release: 13.6.0

.depcheckrc.yml

@@ -5,6 +5,7 @@ ignores:
   #
 
   - '@lavamoat/snow'
+  - '@lavamoat/webpack'
   - '@lavamoat/allow-scripts'
   - '@babel/runtime'
   - '@fortawesome/fontawesome-free'
@@ -27,6 +28,8 @@ ignores:
   - '@metamask/test-dapp'
   - '@metamask/test-dapp-multichain'
   - '@metamask/test-dapp-solana'
+  - '@metamask/snap-simple-keyring-site'
+  - '@metamask/snap-account-abstraction-keyring-site'
   - '@metamask/design-tokens' # Only imported in index.css
   - '@tsconfig/node22' # required dynamically by TS, used in tsconfig.json
   - '@sentry/cli' # invoked as `sentry-cli`

.github/CODEOWNERS

@@ -97,11 +97,14 @@ app/scripts/constants/snaps.ts       @MetaMask/core-platform
 ui/components/app/metamask-template-renderer @MetaMask/confirmations @MetaMask/core-platform
 
 # Core Extension UX
-ui/components/app/whats-new-popup     @MetaMask/core-extension-ux
-ui/css                                @MetaMask/core-extension-ux
-ui/pages/home                         @MetaMask/core-extension-ux
-ui/pages/core                         @MetaMask/core-extension-ux
-ui/components/multichain/             @MetaMask/core-extension-ux
+ui/components/app/whats-new-popup               @MetaMask/core-extension-ux
+ui/css                                          @MetaMask/core-extension-ux
+ui/pages/home                                   @MetaMask/core-extension-ux
+ui/pages/core                                   @MetaMask/core-extension-ux
+ui/components/multichain/                       @MetaMask/core-extension-ux
+ui/components/app/transaction-list              @MetaMask/core-extension-ux
+ui/components/app/transaction-list-item-details @MetaMask/core-extension-ux
+ui/components/app/transaction-list-item         @MetaMask/core-extension-ux
 
 # Co-owned by accounts and core-extension-ux
 ui/components/multichain/multi-srp/              @MetaMask/accounts-engineers @MetaMask/core-extension-ux
@@ -149,6 +152,21 @@ test/e2e/helpers.js                       @MetaMask/qa
 test/e2e/mock-e2e-allowlist.js            @MetaMask/qa
 test/e2e/mock-e2e.js                      @MetaMask/qa
 
-# Wallet API Platform - Page Load Benchmark
-test/e2e/page-objects/benchmark           @MetaMask/wallet-api-platform-engineers
-test/e2e/playwright/benchmark             @MetaMask/wallet-api-platform-engineers
+# Wallet Integrations
+app/scripts/lib/rpc-method-middleware                                 @MetaMask/wallet-integrations
+shared/lib/caip25-caveat-merger.ts                                    @MetaMask/wallet-integrations
+test/e2e/page-objects/benchmark                                       @MetaMask/wallet-integrations
+test/e2e/playwright/benchmark                                         @MetaMask/wallet-integrations
+test/e2e/flask/multichain-api                                         @MetaMask/wallet-integrations
+# TODO CONSOLIDATE THE MIDDLEWARE BELOW INTO THE RPC-METHOD-MIDDLEWARE FOLDER
+app/scripts/lib/createRPCMethodTrackingMiddleware.js                  @MetaMask/wallet-integrations
+app/scripts/lib/createMetamaskMiddleware.js                           @MetaMask/wallet-integrations
+app/scripts/lib/createOnboardingMiddleware.js                         @MetaMask/wallet-integrations
+app/scripts/lib/createMetaRPCHandler.js                               @MetaMask/wallet-integrations
+app/scripts/lib/createEvmMethodsToNonEvmAccountReqFilterMiddleware.ts @MetaMask/wallet-integrations
+app/scripts/lib/createHyperliquidReferralMiddleware.ts                @MetaMask/wallet-integrations
+app/scripts/lib/metaRPCClientFactory.ts                               @MetaMask/wallet-integrations
+app/scripts/lib/middleware/                                           @MetaMask/wallet-integrations
+app/scripts/lib/createOriginThrottlingMiddleware.ts                   @MetaMask/wallet-integrations
+app/scripts/lib/createMainFrameOriginMiddleware.ts                    @MetaMask/wallet-integrations
+app/scripts/lib/createTracingMiddleware.ts                            @MetaMask/wallet-integrations

.github/scripts/check-template-and-add-labels.ts

@@ -183,29 +183,29 @@ async function main(): Promise<void> {
     }
 
   } else if (labelable.type === LabelableType.PullRequest) {
+    // Check changelog entry for all PRs (regardless of template match)
+    const hasNoChangelogLabel = labelable.labels?.some(
+      (label) => label.name === "no-changelog"
+    );
+
+    // Require changelog entry
+    if (hasNoChangelogLabel) {
+      console.log(`PR ${labelable.number} has "no-changelog" label. Skipping changelog entry check.`);
+    } else if (!hasChangelogEntry(labelable.body)) {
+      const errorMessage = `PR is missing a valid "CHANGELOG entry:" line.`;
+      console.log(errorMessage);
+
+      core.setFailed(errorMessage);
+      process.exit(1);
+    }
+
     if (templateType === TemplateType.PullRequest) {
       console.log("PR matches 'pull-request-template.md' template.");
       await removeLabelFromLabelableIfPresent(
         octokit,
         labelable,
         invalidPullRequestTemplateLabel,
       );
-
-      // Skip changelog check if PR has "no-changelog" label
-      const hasNoChangelogLabel = labelable.labels?.some(
-        (label) => label.name === "no-changelog"
-      );
-
-      // Require changelog entry
-      if (hasNoChangelogLabel) {
-        console.log(`PR ${labelable.number} has "no-changelog" label. Skipping changelog entry check.`);
-      } else if (!hasChangelogEntry(labelable.body)) {
-        const errorMessage = `PR is missing a valid "CHANGELOG entry:" line.`;
-        console.log(errorMessage);
-
-        core.setFailed(errorMessage);
-        process.exit(1);
-      }
     } else {
       const errorMessage = `PR body does not match template ('pull-request-template.md').\n\nMake sure PR's body includes all section titles.\n\nSections titles are listed here: https://github.com/MetaMask/metamask-extension/blob/main/.github/scripts/shared/template.ts#L40-L47`;
       console.log(errorMessage);

.github/workflows/e2e-chrome.yml

@@ -43,7 +43,7 @@ jobs:
       test-suite-name: test-e2e-chrome-webpack
       build-artifact: build-test-webpack
       build-command: yarn build:test:webpack
-      test-command: yarn test:e2e:chrome:webpack
+      test-command: yarn test:e2e:chrome
       matrix-index: ${{ matrix.index }}
       matrix-total: ${{ strategy.job-total }}
 

.github/workflows/e2e-firefox.yml

@@ -27,6 +27,24 @@ jobs:
       matrix-index: ${{ matrix.index }}
       matrix-total: ${{ strategy.job-total }}
 
+  test-e2e-firefox-webpack:
+    uses: ./.github/workflows/run-e2e.yml
+    if: ${{ github.event_name != 'merge_group' }}
+    secrets:
+      INFURA_PROJECT_ID: ${{ secrets.INFURA_PROJECT_ID }}
+    strategy:
+      fail-fast: ${{ github.event_name == 'merge_group' }}
+      matrix:
+        index:
+          [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19]
+    with:
+      test-suite-name: test-e2e-firefox-webpack
+      build-artifact: build-test-webpack
+      build-command: yarn build:test:webpack
+      test-command: yarn test:e2e:firefox
+      matrix-index: ${{ matrix.index }}
+      matrix-total: ${{ strategy.job-total }}
+
   test-e2e-firefox-flask:
     uses: ./.github/workflows/run-e2e.yml
     strategy:
@@ -44,6 +62,7 @@ jobs:
   test-e2e-firefox-report:
     needs:
       - test-e2e-firefox-browserify
+      - test-e2e-firefox-webpack
       - test-e2e-firefox-flask
     runs-on: ubuntu-latest
     timeout-minutes: 30

.github/workflows/main.yml

@@ -277,6 +277,7 @@ jobs:
     needs:
       - needs-e2e
       - build-test-mv2-browserify
+      - build-test-webpack
       - build-test-flask-mv2-browserify
     if: ${{ needs.needs-e2e.outputs.needs-e2e == 'true' }}
     uses: ./.github/workflows/e2e-firefox.yml

.github/workflows/update-lavamoat-policies.yml

@@ -160,6 +160,43 @@ jobs:
           path: lavamoat/browserify/${{ matrix.build-type }}
           key: cache-${{ matrix.build-type }}-${{ needs.prepare.outputs.COMMIT_SHA }}
 
+  update-lavamoat-webpack-policy:
+    name: Update LavaMoat webpack policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs:
+      - prepare
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Checkout pull request
+        run: gh pr checkout "${PR_NUMBER}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.LAVAMOAT_UPDATE_TOKEN }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+
+      - name: Checkout and setup environment
+        uses: MetaMask/action-checkout-and-setup@v1
+        with:
+          is-high-risk-environment: false
+          skip-allow-scripts: true
+          use-yarn-hydrate: true
+
+      - name: Update LavaMoat webpack policy
+        run: yarn webpack --env production --no-cache --generatePolicy
+        env:
+          INFURA_PROD_PROJECT_ID: 00000000000
+          SEGMENT_PROD_WRITE_KEY: 00000000000
+          GOOGLE_PROD_CLIENT_ID: 00000000000
+          APPLE_PROD_CLIENT_ID: 00000000000
+
+      - name: Cache webpack policy
+        uses: actions/cache/save@v4
+        with:
+          path: lavamoat/webpack
+          key: cache-webpack-${{ needs.prepare.outputs.COMMIT_SHA }}
+
   commit-updated-policies:
     name: Commit the updated LavaMoat policies
     runs-on: ubuntu-latest
@@ -169,6 +206,7 @@ jobs:
       - is-fork-pull-request
       - update-lavamoat-build-policy
       - update-lavamoat-webapp-policy
+      - update-lavamoat-webpack-policy
     # Ensure forks don't get access to the LavaMoat update token
     if: ${{ needs.is-fork-pull-request.outputs.IS_FORK == 'false' }}
     steps:
@@ -226,6 +264,13 @@ jobs:
           key: cache-experimental-${{ needs.prepare.outputs.COMMIT_SHA }}
           fail-on-cache-miss: true
 
+      - name: Restore webpack policy
+        uses: actions/cache/restore@v4
+        with:
+          path: lavamoat/webpack
+          key: cache-webpack-${{ needs.prepare.outputs.COMMIT_SHA }}
+          fail-on-cache-miss: true
+
       - name: Check whether there are policy changes
         id: policy-changes
         run: |

.github/workflows/validate-lavamoat-policies.yml

@@ -66,3 +66,30 @@ jobs:
               echo "::error::Working tree dirty."
               exit 1
           fi
+
+  validate-lavamoat-policy-webpack:
+    name: Validate LavaMoat webpack policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout and setup environment
+        uses: MetaMask/action-checkout-and-setup@v1
+        with:
+          is-high-risk-environment: false
+          skip-allow-scripts: true
+          use-yarn-hydrate: true
+
+      - name: Validate LavaMoat webpack policy
+        run: yarn webpack --env production --no-cache --generatePolicy
+        env:
+          INFURA_PROD_PROJECT_ID: 00000000000
+          SEGMENT_PROD_WRITE_KEY: 00000000000
+          GOOGLE_PROD_CLIENT_ID: 00000000000
+          APPLE_PROD_CLIENT_ID: 00000000000
+
+      - name: Check working tree
+        run: |
+          if ! git diff --exit-code; then
+              echo "::error::Working tree dirty."
+              exit 1
+          fi

.metamaskrc.dist

@@ -10,6 +10,10 @@ SEEDLESS_ONBOARDING_ENABLED='false'
 ; Set this to `true` to enable Metamask Shield
 METAMASK_SHIELD_ENABLED='false'
 
+; Backend WebSocket URL
+; Uses production API endpoint by default (same as builds.yml)
+;MM_BACKEND_WEBSOCKET_URL='wss://gateway.api.cx.metamask.io/v1'
+
 ; These variables are required for OAuth Service
 GOOGLE_CLIENT_ID=
 APPLE_CLIENT_ID=

.storybook/test-data.js

@@ -1713,6 +1713,7 @@ const state = {
     networkConnectionBanner: {
       status: 'unknown',
     },
+    coverageResults: {},
   },
   appState: {
     isAccountMenuOpen: false,

.yarn/patches/lavamoat-core-npm-16.7.1-9dcb956c6f.patch

@@ -0,0 +1,18 @@
+diff --git a/src/loadPolicy.js b/src/loadPolicy.js
+index 0aa4f83d083bcf18db9cf69df45a4c52154af4fe..b481194d929070dc653b2a61295c5b9cfde5e129 100644
+--- a/src/loadPolicy.js
++++ b/src/loadPolicy.js
+@@ -104,10 +104,9 @@ async function loadPolicyAndApplyOverrides({
+
+   const finalPolicy = mergePolicy(policy, policyOverride)
+
+-  // TODO: Only write if merge results in changes.
+-  // Would have to make a deep equal check on whole policy, which is a waste of time.
+-  // mergePolicy() should be able to do it in one pass.
+-  await fs.writeFile(policyPath, jsonStringifySortedPolicy(finalPolicy))
++  // Skip policy write step to prevent intermittent build failures
++  // The extension validates the policy in a separate step, we don't need it
++  // to be written to disk here.
+
+   return finalPolicy
+ }