chore: bump multichain and ppom dependencies by cryptodev-2s · Pull Request #41122 · MetaMask/metamask-extension

cryptodev-2s · 2026-03-23T14:01:59Z

Description

Bump the following packages:

`@metamask/chain-agnostic-permission` `^1.3.0` → `^1.4.0`

Changelog

Added: Bip122AccountChangedNotifications property in KnownSessionProperties enum (#7537)
Changed: Remove @metamask/network-controller dependency (#7561)
Changed: Dependency bumps (@metamask/utils, @metamask/controller-utils, @metamask/permission-controller)

`@metamask/multichain-api-middleware` `^1.2.5` → `^1.2.7`

Changelog

v1.2.7: Dependency bumps (network-controller ^30.0.0, json-rpc-engine, multichain-transactions-controller, controller-utils)
v1.2.6 Fixed: wallet_revokeSession to handle cases where params is not provided (#7551)
v1.2.6 Changed: Dependency bumps (json-rpc-engine, utils, network-controller, controller-utils, permission-controller, chain-agnostic-permission)

`@metamask/ppom-validator` `0.39.0` → `0.39.1`

Changelog

Changed: Move @metamask/network-controller from peer to direct dependency and bump ^25.0.0 → ^30.0.0 (#254)
Changed: Bump @metamask/utils from ^9.2.1 to ^11.0.0 (#254)

`@metamask/selected-network-controller` `^25.0.0` → `^26.0.3`

Changelog

v26.0.0 BREAKING: Use InternalProvider instead of SafeEventEmitterProvider (#6796)
v26.0.0 BREAKING: Bump @metamask/network-controller from ^25.0.0 to ^26.0.0 (#7202)
v26.0.1: Move peer dependencies to direct dependencies (network-controller, permission-controller) (#7209)
v26.0.2–v26.0.3: Dependency bumps (network-controller to ^30.0.0, json-rpc-engine)

No code changes required — breaking changes are internal to the packages and don't affect extension usage. All dependency versions are already compatible.

Changelog

CHANGELOG entry: null

Related issues

Fixes: N/A

Manual testing steps

Build the extension and verify it runs correctly
Confirm no type errors are introduced

Screenshots/Recordings

N/A — dependency-only changes

Pre-merge author checklist

I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
I've completed the PR template to the best of my ability
I've included tests if applicable
I've documented my code using JSDoc format if applicable
I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Dependency-only update, but it upgrades core networking/permission-related packages (e.g., @metamask/selected-network-controller and transitive @metamask/network-controller/RPC middleware), which can subtly affect session/network behavior at runtime.

Overview
Bumps several MetaMask core dependencies: @metamask/chain-agnostic-permission to ^1.4.0, @metamask/multichain-api-middleware to ^1.2.7, @metamask/ppom-validator to 0.39.1, and @metamask/selected-network-controller to ^26.0.3.

Updates yarn.lock accordingly, including transitive shifts such as @metamask/network-controller moving to ^30.0.0 in dependent packages and related RPC middleware/util version bumps.

^{Written by Cursor Bugbot for commit 133258b. This will update automatically on new commits. Configure here.}

github-actions · 2026-03-23T14:02:15Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

- @metamask/chain-agnostic-permission 1.3.0 -> 1.4.0 - @metamask/multichain-api-middleware 1.2.5 -> 1.2.7 - @metamask/ppom-validator 0.39.0 -> 0.39.1 - @metamask/selected-network-controller 25.0.0 -> 26.0.3

socket-security · 2026-03-23T14:02:48Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@metamask/selected-network-controller@25.0.0 ⏵ 26.0.3	⁺¹
@metamask/multichain-api-middleware@1.2.5 ⏵ 1.2.7
@metamask/chain-agnostic-permission@1.3.0 ⏵ 1.4.0	⁺¹	⁺¹	^-1
@metamask/ppom-validator@0.39.0 ⏵ 0.39.1	^-1

View full report

socket-security · 2026-03-23T14:02:50Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

@metamask/ppom-validator@0.39.1

View full report

cryptodev-2s · 2026-03-23T14:02:53Z

@metamaskbot update-policies

cryptodev-2s · 2026-03-23T14:03:42Z

@SocketSecurity ignore npm/@metamask/ppom-validator@0.39.1

metamaskbot · 2026-03-23T14:15:00Z

No policy changes

sonarqubecloud · 2026-03-23T14:20:21Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

metamaskbotv2 · 2026-03-23T14:38:11Z

Builds ready [133258b]

builds: chrome, firefox
builds (beta): chrome, firefox
builds (flask): chrome, firefox
builds (test): chrome, firefox
builds (test-flask): chrome, firefox
webpack builds: chrome, firefox
webpack builds (beta): chrome, firefox
webpack builds (flask): chrome, firefox
webpack builds (test): chrome, firefox
webpack builds (test-flask): chrome, firefox
bundle size: Bundle Size Stats
interaction-benchmark: Interaction Stats
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
- common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19
- ui: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21
- content-script: 0
- offscreen: 0

⚡ Performance Benchmarks

👆 Interaction Benchmarks
Benchmark Metric Mean (ms) Min (ms) Max (ms) Std Dev (ms) P75 (ms) P95 (ms)
Load New Account load_new_account 286 276 297 9 294 297
total 286 276 297 9 294 297
Confirm Tx confirm_tx 6075 6046 6108 25 6097 6108
total 6075 6046 6108 25 6097 6108
Bridge User Actions bridge_load_page 228 208 246 15 239 246
bridge_load_asset_picker 243 239 248 4 243 248
bridge_search_token 757 751 765 5 759 765
total 1235 1212 1264 21 1251 1264

🔌 Startup Benchmarks
Benchmark Metric Mean (ms) Min (ms) Max (ms) Std Dev (ms) P75 (ms) P95 (ms)
Standard Home uiStartup 1472 1237 1905 118 1526 1683
load 1214 1004 1499 99 1270 1386
domContentLoaded 1207 997 1492 97 1263 1374
domInteractive 30 17 101 21 25 88
firstPaint 142 67 435 72 200 262
backgroundConnect 218 195 280 15 219 250
firstReactRender 20 13 156 15 20 30
initialActions 1 0 6 1 2 4
loadScripts 1006 807 1258 96 1055 1173
setupStore 14 6 37 7 16 31
numNetworkReqs 39 31 83 15 34 77
Power User Home uiStartup 5499 2411 17294 2399 6354 8707
load 1314 1120 1882 136 1346 1603
domContentLoaded 1297 1099 1828 132 1326 1575
domInteractive 45 21 285 46 36 150
firstPaint 206 87 568 97 283 349
backgroundConnect 2224 323 13530 2133 3141 5274
firstReactRender 25 17 63 6 27 36
initialActions 1 0 8 1 1 3
loadScripts 1071 899 1520 123 1108 1341
setupStore 17 8 69 9 20 33
numNetworkReqs 216 127 413 53 247 306

🧭 User Journey Benchmarks
Benchmark Metric Mean (ms) Min (ms) Max (ms) Std Dev (ms) P75 (ms) P95 (ms)
Onboarding Import Wallet importWalletToSocialScreen 220 219 221 1 220 221
srpButtonToSrpForm 94 92 96 2 94 96
confirmSrpToPwForm 22 21 24 1 23 24
pwFormToMetricsScreen 17 15 19 2 19 19
metricsToWalletReadyScreen 16 15 16 0 16 16
doneButtonToHomeScreen 556 548 564 7 562 564
openAccountMenuToAccountListLoaded 2932 2916 2948 12 2933 2948
total 3871 3834 3914 29 3877 3914
Onboarding New Wallet createWalletToSocialScreen 220 220 220 0 220 220
srpButtonToPwForm 115 114 115 0 115 115
createPwToRecoveryScreen 9 9 10 0 9 10
skipBackupToMetricsScreen 41 40 41 1 41 41
agreeButtonToOnboardingSuccess 17 17 18 0 17 18
doneButtonToAssetList 593 490 727 105 714 727
total 998 893 1132 109 1130 1132
Asset Details assetClickToPriceChart 75 71 84 6 84 84
total 75 71 84 6 84 84
Solana Asset Details assetClickToPriceChart 74 66 82 7 82 82
total 74 66 82 7 82 82
Import Srp Home loginToHomeScreen 2695 2620 2771 53 2696 2771
openAccountMenuAfterLogin 105 62 170 42 141 170
homeAfterImportWithNewWallet 417 362 521 62 401 521
total 3294 3120 3476 134 3355 3476
Send Transactions openSendPageFromHome 33 25 48 9 40 48
selectTokenToSendFormLoaded 36 26 50 9 39 50
reviewTransactionToConfirmationPage 1045 849 1348 192 1187 1348
total 1113 926 1408 188 1260 1408
Swap openSwapPageFromHome 96 23 164 51 135 164
fetchAndDisplaySwapQuotes 2696 2681 2714 12 2701 2714
total 2792 2724 2849 53 2848 2849

🌐 Dapp Page Load Benchmarks

Current Commit: 133258b | Date: 3/23/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

pageLoadTime-> current mean value: 1.07s (±79ms) 🟡 | historical mean value: 1.06s ⬆️ (historical data)
domContentLoaded-> current mean value: 760ms (±88ms) 🟢 | historical mean value: 748ms ⬆️ (historical data)
firstContentfulPaint-> current mean value: 94ms (±130ms) 🟢 | historical mean value: 92ms ⬆️ (historical data)

📈 Detailed Results

Metric	Mean	Std Dev	Min	Max	P95	P99
pageLoadTime	1.07s	79ms	1.03s	1.38s	1.31s	1.38s
domContentLoaded	760ms	88ms	719ms	1.31s	985ms	1.31s
firstPaint	94ms	130ms	64ms	1.38s	92ms	1.38s
firstContentfulPaint	94ms	130ms	64ms	1.38s	92ms	1.38s
largestContentfulPaint	0ms	0ms	0ms	0ms	0ms	0ms

Bundle size diffs

background: 57 Bytes (0%)
ui: 5 Bytes (0%)
common: 94 Bytes (0%)

mcmire

LGTM.

mcmire · 2026-03-23T17:33:29Z

yarn.lock

  languageName: node
  linkType: hard

-"@metamask/network-controller@npm:^27.0.0":


Nice removing this from the bundle 😎

cryptodev-2s had a problem deploying to pr-comment March 23, 2026 14:02 — with GitHub Actions Error

cryptodev-2s self-assigned this Mar 23, 2026

metamaskbot added the team-core-platform Core Platform team label Mar 23, 2026

chore: bump multichain and ppom dependencies

133258b

- @metamask/chain-agnostic-permission 1.3.0 -> 1.4.0 - @metamask/multichain-api-middleware 1.2.5 -> 1.2.7 - @metamask/ppom-validator 0.39.0 -> 0.39.1 - @metamask/selected-network-controller 25.0.0 -> 26.0.3

cryptodev-2s force-pushed the chore/bump-multichain-and-ppom-deps branch from f5cfc5c to 133258b Compare March 23, 2026 14:02

cryptodev-2s temporarily deployed to pr-comment March 23, 2026 14:02 — with GitHub Actions Inactive

github-actions bot added the size-XS label Mar 23, 2026

cryptodev-2s requested a review from a team March 23, 2026 14:17

cryptodev-2s temporarily deployed to pr-comment March 23, 2026 14:33 — with GitHub Actions Inactive

cryptodev-2s marked this pull request as ready for review March 23, 2026 14:34

cryptodev-2s temporarily deployed to pr-comment March 23, 2026 14:34 — with GitHub Actions Inactive

FrederikBolding approved these changes Mar 23, 2026

View reviewed changes

cryptodev-2s enabled auto-merge March 23, 2026 14:46

mcmire approved these changes Mar 23, 2026

View reviewed changes

cryptodev-2s added this pull request to the merge queue Mar 23, 2026

Merged via the queue into main with commit 91f18ad Mar 23, 2026
212 checks passed

cryptodev-2s deleted the chore/bump-multichain-and-ppom-deps branch March 23, 2026 18:03

github-actions bot locked and limited conversation to collaborators Mar 23, 2026

metamaskbot added the release-13.25.0 Issue or pull request that will be included in release 13.25.0 label Mar 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump multichain and ppom dependencies#41122

chore: bump multichain and ppom dependencies#41122
cryptodev-2s merged 1 commit intomainfrom
chore/bump-multichain-and-ppom-deps

cryptodev-2s commented Mar 23, 2026 •

edited by cursor bot

Loading

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

socket-security bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

cryptodev-2s commented Mar 23, 2026

Uh oh!

cryptodev-2s commented Mar 23, 2026

Uh oh!

metamaskbot commented Mar 23, 2026

Uh oh!

sonarqubecloud bot commented Mar 23, 2026

Uh oh!

metamaskbotv2 bot commented Mar 23, 2026

📄 Localhost MetaMask Test Dapp

Summary

Uh oh!

mcmire left a comment

Uh oh!

mcmire Mar 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

cryptodev-2s commented Mar 23, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

@metamask/chain-agnostic-permission ^1.3.0 → ^1.4.0

@metamask/multichain-api-middleware ^1.2.5 → ^1.2.7

@metamask/ppom-validator 0.39.0 → 0.39.1

@metamask/selected-network-controller ^25.0.0 → ^26.0.3

Changelog

Related issues

Manual testing steps

Screenshots/Recordings

Pre-merge author checklist

Pre-merge reviewer checklist

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

socket-security bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cryptodev-2s commented Mar 23, 2026

Uh oh!

cryptodev-2s commented Mar 23, 2026

Uh oh!

metamaskbot commented Mar 23, 2026

Uh oh!

sonarqubecloud bot commented Mar 23, 2026

Quality Gate passed

Uh oh!

metamaskbotv2 bot commented Mar 23, 2026

📄 Localhost MetaMask Test Dapp

Summary

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

mcmire Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

cryptodev-2s commented Mar 23, 2026 •

edited by cursor bot

Loading

`@metamask/chain-agnostic-permission` `^1.3.0` → `^1.4.0`

`@metamask/multichain-api-middleware` `^1.2.5` → `^1.2.7`

`@metamask/ppom-validator` `0.39.0` → `0.39.1`

`@metamask/selected-network-controller` `^25.0.0` → `^26.0.3`

socket-security bot commented Mar 23, 2026 •

edited

Loading

socket-security bot commented Mar 23, 2026 •

edited

Loading