Skip to content

fix: bump assets and phishing controller#40132

Merged
sahar-fehri merged 22 commits intomainfrom
fix/upgrade-assets-and-phishing-controller
Feb 24, 2026
Merged

fix: bump assets and phishing controller#40132
sahar-fehri merged 22 commits intomainfrom
fix/upgrade-assets-and-phishing-controller

Conversation

@sahar-fehri
Copy link
Contributor

@sahar-fehri sahar-fehri commented Feb 16, 2026

Description

  • Bump @metamask/assets-controllers from ^99.4.0 to 100.0.2 and @metamask/phishing-controller from ^15.0.0 to ^16.3.0
  • Wire up the new PhishingController:bulkScanTokens action into the MultichainAssetsController messenger so the assets controller can leverage bulk token phishing detection

Open in GitHub Codespaces

Changelog

CHANGELOG entry: bump assets and phishing controllers versions

Related issues

Fixes:

Manual testing steps

  1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Moderate risk due to major-version controller dependency bump and updated LavaMoat policies/state fixtures, which could affect runtime permissions and phishing/asset flows.

Overview
Updates dependencies to @metamask/assets-controllers@100.0.2 and @metamask/phishing-controller@16.3.0, including yarn.lock refresh.

Extends MultichainAssetsController’s restricted messenger to permit the new PhishingController:bulkScanTokens action so the assets controller can request bulk token phishing scans, and updates LavaMoat policies and e2e fixtures/state snapshots for new phishing controller cache state (e.g. addressScanCache).

Written by Cursor Bugbot for commit 34d1ba5. This will update automatically on new commits. Configure here.

@github-actions
Copy link
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@sahar-fehri sahar-fehri marked this pull request as ready for review February 19, 2026 08:44
@socket-security
Copy link

socket-security bot commented Feb 19, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​metamask/​phishing-controller@​15.0.0 ⏵ 16.3.09910078 +196100
Added@​metamask/​assets-controllers@​100.0.2951009199100

View full report

@sahar-fehri sahar-fehri marked this pull request as draft February 19, 2026 08:58
@metamaskbotv2
Copy link
Contributor

metamaskbotv2 bot commented Feb 19, 2026

Builds ready [9197c38]
UI Startup Metrics (1437 ± 103 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup14371202168010314831627
load1229102614188912751402
domContentLoaded1223102114108812641392
domInteractive2816101182574
firstPaint179681233195216292
backgroundConnect25823846024258283
firstReactRender18122842025
initialActions106112
loadScripts98379711748610161146
setupStore1363651621
numNetworkReqs312289192281
BrowserifyPower User HomeuiStartup2504150110767181922174799
load12331087182715612511617
domContentLoaded12161075172714912411588
domInteractive3920232333592
firstPaint220751740218254348
backgroundConnect716295833811093982620
firstReactRender24166282737
initialActions106113
loadScripts95782214491459751323
setupStore1664381834
numNetworkReqs69291472579121
WebpackStandard HomeuiStartup91572211821159871141
load7816431095102839932
domContentLoaded7756401088101834924
domInteractive2816135222485
firstPaint1306842761166254
backgroundConnect30205793446
firstReactRender17123951927
initialActions104112
loadScripts7726381086100832918
setupStore1263041221
numNetworkReqs322292202586
WebpackPower User HomeuiStartup1289855280728813481706
load74964114621257371015
domContentLoaded73763514351237211003
domInteractive40181552739103
firstPaint16167727103191322
backgroundConnect1991311495183174310
firstReactRender22173842428
initialActions103111
loadScripts7346331424121719994
setupStore1252541519
numNetworkReqs1233725849155202
FirefoxBrowserifyStandard HomeuiStartup16771389266822116822115
load14081158240918714331738
domContentLoaded14071157240918814331733
domInteractive93331087110110170
firstPaint------
backgroundConnect6228277346299
firstReactRender14112821417
initialActions102012
loadScripts13801135238218214061637
setupStore197188271641
numNetworkReqs311996202787
BrowserifyPower User HomeuiStartup28502231465949529963943
load15921206292130516422341
domContentLoaded15911199292130516412341
domInteractive177371437225131617
firstPaint------
backgroundConnect3891311482313488967
firstReactRender18144541824
initialActions203122
loadScripts15481177288030315822291
setupStore164101301233191689
numNetworkReqs70282213887133
WebpackStandard HomeuiStartup17311457316327217381992
load14721214291625414811626
domContentLoaded14721213291625414801626
domInteractive873033544109151
firstPaint------
backgroundConnect63252513574123
firstReactRender16122831623
initialActions103122
loadScripts14461191290225214581575
setupStore188120181559
numNetworkReqs302087152765
WebpackPower User HomeuiStartup28081974726457029393496
load16341278539145716422221
domContentLoaded16341278539045716412221
domInteractive15137817156119459
firstPaint------
backgroundConnect3571301372255451896
firstReactRender241673122438
initialActions213123
loadScripts15851251535544415992147
setupStore18581200229250678
numNetworkReqs71262053787139
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 94 Bytes (0%)
  • ui: -1.52 KiB (-0.02%)
  • common: 2.79 KiB (0.03%)

salimtb
salimtb previously approved these changes Feb 23, 2026
salimtb
salimtb previously approved these changes Feb 24, 2026
bergarces
bergarces previously approved these changes Feb 24, 2026
@bergarces
Copy link
Contributor

Approved on behalf of policy reviewers

@sahar-fehri
Copy link
Contributor Author

@metamaskbot update-policies

@metamaskbot metamaskbot dismissed stale reviews from bergarces and salimtb via 34d1ba5 February 24, 2026 11:04
@metamaskbot
Copy link
Collaborator

Policies updated.
👀 Please review the diff for suspicious new powers.

🧠 Learn how: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

👀 lavamoat/browserify/beta/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/browserify/experimental/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/browserify/flask/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/webpack/mv2/beta/policy.json changes differ from mv2/main/policy.json policy changes
👀 lavamoat/webpack/mv2/experimental/policy.json changes differ from mv2/main/policy.json policy changes
👀 lavamoat/webpack/mv2/flask/policy.json changes differ from mv2/main/policy.json policy changes
✅ lavamoat/webpack/mv3/beta/policy.json changes match mv3/main/policy.json policy changes
✅ lavamoat/webpack/mv3/experimental/policy.json changes match mv3/main/policy.json policy changes
✅ lavamoat/webpack/mv3/flask/policy.json changes match mv3/main/policy.json policy changes

@sonarqubecloud
Copy link

@metamaskbotv2
Copy link
Contributor

metamaskbotv2 bot commented Feb 24, 2026

Builds ready [34d1ba5]
⚡ Performance Benchmarks (1334 ± 120 ms)
👆 Interaction Benchmarks
ActionMetricMean (ms)Std Dev (ms)P75 (ms)P95 (ms)
Load New Accountload_new_account2884291291
total2884291291
Confirm Txconfirm_tx60522160706083
total60522160706083
Bridge User Actionsbridge_load_page1913193194
bridge_load_asset_picker21854272289
bridge_search_token71319732739
total11276611901222
🔌 Startup Benchmarks
BuildMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
Chrome Browserify Startup Standard HomeuiStartup13341097172212013841555
load1123931152710611771299
domContentLoaded1115915152010611731292
domInteractive251589172174
firstPaint191561191195198342
backgroundConnect19717740925197225
firstReactRender17123331922
initialActions107113
loadScripts93774113411059881115
setupStore1162941216
numNetworkReqs3122101212290
Chrome Browserify Startup Power User HomeuiStartup2720136910286176635904635
load11981024168613812351500
domContentLoaded11801009167213112241449
domInteractive3620156243595
firstPaint219831689251250399
backgroundConnect902249784813409602670
firstReactRender24176082640
initialActions109112
loadScripts974821143912310121238
setupStore16562111741
numNetworkReqs78401492391119
Chrome Webpack Startup Standard HomeuiStartup85567811591039141078
load73260694389802891
domContentLoaded72760393688797884
domInteractive2816135222482
firstPaint1236241963158222
backgroundConnect28196893242
firstReactRender19124372036
initialActions106113
loadScripts72460192787795878
setupStore1264351219
numNetworkReqs312295202585
Chrome Webpack Startup Power User HomeuiStartup1235915243125512921632
load716624108594716931
domContentLoaded706616107594706925
domInteractive36181422734110
firstPaint13966946102151274
backgroundConnect17812984787166320
firstReactRender21163032226
initialActions102111
loadScripts704614106492703917
setupStore1244561317
numNetworkReqs81391712790153
Firefox Browserify Startup Standard HomeuiStartup17191483256320717202122
load14531233229417814651749
domContentLoaded14521232229417814651749
domInteractive993287097118224
firstPaint------
backgroundConnect6031156196595
firstReactRender14121811516
initialActions103112
loadScripts14251209225517414411659
setupStore187115171643
numNetworkReqs322194192786
Firefox Browserify Startup Power User HomeuiStartup29332133817991230213578
load16931319685279815902202
domContentLoaded16931319685279815892202
domInteractive182491191178174539
firstPaint------
backgroundConnect3721091253281458982
firstReactRender19146271823
initialActions2038422
loadScripts16551301681979415432165
setupStore15715670168216494
numNetworkReqs83312093898173
Firefox Webpack Startup Standard HomeuiStartup16891371352234216702051
load14401204321131814481634
domContentLoaded14401204321131814441634
domInteractive863121245130149
firstPaint------
backgroundConnect58282683263103
firstReactRender16125161625
initialActions103112
loadScripts14151187318131614271558
setupStore2481883815116
numNetworkReqs312091182781
Firefox Webpack Startup Power User HomeuiStartup28372007978280929073628
load16251309815671016242172
domContentLoaded16251308815671016242172
domInteractive183501708214181625
firstPaint------
backgroundConnect4211261762311600994
firstReactRender22156282431
initialActions203122
loadScripts15881284811570815902107
setupStore17316843197240581
numNetworkReqs81292254582203
🧭 User Journey Benchmarks
BenchmarkMetricMean (ms)Std Dev (ms)P75 (ms)P95 (ms)
Onboarding Import WalletimportWalletToSocialScreen2180218218
srpButtonToSrpForm9209292
confirmSrpToPwForm2112122
pwFormToMetricsScreen1501515
metricsToWalletReadyScreen1501515
doneButtonToHomeScreen5668568578
openAccountMenuToAccountListLoaded755645378548078
total852848689569021
Onboarding New WalletcreateWalletToSocialScreen2190219219
srpButtonToPwForm1062108109
createPwToRecoveryScreen8088
skipBackupToMetricsScreen3613637
agreeButtonToOnboardingSuccess1711718
doneButtonToAssetList7742468851182
total116124812751571
Asset DetailsassetClickToPriceChart3933844
total3933844
Solana Asset DetailsassetClickToPriceChart4514646
total4514646
Import Srp HomeloginToHomeScreen18552418571894
openAccountMenuAfterLogin4995960
homeAfterImportWithNewWallet252112926032700
total445218245374749
Send TransactionsopenSendPageFromHome1811819
selectTokenToSendFormLoaded2022023
reviewTransactionToConfirmationPage87332883931
total90613916921
SwapopenSwapPageFromHome12415131144
fetchAndDisplaySwapQuotes45781745694607
total47081047134721
🌐 Dapp Page Load Benchmarks

Current Commit: 34d1ba5 | Date: 2/24/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.05s (±56ms) 🟡 | historical mean value: 1.04s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 737ms (±51ms) 🟢 | historical mean value: 726ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 78ms (±11ms) 🟢 | historical mean value: 81ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.05s 56ms 1.02s 1.36s 1.09s 1.36s
domContentLoaded 737ms 51ms 703ms 1.03s 767ms 1.03s
firstPaint 78ms 11ms 64ms 176ms 88ms 176ms
firstContentfulPaint 78ms 11ms 64ms 176ms 88ms 176ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚀 Bundle size reduced!]
  • background: 169 Bytes (0%)
  • ui: 3.46 KiB (0.04%)
  • common: -42.56 KiB (-0.38%)

@sahar-fehri sahar-fehri added this pull request to the merge queue Feb 24, 2026
Merged via the queue into main with commit a4dc51b Feb 24, 2026
179 checks passed
@sahar-fehri sahar-fehri deleted the fix/upgrade-assets-and-phishing-controller branch February 24, 2026 12:16
@github-actions github-actions bot locked and limited conversation to collaborators Feb 24, 2026
@metamaskbot metamaskbot added the release-13.21.0 Issue or pull request that will be included in release 13.21.0 label Feb 24, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

release-13.21.0 Issue or pull request that will be included in release 13.21.0 size-S team-assets

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants