## Release

### `@metamask/chain-agnostic-permission` 1.6.2

#### Changed

- Bump `@metamask/api-specs` from `^0.14.0` to `^0.15.0`
([MetaMask#9096](MetaMask#9096))
- Bump `@metamask/utils` from `^11.9.0` to `^11.11.0`
([MetaMask#9074](MetaMask#9074))
- Bump `@metamask/controller-utils` from `^12.0.0` to `^12.2.0`
([MetaMask#8774](MetaMask#8774),
[MetaMask#9058](MetaMask#9058),
[MetaMask#9083](MetaMask#9083))

### `@metamask/multichain-api-middleware` 3.1.4

#### Changed

- Bump `@metamask/utils` from `^11.9.0` to `^11.11.0`
([MetaMask#9074](MetaMask#9074))
- Bump `@metamask/controller-utils` from `^12.1.0` to `^12.2.0`
([MetaMask#9058](MetaMask#9058),
[MetaMask#9083](MetaMask#9083))
- Bump `@metamask/accounts-controller` from `^39.0.0` to `^39.0.1`
([MetaMask#9058](MetaMask#9058))
- Bump `@metamask/api-specs` from `^0.14.0` to `^0.15.0`
([MetaMask#9096](MetaMask#9096))
- Bump `@metamask/chain-agnostic-permission` from `^1.6.1` to `^1.6.2`
([MetaMask#9096](MetaMask#9096))

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Patch releases and dependency version bumps only; no logic or API
changes in the diff.
> 
> **Overview**
> **Monorepo release 1037.0.0** — version and changelog updates with no
runtime code changes in this diff.
> 
> **`@metamask/chain-agnostic-permission` 1.6.2** documents patch-level
dependency bumps: `@metamask/api-specs` ^0.15.0, `@metamask/utils`
^11.11.0, and `@metamask/controller-utils` ^12.2.0.
> 
> **`@metamask/multichain-api-middleware` 3.1.4** picks up the same
stack plus `@metamask/accounts-controller` ^39.0.1 and
**`@metamask/chain-agnostic-permission` ^1.6.2** in `package.json` and
`yarn.lock`.
> 
> **`@metamask/eip1193-permission-middleware`** updates its declared
dependency to `@metamask/chain-agnostic-permission` ^1.6.2 and records
that under `[Unreleased]` in its changelog (no package version bump in
this diff).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
daf565d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

## Explanation

This is the release PR for `1038.0.0`, generated by
`create-release-branch`. It bumps the monorepo version from `1037.0.0`
to `1038.0.0` and releases a single package:
`@metamask/ramps-controller` `14.1.1` → `14.2.0`. The release moves the
entries that had accumulated under `[Unreleased]` into a new `[14.2.0]`
section in the package's changelog.

`@metamask/ramps-controller@14.2.0` includes the following:

- **Changed** — `RampsService.getQuotes` now sends an `Authorization:
Bearer <token>` header, sourcing the token from
`AuthenticationController:getBearerToken` (already a required messenger
action since `14.0.0`); the call throws if no token is available (e.g.
the wallet is locked or the user is signed out)
([MetaMask#8888](MetaMask#8888)). This is the
notable change driving the version bump: `getQuotes` previously made an
unauthenticated request and now requires a bearer token, so consumers
should review their sign-in state before upgrading.
- **Changed** — Bump `@metamask/controller-utils` from `^12.1.0` to
`^12.2.0` ([MetaMask#9058](MetaMask#9058),
[MetaMask#9083](MetaMask#9083)).

Note on `getPaymentMethods`: within this unreleased window, auth was
added to `getPaymentMethods` (MetaMask#8888) and then removed again (MetaMask#9060) so
that payment methods can be fetched before sign-in. Because that change
was reverted before shipping, it nets to no consumer-facing change and
is intentionally omitted from the changelog per the project's "omit
reverted changes" guideline.

This is a minor release (`14.2.0`). It contains no breaking changes; the
version is bumped to minor — rather than patch — to surface the
`getQuotes` authentication behavior change, which alters how an existing
method makes its request even though the public interface is unchanged.
As part of cutting the release, the in-monorepo consumer
`@metamask/transaction-pay-controller` has its dependency on
`@metamask/ramps-controller` bumped to `^14.2.0`; this is a mechanical
version bump required by the release tooling and does not change
`transaction-pay-controller`'s behavior.

## References

<!--
Are there any issues that this pull request is tied to?
Are there other links that reviewers should consult to understand these
changes better?
Are there client or consumer pull requests to adopt any breaking
changes?

For example:

* Fixes #12345
* Related to #67890
-->

Release PR generated by `create-release-branch`; see
`docs/processes/releasing.md`. `@metamask/ramps-controller` was bumped
to a minor (`14.2.0`) rather than a patch in response to review feedback
that the `getQuotes` authentication change is a notable behavior change
to an existing method.

## Checklist

- [ ] I've updated the test suite for new or updated code as appropriate
- [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [x] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them

---------

Co-authored-by: Darius Costolas <10818970+meltingice1337@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Explanation

Release `1039.0.0` with a minor version bump for:

- **`@metamask/transaction-pay-controller`** `23.5.1` → `23.6.0`

### `@metamask/transaction-pay-controller@23.6.0`

#### Added
- Add direct mUSD fiat injection flow for Money Account deposits behind
`useFiatMUSDQuoteToInjectForMoneyAccount` feature flag. When enabled,
probes fiat providers for mUSD on Monad availability and, if viable,
purchases mUSD directly to the Money Account, skipping the ETH-to-mUSD
bridge. Falls back to the existing flow when no provider supports the
direct route. Also moves `fiatPayment.caipAssetId` assignment into fiat
quote functions so the asset ID always matches the quote that succeeded.
([MetaMask#9080](MetaMask#9080))
- Make fiat order polling interval and timeout remotely configurable via
`confirmations_pay_fiat.orderPollIntervalMs` and
`confirmations_pay_fiat.orderPollTimeoutMs` feature flags
([MetaMask#9090](MetaMask#9090))

#### Changed
- Bump `@metamask/utils` from `^11.9.0` to `^11.11.0`
([MetaMask#9074](MetaMask#9074))
- Bump `@metamask/assets-controller` from `^9.0.0` to `^9.0.1`
([MetaMask#9083](MetaMask#9083))
- Bump `@metamask/controller-utils` from `^12.1.1` to `^12.2.0`
([MetaMask#9083](MetaMask#9083))
- Bump `@metamask/transaction-controller` from `^67.1.0` to `^68.0.0`
([MetaMask#9089](MetaMask#9089))
- Bump `@metamask/ramps-controller` from `^14.1.1` to `^14.2.0`
([MetaMask#9105](MetaMask#9105))

#### Fixed
- Clear stale `fiatPayment.rampsQuote` when a fiat quote fetch fails,
preventing the "No quotes" alert from being silently suppressed after a
prior successful fetch
([MetaMask#9073](MetaMask#9073))

### Dependency updates

No downstream dependents — no additional changelog entries needed.

## References

- [MetaMask#9080](MetaMask#9080) — Direct mUSD fiat
injection flow
- [MetaMask#9090](MetaMask#9090) — Configurable
fiat order polling
- [MetaMask#9074](MetaMask#9074) — Bump
@metamask/utils
- [MetaMask#9083](MetaMask#9083) — Bump
assets-controller, controller-utils
- [MetaMask#9089](MetaMask#9089) — Bump
transaction-controller
- [MetaMask#9105](MetaMask#9105) — Bump
ramps-controller
- [MetaMask#9073](MetaMask#9073) — Fix stale
fiatPayment.rampsQuote

## Checklist

- [ ] I've updated the test suite for new or updated code as appropriate
- [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [x] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> The PR only changes version numbers and changelog text; behavioral
risk depends on the already-merged 23.6.0 features, not on new code in
this diff.
> 
> **Overview**
> Cuts **release 1039.0.0** by bumping the monorepo from `1038.0.0` to
`1039.0.0` and publishing **`@metamask/transaction-pay-controller`**
**`23.5.1` → `23.6.0`**.
> 
> The package changelog is finalized for **23.6.0** (new `[23.6.0]`
section, compare links updated); the diff does not include
implementation changes—only version metadata and release notes for work
already merged (direct mUSD fiat injection behind a flag, remote fiat
order polling config, dependency bumps, stale `fiatPayment.rampsQuote`
fix).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
1387422. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->