* origin/develop: (56 commits)
  Add advanced setting to enable editing nonce on confirmation screens (MetaMask#7089)
  Add migration on 3box imports and remove feature flag (MetaMask#7209)
  ci - install deps - limit install scripts to whitelist (MetaMask#7208)
  Add a/b test for full screen transaction confirmations (MetaMask#7162)
  Update minimum Firefox verison to 56.0 (MetaMask#7213)
  mesh-testing - submit infura rpc requests to mesh-testing container (MetaMask#7031)
  obs-store/local-store should upgrade webextension error to real error (MetaMask#7207)
  sesify-viz - bump dep for visualization enhancement (MetaMask#7175)
  address book entries by chainId (MetaMask#7205)
  Optimize images only during production build (MetaMask#7194)
  Use common test build during CI (MetaMask#7196)
  Report missing `en` locale messages to Sentry (MetaMask#7197)
  Verify locales on CI (MetaMask#7199)
  updated ganache and addons-linter (MetaMask#7204)
  fixup! add user rejected errors
  add user rejected errors
  update json-rpc-engine
  use eth-json-rpc-errors
  Remove unused locale messages (MetaMask#7190)
  Remove unused components (MetaMask#7191)
  ...

## **Description**

Bump the following packages:

### `@metamask/chain-agnostic-permission` `^1.3.0` → `^1.4.0`

[Changelog](https://github.com/MetaMask/core/blob/main/packages/chain-agnostic-permission/CHANGELOG.md#140)
- **Added:** `Bip122AccountChangedNotifications` property in
`KnownSessionProperties` enum
([#7537](MetaMask/core#7537))
- **Changed:** Remove `@metamask/network-controller` dependency
([#7561](MetaMask/core#7561))
- **Changed:** Dependency bumps (`@metamask/utils`,
`@metamask/controller-utils`, `@metamask/permission-controller`)

### `@metamask/multichain-api-middleware` `^1.2.5` → `^1.2.7`

[Changelog](https://github.com/MetaMask/core/blob/main/packages/multichain-api-middleware/CHANGELOG.md#127)
- **v1.2.7:** Dependency bumps (`network-controller` ^30.0.0,
`json-rpc-engine`, `multichain-transactions-controller`,
`controller-utils`)
- **v1.2.6 Fixed:** `wallet_revokeSession` to handle cases where
`params` is not provided
([#7551](MetaMask/core#7551))
- **v1.2.6 Changed:** Dependency bumps (`json-rpc-engine`, `utils`,
`network-controller`, `controller-utils`, `permission-controller`,
`chain-agnostic-permission`)

### `@metamask/ppom-validator` `0.39.0` → `0.39.1`

[Changelog](https://github.com/MetaMask/ppom-validator/blob/main/CHANGELOG.md#0391)
- **Changed:** Move `@metamask/network-controller` from peer to direct
dependency and bump ^25.0.0 → ^30.0.0
([#254](MetaMask/ppom-validator#254))
- **Changed:** Bump `@metamask/utils` from `^9.2.1` to `^11.0.0`
([#254](MetaMask/ppom-validator#254))

### `@metamask/selected-network-controller` `^25.0.0` → `^26.0.3`

[Changelog](https://github.com/MetaMask/core/blob/main/packages/selected-network-controller/CHANGELOG.md#2600)
- **v26.0.0 BREAKING:** Use `InternalProvider` instead of
`SafeEventEmitterProvider`
([#6796](MetaMask/core#6796))
- **v26.0.0 BREAKING:** Bump `@metamask/network-controller` from ^25.0.0
to ^26.0.0 ([#7202](MetaMask/core#7202))
- **v26.0.1:** Move peer dependencies to direct dependencies
(`network-controller`, `permission-controller`)
([#7209](MetaMask/core#7209))
- **v26.0.2–v26.0.3:** Dependency bumps (`network-controller` to
^30.0.0, `json-rpc-engine`)

No code changes required — breaking changes are internal to the packages
and don't affect extension usage. All dependency versions are already
compatible.

## **Changelog**

CHANGELOG entry: null

## **Related issues**

Fixes: N/A

## **Manual testing steps**

1. Build the extension and verify it runs correctly
2. Confirm no type errors are introduced

## **Screenshots/Recordings**

N/A — dependency-only changes

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [ ] I've included tests if applicable
- [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Dependency-only update, but it upgrades core
networking/permission-related packages (e.g.,
`@metamask/selected-network-controller` and transitive
`@metamask/network-controller`/RPC middleware), which can subtly affect
session/network behavior at runtime.
> 
> **Overview**
> Bumps several MetaMask core dependencies:
`@metamask/chain-agnostic-permission` to `^1.4.0`,
`@metamask/multichain-api-middleware` to `^1.2.7`,
`@metamask/ppom-validator` to `0.39.1`, and
`@metamask/selected-network-controller` to `^26.0.3`.
> 
> Updates `yarn.lock` accordingly, including transitive shifts such as
`@metamask/network-controller` moving to `^30.0.0` in dependent packages
and related RPC middleware/util version bumps.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
133258b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->