename job `jobs.check` to `jobs.release-pr-approval`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
cd3df91. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
…ct decimals (#36580)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

Corrects the mUSD decimal value from 18 -> 6 in the default common token
pair constants file. The incorrect decimal was causing erroneous quotes
when the fromToken <-> toToken switch was flipped.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36580?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: fixed a bug that was causing incorrect quotes for mUSD
to be displayed.

## **Related issues**

Fixes: #36581

## **Manual testing steps**

1. Go to ethereum or linea swaps
2. prefill a quote from eth -> mUSD
3. flip the tokens and observe a normal quote

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Updates mUSD decimals from 18 to 6 for mainnet and Linea bridge
defaults and aligns selector test expectations.
> 
> - **Bridge constants**:
> - Update `BRIDGE_CHAINID_COMMON_TOKEN_PAIR` mUSD `decimals` to `6` for
`eip155:1` (mainnet) and `eip155:59144` (Linea) in
`shared/constants/bridge.ts`.
> - **Tests**:
> - Align `getToToken` default mUSD `decimals` expectation to `6` in
`ui/ducks/bridge/selectors.test.ts`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
6bbd62c. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: SteP-n-s <[email protected]>
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36628?quickstart=1)

Should make the lavamoat policy generation less flaky on CI

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes: #36600

## **Manual testing steps**

1. CI shouldn't flake

## **Screenshots/Recordings**

Not applicable

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Upgrade lavamoat-core to 16.7.1 with a patch to skip writing the
merged policy, and align Lavamoat policy and lockfile.
> 
> - **Build/Lavamoat**:
> - **lavamoat-core**: Replace patch for `^16.2.2` with patched
`16.7.1`; map `^15.2.1` and `^16.7.1` to `16.7.1` in `package.json`.
> - **Patch changes**: Keep `src/loadPolicy.js` behavior to skip writing
`policy.json` after merge; remove prior patch file for `16.2.2`.
> - **Policy**: Update `lavamoat/build-system/policy.json` to allow
`node:fs/promises` for `lavamoat>lavamoat-core` (replaces
`node:fs/promises.writeFile`).
> - **Lockfile**: Refresh `yarn.lock` to reflect `[email protected]`
and related dependency adjustments.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
3148218. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
…36541)

## **Description**

Remove the deprecated `BackgroundColor.backgroundAlternativeSoft` design
token and replace all usage with
`BackgroundColor.backgroundAlternative`. This addresses part of the
technical debt cleanup by removing the final deprecated design token
that was incorrectly added to the design system.

The changes include:
- Removing `backgroundAlternativeSoft = 'background-alternative-soft'`
from the BackgroundColor enum
- Replacing all component usage of
`BackgroundColor.backgroundAlternativeSoft` with
`BackgroundColor.backgroundAlternative`
- Removing associated CSS custom properties and classes for
`background-alternative-soft`
- Updating test snapshots to reflect the CSS class changes from
`mm-box--background-color-background-alternative-soft` to
`mm-box--background-color-background-alternative`

**Note:** This PR completes the cleanup of deprecated alternative-soft
tokens. Previous PRs addressed `textAlternativeSoft` and
`iconAlternativeSoft`.

## **Changelog**

CHANGELOG entry: null

## **Related issues**

Fixes: #30144

## **Manual testing steps**

1. Verify all bridge components render correctly with proper background
colors
2. Check prepare bridge page displays backgrounds with appropriate
styling
3. Confirm switch tokens button background appears as expected
4. Ensure overall bridge page styling is unchanged visually

## **Screenshots/Recordings**

Not applicable - this is a technical debt cleanup with no visual changes
expected.

## **Pre-merge author checklist**

- [x] I've followed MetaMask Contributor Docs and MetaMask Extension
Coding Standards
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [ ] I've documented my code using JSDoc format if applicable
- [ ] I've applied the right labels on the PR (see labeling guidelines).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Removes `BackgroundColor.backgroundAlternativeSoft` and deletes
related `background-alternative-soft` CSS vars/classes from bridge
styles.
> 
> - **Design System**:
> - Remove `BackgroundColor.backgroundAlternativeSoft` from
`ui/helpers/constants/design-system.ts`.
> - **Bridge Styles** (`ui/pages/bridge/index.scss`):
> - Delete theme-specific CSS variables for
`--color-background-alternative-soft` (light/dark).
> - Remove `.mm-box--background-color-background-alternative-soft` rule.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
82cfbb0. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## **Description**

This PR updates carousel component to improve spacing and layout by
updating the margin bottom from `8px` to `12px`

## **Changelog**

CHANGELOG entry: null

## **Related issues**

Fixes: N/A (UI improvement)

## **Manual testing steps**

1. Go to home page with carousel slides
2. Verify the carousel now has 12px margin bottom
## **Screenshots/Recordings**

### **Before**
- Carousel had 8px margin

<img width="418" height="622" alt="Screenshot 2025-10-03 at 2 52 53 PM"
src="https://github.com/user-attachments/assets/343574e7-807e-41bb-90e0-e55593b2e739"
/>
<img width="1512" height="863" alt="Screenshot 2025-10-03 at 2 53 09 PM"
src="https://github.com/user-attachments/assets/ce83cb90-da2e-4e8c-8c93-78a2a832a3bd"
/>

### **After**  
- Carousel has 12px margin for better spacing
- Same visual result but using Tailwind classes for better
maintainability

<img width="414" height="612" alt="Screenshot 2025-10-03 at 2 51 38 PM"
src="https://github.com/user-attachments/assets/f9827fdf-0a0e-4ef3-baa4-0ba81e1e2eb8"
/>
<img width="1512" height="864" alt="Screenshot 2025-10-03 at 2 52 01 PM"
src="https://github.com/user-attachments/assets/856efaf4-8634-413c-b350-120f4d2cdeb3"
/>


## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

🤖 Generated with [Claude Code](https://claude.com/claude-code)



<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Removes SCSS padding/margin from `carousel-container` and applies
`px-4` and `mb-3` (12px) spacing directly on `CarouselWithEmptyState`.
> 
> - **UI**
> -
`ui/components/multichain/account-overview/account-overview-layout.tsx`
> - Adds `className="mb-3 px-4"` to `CarouselWithEmptyState` to control
spacing via utility classes.
> - **Styles**
>   - `ui/components/multichain/carousel/index.scss`
> - Removes `padding: 0 16px` and `margin-bottom: 8px` from
`.carousel-container` (spacing now handled by component props).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
e1cc3f1. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Refreshes translations across multiple locales, adding new keys
(multichain/smart account/UI texts), removing obsolete strings, and
tweaking a few labels.
> 
> - **i18n/Localization**:
> - Adds translations for new UI and feature strings (e.g.,
`multichain*`, `smartAccount*`, `unlockToReveal`, `privateKeys`,
`setUp`, `sites`, `searchYourAccounts`, `clearFilters`, network tab
labels, bridge/tooltips, push notification titles, CSS loading
messages).
> - Removes/deprecates various obsolete keys (e.g., address trust
signals, certain bridge warnings, Linea mainnet connect, import success,
password length, rate includes fee, name warning titles, etc.).
> - Minor label tweaks in specific locales (e.g., “buy” label,
phrasing/typos) and new loading/state texts.
> - Coverage spans many locales (de, el, es, fr, hi, id, ja, ko, pt, ru,
tl, tr, vi, zh_CN).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
4400e90. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: metamaskbot <[email protected]>
OGPoyraz and others added 15 commits October 16, 2025 09:13
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

This PR aims to centralise seed account icon map in a hook and use it in
send flow.

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36877?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes: #36657

## **Manual testing steps**

Account icon should be consistent as other parts of the wallet.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**



https://github.com/user-attachments/assets/466421d4-e7bc-4a35-98e9-236c7d85d558



## **Pre-merge author checklist**

- [X] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Introduces a hook to map account addresses to seed-icon addresses and
integrates it across send flow to render consistent avatars, updating
recipient types and tests.
> 
> - **Hooks**:
> - Add `useAccountAddressSeedIconMap` to build a map of account
addresses -> seed icon address from account groups.
> - Use in `useAccountRecipients` and `useContactRecipients` to attach
`seedIcon` to each `Recipient`.
> - **Components**:
> - `Recipient`: pass `recipient.seedIcon ?? address` to
`PreferredAvatar`.
> - `RecipientInput`: compute avatar seed address from the map and use
it in `PreferredAvatar` when a recipient is resolved.
> - **Types**:
>   - Extend `Recipient` with optional `seedIcon`.
> - **Tests**:
>   - Add tests for `useAccountAddressSeedIconMap`.
> - Update/mocks in `recipient-input.test.tsx`, `recipient.test.tsx`,
`useAccountRecipients.test.ts`, and `useContactRecipients.test.ts` to
account for the new hook and `seedIcon`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
596eb60. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36914?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds 13.4.3 changelog entry (path-based URL blocking) and updates
Unreleased/13.4.3 compare links.
> 
> - **Documentation**:
>   - **CHANGELOG** (`CHANGELOG.md`):
> - Add `13.4.3` with Fixed: path-based URL blocking for URLs (#36634).
> - Update compare links: `[Unreleased]` now `v13.4.3...HEAD` and add
`[13.4.3]` link.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
782e9ce. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: runway-github[bot] <73448015+runway-github[bot]@users.noreply.github.com>
Co-authored-by: imblue <[email protected]>
Co-authored-by: imblue-dabadee <[email protected]>
Co-authored-by: MetaMask Bot <[email protected]>
Co-authored-by: Jongsun Suh <[email protected]>
Co-authored-by: Pavel Dvorkin <[email protected]>
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

- Added a shared #normalizeCallData helper in Delegation7702PublishHook
so we always feed canonical 0x calldata into both the caveat builder and
execution encoder, preventing stray zero bytes from drifting into caveat
terms.
- Updated exactExecutionBuilder to reuse encodeSingleExecution so the
stored caveat terms are guaranteed to match the execution payload, and
relaxed validation so empty calldata is treated as 0x instead of 0x0.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36902?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Normalizes calldata and keeps caveat terms byte-identical to
execution, while sending sponsored transactions through the delegation
publish hook.
> 
> - **EIP-7702 Delegation flow**:
> - Add `#normalizeCallData` to canonicalize `txParams.data` (lowercase,
`0x`-prefixed, even-length) and use it in `#buildExecutions` and
`#buildCaveats`.
> - Route when to use delegation: include
`transactionMeta.isGasFeeSponsored` in the non-smart/non-send-bundle
condition in `publishHook`.
> - **Caveats/encoding**:
> - `exactExecutionBuilder`: reuse `encodeSingleExecution` so `terms`
match the execution payload; relax data validation to accept empty
calldata as `0x` (not `0x0`).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1403824. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

Show skeleton loader when loading status for Shield Coverage


https://www.figma.com/design/HTAO1SrmixV4ppv7qIvLoa/Metamask-Transaction-Shield?node-id=12570-88009&t=mNinFtkACmFpqbjG-4

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36888?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Show skeleton loader when loading status for Shield
Coverage

## **Related issues**

Fixes:

## **Manual testing steps**

1. Login/Create to an account with Shield subscription
2. Open `https://metamask.github.io/test-dapp/` and Connect
3. Run a `Malicious ETH Transfer`
4. Observe the Transaction Shield coverage status just above the footer

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

https://github.com/user-attachments/assets/fc7c2a51-c027-44bf-8d91-72d4b5e2a078


<!-- [screenshots/recordings] -->

### **After**

https://github.com/user-attachments/assets/2c3faa8b-15ee-4384-b8be-ea47ca96b43d


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds a skeleton loader for the Shield coverage indicator and makes
subscription hooks refetchable, updating settings and plan pages to
always fetch latest data.
> 
> - **UI**
> - `ConfirmInfoAlertRow`: adds `showAlertLoader` prop and renders
`Skeleton` when alerts are not yet loaded; used in
`shield-footer-coverage-indicator`.
> - **Hooks**
> - `useUserSubscriptions`: accepts `{ refetch }`, fetches only when
signed-in and unlocked; uses `useAsyncResult`.
> - `useSubscriptionPricing`: accepts `{ refetch }`, switched to
`useAsyncResult` for loading/error state.
> - `useEnableShieldCoverageChecks`: simplified to derive from
`subscriptions` with `useMemo`.
> - **Pages**
> - Settings `transaction-shield` and `shield-plan`: call hooks with `{
refetch: true }` and show loaders accordingly.
> - **Tests**
> - Update expectation for `useSubscriptionPricing` error to be
`undefined`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9c9e421. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Nguyen Anh Tu <[email protected]>
Co-authored-by: Chaitanya Potti <[email protected]>
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36882?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: improve perceived performance after importing a new SRP

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/MUL-1161

## **Manual testing steps**

1. Onboard, add a new SRP
2. Verify that after clicking the import button, we directly come back
to the wallet home page
3. Verify that syncing & discovery happens after coming back to the home
page

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Make SRP import non-blocking by deferring sync/account discovery to
background and moving metrics there; update UI and tests accordingly.
> 
> - **Controller (metamask-controller.js)**:
> - Import SRP flow: wrap account-tree sync and multichain account
discovery in a fire-and-forget task (no await) to avoid blocking UI.
> - Move metrics tracking (`ImportSecretRecoveryPhraseCompleted` with
`hd_entropy_index`, discovered Solana/Bitcoin counts) to background
after discovery.
> - Change `importMnemonicToVault` return type to `Promise<void>` and
adjust JSDoc.
> - **UI (Import SRP page)**:
> - Stop awaiting discovery results/metrics; dispatch
`importMnemonicToVault` and immediately navigate; remove MetaMetrics
usage and HD keyrings-derived entropy index.
> - **Actions (store/actions.ts)**:
>   - Update `importMnemonicToVault` thunk to return `Promise<void>`.
> - **Tests**:
> - Await microtask (`setImmediate`) to let fire-and-forget work
complete; add mocks for `syncWithUserStorage`; update expectations to
reflect new async flow.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
8db4b81. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

Based on @chloeYue , the generate-rc-commits.js script was used to
manually generate the commit list for the release progress tracker in
old format. Now we have the new format and automation in place, so we
don't need it anymore and it can be deleted.


<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36814?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Removes the deprecated `development/generate-rc-commits.js` script.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f2ebb03. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

This PR adds network and native token logos for Plasma mainnet network.

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/35805?quickstart=1)

## **Changelog**
CHANGELOG entry: adds network logo and native token logo for Plasma
Mainnet network
<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->


## **Manual testing steps**

Open the extension
Manually add the network with these details:
-   Network Name: Plasma Mainnet
-   RPC URL: https://rpc.plasma.to
-   Chain ID: 9745
-   Currency Symbol: XPL

After saving, the network should be added to your MetaMask
The icons should show correctly

<img width="396" height="599" alt="Screenshot 2025-09-30 at 13 06 00"
src="https://github.com/user-attachments/assets/9a031ade-cdad-41f0-852f-5375f1c09361"
/>


## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->


## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds Plasma network support with chain ID 0x2611, display name, XPL
ticker, and network/native token icons, updating all related maps.
> 
> - **Assets**
>   - Add `./images/plasma.svg` and `./images/plasma-native.svg`.
> - **Network constants/mappings**
> - Add `CHAIN_IDS.PLASMA = '0x2611'` and `PLASMA_DISPLAY_NAME =
'Plasma'`.
> - Add `CURRENCY_SYMBOLS.PLASMA = 'XPL'` and map `CHAIN_IDS.PLASMA` to
`XPL` in currency maps.
> - Register Plasma images: `PLASMA_IMAGE_URL`,
`PLASMA_NATIVE_TOKEN_IMAGE_URL` and map to `CHAIN_IDS.PLASMA` in
network/token image maps.
> - Include Plasma in `NETWORK_TO_NAME_MAP` and
`CHAIN_ID_TO_CURRENCY_SYMBOL_MAP`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
2e455e5. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Vivek <[email protected]>
Co-authored-by: khanti42 <[email protected]>
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

Migration script from js file to ts file
Move script to POM
Reuse the function from POM

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36598?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Implement: https://consensyssoftware.atlassian.net/browse/MMQA-722

## **Manual testing steps**

N/A

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

N/A

### **Before**

<!-- [screenshots/recordings] -->

N/A

### **After**

<!-- [screenshots/recordings] -->

N/A

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Refactors simulation details E2E tests to use TransactionConfirmation
page object methods, adding locators and helpers for balance changes and
estimated statuses.
> 
> - **E2E Page Object
(`test/e2e/page-objects/pages/confirmations/redesign/transaction-confirmation.ts`)**:
> - Add selectors for `simulation-details-layout` and row targeting
(outgoing/incoming).
> - Add methods: `expectBalanceChange`,
`checkEstimatedSimulationDetails`,
`checkEstimatedSimulationDetailsNotDisplayed`.
> - **Tests
(`test/e2e/tests/simulation-details/simulation-details.spec.ts`)**:
> - Replace inline assertions and local `expectBalanceChange` helper
with `TransactionConfirmation` methods across scenarios (send ETH, buy
ERC20/721/1155, no changes, errors, unsupported chain).
>   - Update imports accordingly.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
21fa921. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
This PR fixes issue with the DaPP permissions icon showing wrong network
for Solana only DaPP.
<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixed a bug with the DaPP permissions icon showing
wrong network for Solana only DaPP

## **Related issues**

Fixes: #36825

## **Manual testing steps**

1. Navigate to SOL only dapp (Orca, Jupiter)
2. Connect to DaPP
3. Notice Badge icon

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
<img width="398" height="596" alt="Screenshot 2025-10-15 at 16 37 41"
src="https://github.com/user-attachments/assets/350edb96-5c1d-4904-8601-c1f04f1a5c8c"
/>

<!-- [screenshots/recordings] -->

### **After**
<img width="398" height="598" alt="Screenshot 2025-10-15 at 16 35 33"
src="https://github.com/user-attachments/assets/c212b838-246d-4bb3-8e96-99c4ddeadf88"
/>

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Refactors active network detection to be multichain-aware (EVM and
Solana) via a selector, updates the connected site popover to use it,
adds safeguards, and adjusts/extends tests and fixtures.
> 
> - **Selectors**:
> - `getDappActiveNetwork`: Derives active network from ordered
connected accounts; supports EVM and non‑EVM (Solana) via scopes;
returns `{ ...network, isEvm }`; uses
`getMultichainNetworkConfigurationsByChainId`.
> - Adds use of `getOrderedConnectedAccountsForActiveTab`; updates tests
for new logic.
> - `getMetaMaskAccountsOrdered`: Safeguards spreading when `address`
missing.
> - **UI**:
> - `ConnectedSitePopover`: Replaces manual domain-based lookup with
`getDappActiveNetwork`; removes `useMemo` and unused selectors.
> - **Tests**:
> - New/updated tests for selector (`ui/selectors/dapp.test.ts`)
covering EVM, Solana, and null paths.
> - Updates to popover/menu/routes tests to include required state
(`domains`, `selectedNetworkClientId`, `keyrings.metadata`,
`internalAccounts`, `permissionHistory`, multichain configs/accounts).
> - **Test data**:
> - Extend fixtures with additional accounts/addresses and keyring
metadata in `mock-send-state.json` and onboarding data.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
98c125e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## **Description**

PR to fix the ability to add the same token twice from search.

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36727?quickstart=1)

## **Changelog**

CHANGELOG entry: Fixed a bug that was causing the same token to be added
twice from search

## **Related issues**

Fixes: #36726

## **Manual testing steps**

1. Click on import tokens
2. Import any token from search
3. Notice the token is added successfully to list
4. Re-import the same token
5. The token should already be selected and you should not be able to
re-select it

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->


https://github.com/user-attachments/assets/0e4e0913-e5b8-4bca-8edf-9130c08a4db7

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Unifies token existence checks to always use `checkExistingAllTokens`
and removes `tokens` prop usage to prevent duplicate imports from
search.
> 
> - **Import Token UI** (`ui/components/app/import-token/token-list`):
> - **Duplicate Prevention Logic**: Always use
`checkExistingAllTokens(address, chainId, accountAddress, allTokens)` to
determine if a token is already added; remove `checkExistingAddresses`
path.
> - **Props Cleanup**: Remove `tokens` prop and related
destructuring/usage.
> - **Imports**: Drop `checkExistingAddresses` import; keep
`checkExistingAllTokens`.
> - **Behavior**: When filter matches current network, continue setting
`results[i].chainId = currentNetwork?.chainId`.
> - **Container** (`token-list.container.js`):
> - Stop mapping `state.metamask.tokens`; retain `allTokens` and
`accountAddress`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
8decdaa. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## **Description**

When selectors return empty arrays or objects using the `??` or `||`
operators, they create new instances every time the function is called
if the value is undefined/null. This breaks reference equality and
memoization and can cause excess re-renders.

## **Changelog**

CHANGELOG entry: chore: use stable empty references

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

```
useSelector(state => state.some.collection || []) // new array each time
```

### **After**
```
// stable instance
const EMPTY = []

useSelector(state => state.some.collection || EMPTY)
```
## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Replaces ad-hoc []/{} fallbacks with shared frozen constants across
selectors to stabilize memoization and references.
> 
> - **Selectors**:
>   - Alerts: `selectAlerts` now returns `EMPTY_ARRAY` fallback.
> - Assets: use `EMPTY_OBJECT` for `getMetamaskState` and in
balance-related selectors (account tree, rates, tokens, currency rates)
instead of `{}`; remove local `EMPTY_OBJ` in favor of shared constant.
>   - NFTs: default `allNftContracts`/`allNfts` to `EMPTY_OBJECT`.
> - General selectors: `selectNftsByChainId` and
`selectNonZeroUnusedApprovalsAllowList` now return `EMPTY_ARRAY` when
empty.
> - **Shared utils**:
> - Add `ui/selectors/shared.ts` exporting frozen `EMPTY_ARRAY` and
`EMPTY_OBJECT`; import and use where needed.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9272811. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## **Description**

Implements Bitcoin provider feature flag support using the
`addBitcoinAccount` remote feature flag. This allows the New Networks
team to control Bitcoin account availability at runtime without
requiring restarts.

**What is the reason for the change?**
We need a way to disable the Bitcoin provider via feature flag with the
same behavior as Basic Functionality, but with more granular control
over Bitcoin specifically.

**What is the improvement/solution?**
- Creates Bitcoin provider externally wrapped with
`AccountProviderWrapper` for runtime control
- Subscribes to `RemoteFeatureFlagController:stateChange` to toggle
provider state based on `addBitcoinAccount` flag
- Uses `wallet.sync()` to properly hide Bitcoin accounts when provider
is disabled (no zombie accounts)
- Follows the exact approach proposed by the core team

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36676?quickstart=1)

## **Changelog**

CHANGELOG entry: Added Bitcoin provider feature flag support for runtime
control via addBitcoinAccount flag

## **Related issues**

[MUL-1138](https://consensyssoftware.atlassian.net/browse/MUL-1138)

## **Manual testing steps**

1. Enable `addBitcoinAccount` feature flag via remote config
2. Verify Bitcoin accounts can be created and are visible in account
list
3. Disable `addBitcoinAccount` feature flag via remote config  
4. Verify Bitcoin accounts are hidden from UI (no longer appear in
account list/groups)
5. Re-enable flag and verify Bitcoin accounts reappear
6. Confirm no zombie accounts remain when flag is disabled

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- Bitcoin provider was always enabled regardless of feature flag
state -->

### **After**

<!-- Bitcoin provider respects addBitcoinAccount feature flag with
runtime control -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

[MUL-1138]:
https://consensyssoftware.atlassian.net/browse/MUL-1138?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Enables runtime control of the Bitcoin provider via version-gated
remote flags and migrates BTC/SOL flags to new schema, updating
selectors and tests accordingly.
> 
> - **Multichain Account Service**:
> - Add `RemoteFeatureFlagController:stateChange` to allowed events and
messenger typing.
> - Wrap `BtcAccountProvider` with `AccountProviderWrapper` and toggle
via remote flag; align wallets on enable.
> - **Feature Flags**:
> - Introduce `shared/lib/multichain-feature-flags.ts` with
`isMultichainFeatureEnabled` (version-gated helper).
> - Migrate flags to object schema: `bitcoinAccounts`/`solanaAccounts`
`{ enabled, minimumVersion }`.
>   - Bump `@metamask/remote-feature-flag-controller` to `^1.9.0`.
> - **Selectors/UI**:
>   - Update selectors to use version-gated checks for BTC/SOL support.
>   - Harden non‑EVM network filtering against missing configs.
> - **Tests/Mocks/Stories**:
> - Update e2e/unit tests, stories, and mocks to new flag schema and BTC
provider toggling.
>   - Adjust Solana tests to use `solanaAccounts` object flag.
> - **Lockfile**: Update `yarn.lock` for new dependency version.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
cfd3375. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Charly Chevalier <[email protected]>
…esController (#36819)

## **Description**

This PR integrates the **Backend WebSocket Service** and **Account
Activity Service** from `@metamask/core-backend` into MetaMask
Extension. These services enable real-time account activity monitoring
and balance updates via WebSocket connections.

**⚠️ Important: This integration is feature-flagged and will NOT change
any behavior until the `backendWebSocketConnection` remote feature flag
is enabled.** Without the feature flag, the WebSocket service will not
connect, and the extension will continue to work exactly as before.

### What is the reason for the change?

To prepare the extension for real-time account activity updates from the
MetaMask backend platform, reducing reliance on polling and enabling
faster balance updates and transaction notifications.

### What is the improvement/solution?

1. **Integrated BackendWebSocketService**: Provides authenticated
WebSocket connectivity to the MetaMask backend with automatic
reconnection, authentication flow integration, and feature flag control.

2. **Integrated AccountActivityService**: Subscribes to account activity
channels and receives real-time transaction and balance updates.

3. **TokenBalancesController Integration**: The controller automatically
adjusts polling intervals based on WebSocket availability:
- When chains are "up" (WebSocket active): Reduces polling to 5 minutes
(backup only)
- When chains are "down" (WebSocket inactive): Uses default 30-second
polling
- Automatically imports new tokens detected via WebSocket balance
updates

4. **Package Updates**: Updated to use local `@metamask/core-backend`
and `@metamask/assets-controllers` packages from the core monorepo for
development.

### Architecture

BackendWebSocketService (Transport Layer)
↓
AccountActivityService (Data Layer)
↓
TokenBalancesController & AccountTrackerController,
TokenDetectionController (Business Logic, and internal state Management)


### References

For detailed architecture, implementation details, and API
documentation, see:
- **Core Backend Package**:
[core/packages/core-backend](https://github.com/MetaMask/core/tree/main/packages/core-backend)
- **Core Backend README**: [Comprehensive documentation on services,
authentication flow, and integration
patterns](https://github.com/MetaMask/core/blob/main/packages/core-backend/README.md)

## **Changelog**

CHANGELOG entry: Integrated Backend WebSocket Service and Account
Activity Service for real-time balance updates (feature-flagged)

## **Related issues**

Fixes: [Add issue number]

## **Manual testing steps**

Since this feature is behind a feature flag, testing requires enabling
the flag:

### Testing with Feature Flag Disabled (Default)
1. Build and run the extension
2. Verify extension works normally
3. Confirm no WebSocket connections are made (check Network tab)
4. Verify token balances still update via polling

### Testing with Feature Flag Enabled (Development)
1. Add to `.metamaskrc`:
```
BACKEND_WEBSOCKET_CONNECTION_ENABLED=true
```
2. Build and run the extension
3. Unlock wallet
4. Check browser console for WebSocket connection logs:
`[BackendWebSocketService]`
5. Verify WebSocket connection in Network tab
(wss://gateway.dev-api.cx.metamask.io/v1)
6. Perform transactions and verify balance updates
7. Check that TokenBalancesController logs show adjusted polling
intervals

## **Screenshots/Recordings**

### **Before**

N/A - This is a new feature integration

### **After**

<!-- Add console screenshots showing WebSocket connection and service
initialization -->

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

---

## **Technical Details**

### Files Added
-
`app/scripts/controller-init/core-backend/backend-websocket-service-init.ts`
- Service initialization with feature flag and auth integration
-
`app/scripts/controller-init/core-backend/account-activity-service-init.ts`
- Account activity service setup
-
`app/scripts/controller-init/messengers/core-backend/backend-websocket-service-messenger.ts`
- Messenger with auth actions/events
-
`app/scripts/controller-init/messengers/core-backend/account-activity-service-messenger.ts`
- Account activity messenger
- Index files for exports

### Files Modified
- `package.json` - Added `@metamask/core-backend` and switched
`@metamask/assets-controllers` to local file reference
- `builds.yml` - Environment variables for WebSocket URL (already
present)
- `controller-list.ts` - Added service types
- `messengers/index.ts` - Registered service messengers
- `metamask-controller.js` - Integrated services into controller
initialization
- `messengers/token-balances-controller-messenger.ts` - Added
actions/events for WebSocket integration
- `yarn.lock` - Updated dependencies

### Integration Points

**TokenBalancesController** (in core) automatically:
- Subscribes to `AccountActivityService:statusChanged` for dynamic
polling adjustment
- Subscribes to `AccountActivityService:balanceUpdated` for real-time
balance updates
- Calls `TokenDetectionController:addDetectedTokensViaWs` to auto-import
new tokens

**BackendWebSocketService** handles:
- Feature flag checking (`backendWebSocketConnection` remote feature
flag)
- Authentication via `AuthenticationController:getBearerToken`
- Wallet lock/unlock state monitoring
- Automatic reconnection with exponential backoff

**AccountActivityService** provides:
- Automatic subscription to selected account
- Account switching handling
- Balance update processing with CAIP-10 format support
- Chain status tracking and notification
```

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Integrates feature-flagged backend WebSocket and AccountActivity services, wires them into controllers/messengers with real-time balance updates, and updates configs, policies, and deps.
> 
> - **Core Backend Integration**:
>   - Add `BackendWebSocketServiceInit` and `AccountActivityServiceInit` with feature-flag gating via `RemoteFeatureFlagController:getState` and tracing.
>   - Register services in `controller-list.ts`, `controller-init/index`, and `metamask-controller.js` (connect/disconnect on UI open/close).
> - **Controllers & Messaging**:
>   - New messengers for `BackendWebSocketService` and `AccountActivityService` with auth and lifecycle events; expose in `messengers/index.ts`.
>   - Extend `TokenBalancesController` messengers to handle `AccountActivityService` events and `TokenDetectionController:addDetectedTokensViaWs`.
>   - Update `AccountTrackerController.updateNativeBalances` to normalize addresses to lowercase.
> - **Config**:
>   - Add `MM_BACKEND_WEBSOCKET_URL` (default `wss://gateway.api.cx.metamask.io/v1`) in `.metamaskrc.dist` and `builds.yml`.
> - **Security/Policies**:
>   - LavaMoat policies: allow `@metamask/core-backend` globals (`URL`, `WebSocket`, timers) and packages.
> - **Dependencies**:
>   - Add `@metamask/core-backend@^2.1.0`; bump `@metamask/assets-controllers` to `81.0.0` (patch), update related locks; bump `@metamask/bridge-status-controller` and `@metamask/profile-sync-controller`.
> - **Tests**:
>   - Add init and messenger tests for core-backend services, including feature-flag `isEnabled` behavior.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit c66db6b. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: MetaMask Bot <[email protected]>
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36932?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds 13.5.0 release notes to CHANGELOG and updates comparison links.
> 
> - **Changelog (`CHANGELOG.md`)**:
> - Added `13.5.0` section with extensive Added/Changed/Fixed entries
(multichain accounts, Solana, UI/UX, swaps/bridge, alerts, networks,
performance, bug fixes).
> - Updated compare links: `[Unreleased]` now compares from `v13.5.0`,
and added `[13.5.0]` comparison link.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
afd15d3. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: runway-github[bot] <73448015+runway-github[bot]@users.noreply.github.com>
Co-authored-by: Shane T <[email protected]>
Co-authored-by: seaona <[email protected]>
Co-authored-by: MetaMask Bot <[email protected]>
Co-authored-by: metamaskbot <[email protected]>
Co-authored-by: Jyoti Puri <[email protected]>
Co-authored-by: Francis Nepomuceno <[email protected]>
Co-authored-by: Salim TOUBAL <[email protected]>
Co-authored-by: Bernardo Garces Chapero <[email protected]>
Co-authored-by: hunty <[email protected]>
Co-authored-by: SteP-n-s <[email protected]>
Co-authored-by: Lwin <[email protected]>
Co-authored-by: Micaela <[email protected]>
Co-authored-by: Frederik Bolding <[email protected]>
Co-authored-by: Prithpal Sooriya <[email protected]>
Co-authored-by: Mathieu Artu <[email protected]>
Co-authored-by: imblue <[email protected]>
Co-authored-by: augmentedmode <[email protected]>
Co-authored-by: imblue-dabadee <[email protected]>
Co-authored-by: Pedro Figueiredo <[email protected]>
Co-authored-by: Guillaume Roux <[email protected]>
Co-authored-by: Maarten Zuidhoorn <[email protected]>
Co-authored-by: Charly Chevalier <[email protected]>
Co-authored-by: OGPoyraz <[email protected]>
Co-authored-by: AugmentedMode <[email protected]>
Co-authored-by: jiexi <[email protected]>
Co-authored-by: Xavier Brochard <[email protected]>
Co-authored-by: Gustavo Antunes <[email protected]>
Co-authored-by: Patryk Łucka <[email protected]>
Copy link
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

Copy link

socket-security bot commented Oct 17, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​mui/​core-downloads-tracker@​5.18.01001004298100
Updatednode-releases@​2.0.18 ⏵ 2.0.211001004487 -3100
Updatedjson-stable-stringify@​1.1.1 ⏵ 1.3.06710010054 +1100
Added@​emotion/​memoize@​0.9.01001006182100
Updated@​babel/​plugin-syntax-jsx@​7.25.9 ⏵ 7.27.11001006589100
Updated@​babel/​helper-annotate-as-pure@​7.25.9 ⏵ 7.27.31001006589100
Updated@​emotion/​use-insertion-effect-with-fallbacks@​1.0.1 ⏵ 1.2.0100 +110066 +282100
Updated@​metamask/​ens-resolver-snap@​0.1.4 ⏵ 1.0.099 +510067 -190 -1100
Added@​emotion/​utils@​1.4.21001006783100
Addedjson-rpc-middleware-stream@​4.2.3971006881100
Added@​mui/​types@​7.2.241001006895100
Added@​lavamoat/​types@​0.1.0691007391100
Added@​types/​react-helmet@​6.1.111001007078100
Added@​emotion/​serialize@​1.3.31001007083100
Added@​mui/​private-theming@​5.17.1991007097100
Updated@​types/​prop-types@​15.7.3 ⏵ 15.7.1510010071 +279100
Added@​emotion/​unitless@​0.7.51001007182100
Updated@​babel/​helper-plugin-utils@​7.25.9 ⏵ 7.27.11001007189100
Updated@​metamask/​json-rpc-middleware-stream@​8.0.7 ⏵ 8.0.81001007388 +5100
Updated@​babel/​code-frame@​7.26.2 ⏵ 7.27.11001007490100
Added@​mui/​styled-engine@​5.18.0991007497100
Added@​emotion/​is-prop-valid@​1.4.01001007485100
Updated@​types/​react-transition-group@​4.4.6 ⏵ 4.4.121001007479100
Updated@​metamask/​polling-controller@​12.0.3 ⏵ 14.0.11001007490 -1100
Updated@​types/​estree@​1.0.7 ⏵ 1.0.81001007579100
Updated@​metamask/​shield-controller@​0.1.1 ⏵ 0.3.297 +2510075 +494 +3100
Updated@​metamask/​remote-feature-flag-controller@​1.6.0 ⏵ 1.9.0100 +110075 +393 +2100 +20
Added@​mui/​utils@​5.17.1991007597100
Updated@​babel/​helper-module-imports@​7.25.9 ⏵ 7.27.11001007589100
Updated@​ethersproject/​pbkdf2@​5.7.0 ⏵ 5.8.01001007579100
Updatedupdate-browserslist-db@​1.1.1 ⏵ 1.1.31001007579100
Addedacorn-import-phases@​1.0.41001007681100
Updated@​metamask/​gas-fee-controller@​24.0.0 ⏵ 24.1.09910076 +190 +5100
See 99 more rows in the dashboard

View full report

Copy link

socket-security bot commented Oct 17, 2025

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block High
@lavamoat/[email protected] has Unstable ownership.

Author: naugtur

From: yarn.locknpm/@lavamoat/[email protected]

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lavamoat/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
@metamask/[email protected] has Network access.

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/@metamask/[email protected]

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
@emotion/[email protected] has a New author.

New Author: emotion-release-bot

Previous Author: mitchellhamilton

From: yarn.locknpm/@emotion/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emotion/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
@emotion/[email protected] has a New author.

New Author: emotion-release-bot

Previous Author: mitchellhamilton

From: yarn.locknpm/@emotion/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emotion/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
@lavamoat/[email protected] has a New author.

New Author: naugtur

Previous Author: boneskull

From: yarn.locknpm/@lavamoat/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lavamoat/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
@metamask/[email protected] has a New author.

New Author: lgbot

Previous Author: gudahtt

From: yarn.locknpm/@metamask/[email protected]npm/@metamask/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a New author.

New Author: ljharb

Previous Author: substack

From: yarn.locknpm/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a New author.

New Author: gudahtt

Previous Author: rekmarks

From: yarn.locknpm/@metamask/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a New author.

New Author: jsdnxx

Previous Author: jden

From: yarn.locknpm/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a New author.

New Author: formidablelabs

Previous Author: ryan.roemer

From: yarn.locknpm/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@emotion/[email protected] is a AI-detected potential code anomaly.

Notes: Overall, this is a standard, non-malicious portion of the Emotion styling library. No evidence of backdoors, credential theft, or external network/data exfiltration. The primary risk vector is the CSS-in-DOM injection path via dangerouslySetInnerHTML, which is expected but should be reviewed in the context of trusted inputs. Security posture is low-to-moderate; no immediate danger, but maintain caution with user-supplied template literals and ensure dependencies are trusted.

Confidence: 1.00

Severity: 0.60

From: yarn.locknpm/@emotion/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emotion/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@metamask/[email protected] is a AI-detected potential code anomaly.

Notes: The code implements a guarded, cache-accelerated path to sign a message via an external SnapController. No explicit malware indicators detected. Primary risks relate to API design and cache semantics: entropySourceId is currently unused in the cache key, which could cause mismatches between the signing policy and cached signatures; potential replay/reuse concerns if identical messages are signed for different intents without provenance. Recommended improvements: validate message format and provenance, incorporate entropySourceId into cache keys or policy checks, add audit logging, and implement cache eviction/invalidation rules to prevent stale signatures.

Confidence: 0.75

Severity: 0.55

From: package.jsonnpm/@metamask/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@metamask/[email protected] is a AI-detected potential code anomaly.

Notes: The code performs straightforward signature verification using ethers.js, returning true when the recovered signer matches the provided publicKey. While generally safe, the silent catch and potential mismatch between data formatting and signing process should be addressed to avoid silent failures. Overall, a benign utility with moderate input-format sensitivity.

Confidence: 0.75

Severity: 0.50

From: package.jsonnpm/@metamask/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@metamaskbot
Copy link
Collaborator Author

✨ Files requiring CODEOWNER review ✨

🔒 @MetaMask/extension-security-team (1 files, +26 -8)
  • 📁 .github/
    • 📄 CODEOWNERS +26 -8

@metamaskbot metamaskbot added the team-bots Bot team (for MetaMask Bot, Runway Bot, etc.) label Oct 17, 2025
@gauthierpetetin
Copy link
Contributor

@metamaskbot update-policies

@gauthierpetetin
Copy link
Contributor

@metamaskbot update-attributions

@metamaskbot
Copy link
Collaborator Author

Attributions updated

@metamaskbot metamaskbot added the release-13.6.0 Issue or pull request that will be included in release 13.6.0 label Oct 17, 2025
@metamaskbot
Copy link
Collaborator Author

No policy changes

MajorLift and others added 3 commits October 17, 2025 13:41
… workflow (#36942)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

Declares environment variables in `builds.yml` that are required for the
`validate-lavamoat-policies` workflow to run successfully.

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36942?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds per-environment INFURA, Segment, Google, and Apple OAuth env vars
to builds.yml for workflow compatibility.
> 
> - **Build config (`builds.yml`)**:
> - Add per-environment INFURA project IDs: `INFURA_PROD_PROJECT_ID`,
`INFURA_BETA_PROJECT_ID`, `INFURA_FLASK_PROJECT_ID`,
`INFURA_EXPERIMENTAL_PROJECT_ID`.
> - Add per-environment Segment write keys: `SEGMENT_PROD_WRITE_KEY`,
`SEGMENT_BETA_WRITE_KEY`, `SEGMENT_FLASK_WRITE_KEY`,
`SEGMENT_EXPERIMENTAL_WRITE_KEY`.
>   - Add per-environment OAuth client IDs:
> - Google: `GOOGLE_PROD_CLIENT_ID`, `GOOGLE_BETA_CLIENT_ID`,
`GOOGLE_FLASK_CLIENT_ID`, `GOOGLE_EXPERIMENTAL_CLIENT_ID`.
> - Apple: `APPLE_PROD_CLIENT_ID`, `APPLE_BETA_CLIENT_ID`,
`APPLE_FLASK_CLIENT_ID`, `APPLE_EXPERIMENTAL_CLIENT_ID`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
707f704. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
…roment variables (#36945)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36945?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Removes default empty-string values for Segment write keys and
Google/Apple OAuth client IDs, declaring them as required env vars
instead.
> 
> - **Build config (`builds.yml`)**:
>   - **Env var declarations**:
> - `SEGMENT_PROD_WRITE_KEY`, `SEGMENT_BETA_WRITE_KEY`,
`SEGMENT_FLASK_WRITE_KEY`, `SEGMENT_EXPERIMENTAL_WRITE_KEY` changed from
`''` defaults to declarations.
> - `GOOGLE_PROD_CLIENT_ID`, `GOOGLE_BETA_CLIENT_ID`,
`GOOGLE_FLASK_CLIENT_ID`, `GOOGLE_EXPERIMENTAL_CLIENT_ID` changed from
`''` defaults to declarations.
> - `APPLE_PROD_CLIENT_ID`, `APPLE_BETA_CLIENT_ID`,
`APPLE_FLASK_CLIENT_ID`, `APPLE_EXPERIMENTAL_CLIENT_ID` changed from
`''` defaults to declarations.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f20db36. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
This PR updates the change log for 13.6.0.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds the 13.6.0 section to CHANGELOG with key additions/fixes and
updates comparison links.
> 
> - **CHANGELOG**:
>   - Add `13.6.0` release notes with highlights:
> - Real-time balance updates via integrated WebSocket and account
activity services (feature-flagged).
> - Expanded Bitcoin support (feature flag, BIP44 accounts, Bridge
support, BTC assets labeling; v1.3.0).
> - Shield subscription enhancements (entry modal integration, new
durations, error toasts, eligibility checks, coverage UI).
> - UI/components: add funds modal, new toast, file upload, skeleton
loaders; network and token logos.
>     - Localization: add Irish (Gaeilge).
> - Various fixes and performance improvements (token duplication, ENS
content hash resolution, Solana provider interactions, shield controller
patching).
> - Update links: set `[Unreleased]` to compare from `v13.6.0` and add
`[13.6.0]` compare URL.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
193b781. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <[email protected]>
Co-authored-by: Gauthier Petetin <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release-13.6.0 Issue or pull request that will be included in release 13.6.0 team-bots Bot team (for MetaMask Bot, Runway Bot, etc.)

Projects

None yet

Development

Successfully merging this pull request may close these issues.