Skip to content

chore: bump assets controllers to v95.3.0#24719

Merged
salimtb merged 2 commits intomainfrom
chore/bump-assets-controllers-v95.3.0
Jan 16, 2026
Merged

chore: bump assets controllers to v95.3.0#24719
salimtb merged 2 commits intomainfrom
chore/bump-assets-controllers-v95.3.0

Conversation

@salimtb
Copy link
Copy Markdown
Contributor

@salimtb salimtb commented Jan 16, 2026 •
edited by cursor bot
Loading

Description

bump assets controllers to v95.3.0

Changelog

CHANGELOG entry: bump assets controllers to v95.3.0

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Upgrades asset management and aligns dependent controllers with the latest network stack. No app code changes; dependency-only.

  • Bump @metamask/assets-controllers to ^95.3.0
  • Lockfile updates cascade to newer controller versions: accounts-controller@^35.0.2, network-controller@^29.0.0 (introduces connectivity-controller@^0.1.0), polling-controller@^16.0.2, gas-fee-controller@^26.0.2, transaction-controller@^62.9.2
  • Supporting bumps: eth-block-tracker@^15.0.1, json-rpc-engine@^10.2.1, eth-json-rpc-middleware@^23.0.0, plus minor @metamask/utils alignment
  • Only package.json dep pin and yarn.lock resolution changes

Written by Cursor Bugbot for commit a04e86d. This will update automatically on new commits. Configure here.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jan 16, 2026

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@salimtb salimtb force-pushed the chore/bump-assets-controllers-v95.3.0 branch from 8b2fd01 to eb34fa1 Compare January 16, 2026 09:05
@socket-security
Copy link
Copy Markdown

socket-security bot commented Jan 16, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​metamask/​assets-controllers@​95.1.0 ⏵ 95.3.09510091 +198 +1100
Updatednpm/​@​metamask/​json-rpc-engine@​10.2.0 ⏵ 10.2.19910010092 +5100

View full report

@socket-security
Copy link
Copy Markdown

socket-security bot commented Jan 16, 2026 •
edited
Loading

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

  • npm/@metamask/eth-json-rpc-middleware@23.0.0
  • npm/@metamask/eth-block-tracker@15.0.1

View full report

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jan 16, 2026

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeAccounts, SmokeConfirmationsRedesigned, SmokeNetworkAbstractions, SmokeWalletPlatform, SmokeTrade, SmokeRamps, SmokePerps
  • Risk Level: high
  • AI Confidence: 85%
click to see 🤖 AI reasoning details

This PR updates @metamask/assets-controllers from 95.1.0 to 95.3.0, which is a critical controller package. The yarn.lock shows significant transitive dependency updates:

  1. Network Controller: Major version bump from 27.2.0/28.0.0 to 29.0.0 - this affects all network-related functionality
  2. Transaction Controller: Updated to 62.9.2 - affects transaction processing
  3. Accounts Controller: Updated to 35.0.2 - affects account management
  4. Gas Fee Controller: Updated to 26.0.2 - affects gas estimation
  5. New packages: connectivity-controller 0.1.0 and eth-json-rpc-middleware 23.0.0

The assets-controllers package is used extensively throughout the codebase for:

  • Token management (TokensController, TokenListController, TokenDetectionController)
  • NFT handling (NftController, NftDetectionController)
  • Confirmation flows (multiple hooks import types from this package)
  • Trending/search features
  • Multichain balances

Given the scope of changes affecting core wallet infrastructure (network, transactions, accounts, gas fees, tokens, NFTs), this is a high-risk change that requires comprehensive testing across multiple functional areas. I'm selecting tags that cover the main impacted areas while excluding unrelated features like Identity sync, Card, Rewards, Predictions, and Flask/Snaps which don't appear to be directly affected by these controller updates.

View GitHub Actions results

@salimtb
Copy link
Copy Markdown
Contributor Author

salimtb commented Jan 16, 2026

@SocketSecurity ignore npm/@metamask/eth-json-rpc-middleware@23.0.0

Reasoning: Reviewed source for @metamask/eth-json-rpc-middleware@23.0.0. The globalThis.fetch reference is used for (e.g., optional environment detection / transport / polyfill). No unexpected external endpoints found; network behavior is controlled by consumer-provided RPC URL/provider. No evidence of obfuscation, dynamic eval, or suspicious exfiltration patterns.

@salimtb
Copy link
Copy Markdown
Contributor Author

salimtb commented Jan 16, 2026

@SocketSecurity ignore npm/@metamask/eth-block-tracker@15.0.1

Reasoning: Reviewed source for @metamask/eth-block-tracker@15.0.1. The globalThis.fetch usage is related to expected network activity for block tracking via the configured Ethereum JSON-RPC provider/R

@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Jan 16, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@salimtb salimtb marked this pull request as ready for review January 16, 2026 09:39
@salimtb salimtb added this pull request to the merge queue Jan 16, 2026
Merged via the queue into main with commit 708786f Jan 16, 2026
168 of 171 checks passed
@salimtb salimtb deleted the chore/bump-assets-controllers-v95.3.0 branch January 16, 2026 10:28
@github-actions github-actions bot locked and limited conversation to collaborators Jan 16, 2026
@metamaskbot metamaskbot added the release-7.63.0 Issue or pull request that will be included in release 7.63.0 label Jan 16, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@bergarces bergarces bergarces approved these changes

Assignees

No one assigned

Labels

release-7.63.0 Issue or pull request that will be included in release 7.63.0 size-XS team-assets

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@salimtb @bergarces @metamaskbot