Skip to content

release: 7.68.2#27393

Merged
chloeYue merged 4 commits into
stablefrom
release/7.68.2
Mar 12, 2026
Merged

release: 7.68.2#27393
chloeYue merged 4 commits into
stablefrom
release/7.68.2

Conversation

@metamaskbot

Copy link
Copy Markdown
Collaborator

🚀 v7.68.2 Testing & Release Quality Process

Hi Team,
As part of our new MetaMask Release Quality Process, here’s a quick overview of the key processes, testing strategies, and milestones to ensure a smooth and high-quality deployment.


📋 Key Processes

Testing Strategy

  • Developer Teams:
    Conduct regression and exploratory testing for your functional areas, including automated and manual tests for critical workflows.
  • QA Team:
    Focus on exploratory testing across the wallet, prioritize high-impact areas, and triage any Sentry errors found during testing.
  • Customer Success Team:
    Validate new functionalities and provide feedback to support release monitoring.

GitHub Signoff

  • Each team must sign off on the Release Candidate (RC) via GitHub by the end of the validation timeline (Tuesday EOD PT).
  • Ensure all tests outlined in the Testing Plan are executed, and any identified issues are addressed.

Issue Resolution

  • Resolve all Release Blockers (Sev0 and Sev1) by Tuesday EOD PT.
  • For unresolved blockers, PRs may be reverted, or feature flags disabled to maintain release quality and timelines.

Cherry-Picking Criteria

  • Only critical fixes meeting outlined criteria will be cherry-picked.
  • Developers must ensure these fixes are thoroughly reviewed, tested, and merged by Tuesday EOD PT.

🗓️ Timeline and Milestones

  1. Today (Friday): Begin Release Candidate validation.
  2. Tuesday EOD PT: Finalize RC with all fixes and cherry-picks.
  3. Wednesday: Buffer day for final checks.
  4. Thursday: Submit release to app stores and begin rollout to 1% of users.
  5. Monday: Scale deployment to 10%.
  6. Tuesday: Full rollout to 100%.

✅ Signoff Checklist

Each team is responsible for signing off via GitHub. Use the checkbox below to track signoff completion:

Team sign-off checklist

  • Mobile Platform

This process is a major step forward in ensuring release stability and quality. Let’s stay aligned and make this release a success! 🚀

Feel free to reach out if you have questions or need clarification.

Many thanks in advance

Reference

@metamaskbot metamaskbot added the team-bots Bot team (for MetaMask Bot, Runway Bot, etc.) label Mar 11, 2026
@github-actions

Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

⏭️ Smart E2E selection skipped - base branch is not main (base: stable)

All E2E tests pre-selected.

View GitHub Actions results

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​metamask/​snaps-controllers@​18.0.2 ⏵ 18.0.471 +110076 +198 +250
Addednpm/​@​metamask/​snaps-rpc-methods@​15.0.098100769650
Updatednpm/​@​metamask/​snaps-execution-environments@​11.0.0 ⏵ 11.0.199 +11007797 +180

View full report

@socket-security

Copy link
Copy Markdown

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block High
Publisher changed: npm ses is now published by boneskull

Author: boneskull

From: ?npm/@metamask/profile-sync-controller@27.1.0npm/@metamask/account-tree-controller@4.1.1npm/@metamask/multichain-transactions-controller@7.0.1npm/@metamask/multichain-account-service@7.0.0npm/@metamask/assets-controller@2.0.0npm/@metamask/bridge-controller@66.2.0npm/@metamask/bridge-status-controller@66.1.0npm/@metamask/accounts-controller@36.0.1npm/@metamask/assets-controllers@100.0.3npm/@metamask/transaction-pay-controller@16.1.2npm/@metamask/snaps-utils@12.1.1npm/@metamask/gator-permissions-controller@0.3.0npm/ses@1.15.0

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ses@1.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm ses is now published by boneskull instead of kriskowal

New Author: boneskull

Previous Author: kriskowal

From: ?npm/@metamask/profile-sync-controller@27.1.0npm/@metamask/account-tree-controller@4.1.1npm/@metamask/multichain-transactions-controller@7.0.1npm/@metamask/multichain-account-service@7.0.0npm/@metamask/assets-controller@2.0.0npm/@metamask/bridge-controller@66.2.0npm/@metamask/bridge-status-controller@66.1.0npm/@metamask/accounts-controller@36.0.1npm/@metamask/assets-controllers@100.0.3npm/@metamask/transaction-pay-controller@16.1.2npm/@metamask/snaps-utils@12.1.1npm/@metamask/gator-permissions-controller@0.3.0npm/ses@1.15.0

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ses@1.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@weitingsun weitingsun changed the base branch from stable to release/7.68.0 March 12, 2026 01:20
@weitingsun weitingsun closed this Mar 12, 2026
@github-actions github-actions Bot locked and limited conversation to collaborators Mar 12, 2026
@weitingsun weitingsun reopened this Mar 12, 2026
The encryptorAdapter introduced in PR #26258 overrides encryptWithKey to
return browser-passworder format ({ data }) instead of the mobile Encryptor
format ({ cipher }). However, decrypt and decryptWithDetail were not
overridden — they were spread from the mobile Encryptor, which reads the
cipher field. This caused a crash on the next unlock after any background
JWT token refresh:

  TypeError: The first argument must be one of type string, Buffer...
  Received type undefined (quick-crypto.ts:101)

Fix: add normalizeVaultFormat which injects cipher = data when a vault has
data but no cipher, and override decrypt and decryptWithDetail in the
adapter to normalize before delegating to the underlying Encryptor.

Also harden decryptWithKey to accept both data and cipher fields (for
pre-adapter vaults that only carry cipher), and throw explicitly when
both fields are absent.

Adds end-to-end tests that reproduce the bug scenario: background token
refresh writes a data-format vault via encryptWithKey, then decrypt /
decryptWithDetail must recover it on the next unlock.
@github-actions github-actions Bot added size-M and removed size-S labels Mar 12, 2026
@weitingsun weitingsun requested a review from Cal-L March 12, 2026 05:05
Cal-L
Cal-L previously approved these changes Mar 12, 2026

@Cal-L Cal-L left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

ieow
ieow previously approved these changes Mar 12, 2026

@ieow ieow left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@weitingsun weitingsun marked this pull request as ready for review March 12, 2026 05:26
@weitingsun weitingsun requested a review from a team as a code owner March 12, 2026 05:26
@weitingsun weitingsun changed the base branch from release/7.68.0 to stable March 12, 2026 05:30
@weitingsun weitingsun dismissed stale reviews from ieow and Cal-L March 12, 2026 05:30

The base branch was changed.

@weitingsun weitingsun changed the base branch from stable to release/7.68.0 March 12, 2026 05:36
@weitingsun weitingsun changed the base branch from release/7.68.0 to release/tag-7.68.0 March 12, 2026 05:52
Cal-L
Cal-L previously approved these changes Mar 12, 2026

@Cal-L Cal-L left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. The temp target branch is used since release/7.68.0 included other changes post release. This temp branch is based off of the fixed v7.68.0 tag, which is what was released.

@chloeYue chloeYue changed the base branch from release/tag-7.68.0 to stable March 12, 2026 13:09
@chloeYue chloeYue dismissed Cal-L’s stale review March 12, 2026 13:09

The base branch was changed.

Made-with: Cursor

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I've included tests if applicable
- [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk documentation-only change that updates the changelog and
version compare links; no runtime behavior is modified.
> 
> **Overview**
> Adds a new `7.68.2` section to `CHANGELOG.md` documenting a fix for
seedless onboarding users being locked out after a background token
refresh.
> 
> Updates the changelog reference links so `Unreleased` now compares
from `v7.68.2` and includes a new `7.68.2` compare link.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
41e109b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@chloeYue chloeYue enabled auto-merge March 12, 2026 13:24
@chloeYue chloeYue disabled auto-merge March 12, 2026 13:24
@chloeYue chloeYue merged commit c97a678 into stable Mar 12, 2026
103 of 107 checks passed
@metamaskbot metamaskbot added the release-7.68.2 Issue or pull request that will be included in release 7.68.2 label Mar 13, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

release-7.68.2 Issue or pull request that will be included in release 7.68.2 size-M team-bots Bot team (for MetaMask Bot, Runway Bot, etc.)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants