Repository navigation
chore: add support for Node.js 26 - #10981
Merged
Merged
Conversation
Mrtenz
force-pushed
the
mrtenz/ci-node-26
branch
2 times, most recently
from
October 22, 2026 14:16
d1ff756 to
3724e37
Compare
Add Node.js 26.x to the `prepare` and `test-wallet-cli-e2e` matrices, and add a `test-26` job alongside `test-22` and `test-24`. Jobs that only ran on 24.x (lint, build, scripts, changelog, API docs) now run on 26.x, so the newest version is covered everywhere.
CI now runs on Node.js 26, so the `engines` field in the root and every package `package.json` should also accept it. This changes the range to `^22.14.0 || ^24 || ^26` and updates the Yarn constraint in `yarn.config.cjs` to enforce it.
The `engines` field of every package now accepts Node.js 26, and consumers see that change. Add an "Added" entry linking to the PR under the Unreleased section of each package changelog.
Mrtenz
force-pushed
the
mrtenz/ci-node-26
branch
from
October 22, 2026 15:52
8c8f645 to
5869c98
Compare
Mrtenz
marked this pull request as ready for review
October 22, 2026 15:56
3 of 4 tasks
Merged
Merged
1 of 4 tasks
SnowingFox
pushed a commit
to SnowingFox/core-1
that referenced
this pull request
Oct 24, 2026
## Explanation `.nvmrc` pointed at `lts/*`, which currently resolves to Node.js 24. This pins it to Node.js 26.12.1. The LavaMoat harden plugin implementation in MetaMask#9937 needs Node.js 26, and this release also includes an RCE fix. We can revert this when `lts/*` points to 26. ## References * Related to MetaMask#9937 * Follows MetaMask#10981 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Developer-environment only; no application runtime or auth/data-path changes, though contributors must install Node 26.12.1. > > **Overview** > Pins the repo’s Node version in `.nvmrc` from the floating `lts/*` alias to **26.12.1**, so local and tooling setups use a fixed Node 26 release instead of whatever LTS resolves to today (e.g. Node 24). > > This aligns the documented/runtime Node version with upcoming work that requires Node 26 (e.g. LavaMoat harden plugin) and picks a specific patch that includes security fixes. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0a55447. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
SnowingFox
pushed a commit
to SnowingFox/core-1
that referenced
this pull request
Oct 24, 2026
## Packages - [`@metamask/money-account-api-data-service@2.3.0`](https://github.com/MetaMask/core/blob/release/1355.0.0/packages/money-account-api-data-service/CHANGELOG.md#230) (minor) ### `@metamask/money-account-api-data-service` #### Added - Add SIWE-authenticated `fetchVbaTransfers` and `MoneyAccountApiDataService:fetchVbaTransfers` to read current VBA transfers for a wallet, with wallet-scoped in-memory sessions ([MetaMask#11012](MetaMask#11012)) - Add support for Node.js 26 ([MetaMask#10981](MetaMask#10981)) Other changed packages (`@metamask/base-data-service`, `@metamask/controller-utils`, `@metamask/messenger`, `@metamask/utils`) were marked `intentionally-skip` in the release spec: their current published versions satisfy this package's dependency ranges, and their pending changes are not required by [MetaMask#11012](MetaMask#11012). The sole dependent of this package, `@metamask/money-account-balance-service`, had its dependency range updated from `^2.2.0` to `^2.3.0` in lockstep. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Release-only version, changelog, and dependency lockfile updates; no runtime code changes in this diff. > > **Overview** > **Release 1355.0.0** cuts **`@metamask/money-account-api-data-service@2.3.0`** (monorepo root **1354.0.0 → 1355.0.0**). The changelog for 2.3.0 documents the shipped API surface: SIWE-authenticated **`fetchVbaTransfers`** / **`MoneyAccountApiDataService:fetchVbaTransfers`** for wallet VBA transfers (wallet-scoped in-memory sessions) and **Node.js 26** support—those behaviors land via prior merges; this PR is versioning and release notes, not new implementation in the diff. > > **`@metamask/money-account-balance-service`** is updated in lockstep: dependency **`@metamask/money-account-api-data-service`** **`^2.2.0` → `^2.3.0`**, with its changelog noting the bump from **`^2.1.0` to `^2.3.0`**. **`yarn.lock`** reflects the new resolution range. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 854999d. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
SnowingFox
pushed a commit
to SnowingFox/core-1
that referenced
this pull request
Oct 24, 2026
## Explanation Major release of `@metamask/perps-controller` (`21.0.0` → `22.0.0`). - **Breaking:** testnet deposit and withdrawal routes use Arbitrum Sepolia USDC2 (`0x1baAbB04529D43a73232B713C0FE471f7c7334d5`). `USDC_ARBITRUM_TESTNET_ADDRESS` and `HYPERLIQUID_ASSET_CONFIGS.usdc.testnet` change to that address, and `withdraw` rejects the previous testnet asset ID. `depositWithConfirmation` prepares an Arbitrum Sepolia transfer to the Hyperliquid testnet bridge. ([MetaMask#10991](MetaMask#10991)) - `TrackingData`, `TPSLTrackingData`, and `WithdrawParams` accept an optional `environmentType`. Events that already copy attribution include `environment_type` when it is set. ([MetaMask#10899](MetaMask#10899)) - New export `@metamask/perps-controller/providers/lighter`, plus optional `LighterCredentials.loadProvider`, so a web client can bundle Lighter itself. `switchProvider('lighter')` reports why the provider failed to load. A missing Lighter module is debug-logged instead of sent through `logger.error`. ([MetaMask#10996](MetaMask#10996)) - The `closePositions` summary event includes `order_type: 'market'`. ([MetaMask#11027](MetaMask#11027)) - Engines allow Node.js 26. ([MetaMask#10981](MetaMask#10981)) ## References - [MetaMask#10991](MetaMask#10991) - [MetaMask#10899](MetaMask#10899) - [MetaMask#10996](MetaMask#10996) - [MetaMask#11027](MetaMask#11027) - [MetaMask#10981](MetaMask#10981) ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Major perps-controller release with breaking testnet token/bridge behavior; this PR only bumps versions but consumers picking up 22.0.0 inherit that risk. > > **Overview** > **Monorepo release 1359.0.0** that publishes **`@metamask/perps-controller` 22.0.0** and bumps **`@metamask/transaction-pay-middleware`** to depend on `^22.0.0` (plus `yarn.lock` and root package version). > > The diff is mostly versioning and changelog housekeeping; the shipped **22.0.0** behavior (already merged) includes a **breaking testnet USDC2 / Arbitrum Sepolia deposit path** change, optional **`environmentType`** on perps tracking/withdraw params, **Lighter** `loadProvider` + public provider export, **`closePositions`** analytics `order_type: 'market'`, and **Node.js 26** engine support. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 8356d7d. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
SnowingFox
pushed a commit
to SnowingFox/core-1
that referenced
this pull request
Oct 24, 2026
## Explanation Minor release of `@metamask/wallet` (`19.0.0` → `19.1.0`). - Add support for Node.js 26. ([MetaMask#10981](MetaMask#10981)) - Fall back to `options.analyticsId` when persisted `analyticsId` is null, undefined, or empty. ([MetaMask#11025](MetaMask#11025)) ## References - [MetaMask#10981](MetaMask#10981) - [MetaMask#11025](MetaMask#11025) ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Version and changelog-only release; included analytics ID fallback is a narrow initialization fix and Node 26 is an engines declaration update. > > **Overview** > **Release monorepo `1360.0.0` and publish `@metamask/wallet` `19.1.0`.** The diff is version bumps in the root `package.json` and `packages/wallet/package.json`, plus changelog housekeeping for the wallet package. > > The **19.1.0** notes (moved out of `[Unreleased]`) cover two already-merged changes: **Node.js 26** support in the package engines matrix, and a fix so wallet `AnalyticsController` initialization uses **`options.analyticsId`** when persisted state has a null, undefined, or empty `analyticsId` (non-empty persisted values still win). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 8d14cef. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
Merged
1 of 4 tasks
gaohan1994
pushed a commit
to gaohan1994/core
that referenced
this pull request
Oct 27, 2026
## Explanation Major release of `@metamask/wallet` (`19.1.0` → `20.0.0`). - **Breaking:** Add `GeolocationController` and `GeolocationApiService` to the default initialization configurations. Optional `instanceOptions.geolocationApiService` accepts `env`, `fetch`, `ttlMs`, and `policyOptions` (defaults to production and `globalThis.fetch`). Hosts that already register these on the wallet root messenger must remove them before upgrading, or messenger registration will collide. Hosts no longer need to register `GeolocationController` when `AnalyticsController` `isGeolocationEnabled` is `true`. ([MetaMask#11058](MetaMask#11058)) - Add `@metamask/geolocation-controller` as a dependency. ([MetaMask#11058](MetaMask#11058)) Minor release of `@metamask/analytics-controller` (`4.0.0` → `4.1.0`). - Add support for Node.js 26. ([MetaMask#10981](MetaMask#10981)) - Accept partial initial `state` as long as `analyticsId` is provided. ([MetaMask#10901](MetaMask#10901)) - Bump `@metamask/base-controller` from `^10.0.0` to `^10.1.0`. ([MetaMask#10864](MetaMask#10864)) Dependent packages (`@metamask/marketing-consent-controller`, `@metamask/network-controller`, `@metamask/notification-services-controller`, `@metamask/seedless-onboarding-controller`, `@metamask/wallet`) now depend on `@metamask/analytics-controller` `^4.1.0`. ## References - [MetaMask#11058](MetaMask#11058) - [MetaMask#10981](MetaMask#10981) - [MetaMask#10901](MetaMask#10901) - [MetaMask#10864](MetaMask#10864) ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them Made with [Cursor](https://cursor.com) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > Wallet 20.0.0 carries a documented breaking change to default controller registration (geolocation), so consumers upgrading from this release can hit messenger collisions or required migration steps even though this PR only versions and documents prior work. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 16059ef. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
gaohan1994
pushed a commit
to gaohan1994/core
that referenced
this pull request
Oct 28, 2026
## Explanation Release `1368.0.0` with a major version bump for: - **`@metamask/transaction-pay-middleware`** `1.0.0` → `2.0.0` ### `@metamask/transaction-pay-middleware@2.0.0` **Breaking:** `wallet_pay` now selects the requested account before adding the transaction, once the request has passed every check ([MetaMask#11109](MetaMask#11109)) - The messenger must now allow `AccountsController:getAccountByAddress`, `AccountsController:getSelectedAccount` and `AccountTreeController:setSelectedAccountGroupByAccountId`. - A request whose `from` is not a known account is rejected with `4100`. Other changes: - Add support for Node.js 26 ([MetaMask#10981](MetaMask#10981)) - Accept a zero `amount` for `perpsWithdraw`, which opens the confirmation without a prefilled amount; adds optional `allowZeroAmount` to `WalletPayFlow` ([MetaMask#11114](MetaMask#11114)) - Add dependencies `@metamask/accounts-controller` (`^40.1.0`) and `@metamask/account-tree-controller` (`^11.2.0`) ([MetaMask#11109](MetaMask#11109)) - Bump `@metamask/perps-controller` from `^21.0.0` to `^22.0.0` ([MetaMask#11029](MetaMask#11029)) - Bump `@metamask/utils` from `^12.0.0` to `^12.0.1` ([MetaMask#11107](MetaMask#11107)) ### Dependency updates No packages in the monorepo depend on `@metamask/transaction-pay-middleware`, so there are no downstream range updates. All upstream dependencies are already at their released versions and were marked `intentionally-skip`. ## References - [MetaMask#11109](MetaMask#11109) — select the requested account for `wallet_pay` - [MetaMask#11114](MetaMask#11114) — accept a zero amount for `perpsWithdraw` ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Version and changelog edits only; no application code changes in this diff. > > **Overview** > Cuts **monorepo release `1368.0.0`** and publishes **`@metamask/transaction-pay-middleware@2.0.0`** by bumping root and package versions and moving unreleased changelog entries into a **`[2.0.0]`** section with updated compare links. > > The documented **2.0.0** behavior (already merged elsewhere) includes a **breaking** change: `wallet_pay` selects the `from` account before enqueueing the transaction, with new messenger actions and `4100` for unknown accounts; plus Node 26 support, optional zero `amount` for `perpsWithdraw` via `allowZeroAmount`, and dependency bumps. No other monorepo packages declare a dependency on this middleware, so this PR does not update downstream version ranges. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e9c6ee0. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Nov 4, 2026
## Explanation Releases `@metamask/money-account-mfa-whitelist@0.2.0`. This is a minor bump because the package is still `0.x` and the unreleased changes include a breaking type change. `0.2.0` moves the existing `Unreleased` entries into the new version: ### Added - Add support for Node.js 26 (MetaMask#10981) ### Changed - **BREAKING:** `DelegationFrameworkContracts` requires `TimestampEnforcer` (MetaMask#11185) - Bump `@metamask/utils` from `^12.0.0` to `^12.0.1` (MetaMask#11107) ### Fixed - Whitelist single-use vault deposit delegations that carry a `Timestamp` deadline caveat (MetaMask#11185) Consumers that construct a `DelegationFrameworkContracts` value need to supply `TimestampEnforcer`. ## Notes - `@metamask/utils` has unpublished test and CI changes only, and this package already depends on `^12.0.1`, so that package was intentionally left out of the release. - No workspace package depends on `@metamask/money-account-mfa-whitelist`. The lockfile now resolves the external `@metamask/eth-money-mpc-keyring` range `^0.1.0` to the published `0.1.0`, because `0.2.0` is outside that range. - Dropped non-consumer CI, test, and release commits that the tooling had added under `Uncategorized`. - `yarn changelog:validate` passes for `@metamask/money-account-mfa-whitelist`. ## References * MetaMask#11185 * MetaMask#11107 * MetaMask#10981 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > The release advertises a breaking type change for consumers building `DelegationFrameworkContracts`; the PR itself only bumps versions and the lockfile. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit abd4ae1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
CI only covers Node.js 22 and 24. This adds Node.js 26.x to the
prepareandtest-wallet-cli-e2ematrices and adds atest-26job next totest-22andtest-24. These are separate jobs because a single matrix is capped at 256 combinations. Jobs that previously ran only on 24.x (lint, build, scripts, changelog validation, API docs) now run on 26.x. Thepreparesteps that compute changed packages stay on 24.x.References
None.
Checklist
Note
Low Risk
Tooling and CI matrix updates with no application runtime logic changes; script flag removal could affect contributors still running those scripts only on older Node without equivalent TS support.
Overview
Adds Node.js 26 to the supported engine range (
^22.14.0 || ^24 || ^26) across the root and workspace packages, with matching Unreleased changelog notes.CI expands the
preparematrix to include 26.x, moves lint/build/changelog/script/docs jobs from 24.x to 26.x, and introduces atest-26job (mirroring existing per-package test jobs) so changed packages are exercised on 26 without blowing the matrix size limit.Package npm scripts that run TypeScript via
node --import …/register.tsno longer pass--experimental-transform-types(includingmessenger-clitests), aligning local/CI script invocation with Node 26.Reviewed by Cursor Bugbot for commit 5869c98. Bugbot is set up for automated code reviews on this repo. Configure here.