Repository navigation
Release 1364.0.0 - #11107
Merged
Merged
Release 1364.0.0#11107
Conversation
Contributor
|
✅ Changelogs updated and pushed. |
Mrtenz
force-pushed
the
release/1364.0.0
branch
from
October 27, 2026 09:24
3f620ca to
483dd8d
Compare
cryptodev-2s
approved these changes
Oct 27, 2026
Merged
gaohan1994
pushed a commit
to gaohan1994/core
that referenced
this pull request
Oct 28, 2026
## Explanation Scoped release so clients can pick up MetaMask#11017 and MetaMask#11041. - **`@metamask/ramps-controller` 27.2.0 → 28.0.0** (major). Persists autoramp transaction statuses and reports a new id or a changed status string through the optional `trackAutorampTransactionStatusChanged` callback. **BREAKING:** `RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS` now includes `NeoBankService:listAutorampTransactions`. Hosts that spread that list pick it up on the bump. Hosts that copy the action list by hand must delegate it. This version also includes the unpublished `@metamask/utils` range bump to `^12.0.1` from MetaMask#11107. - **`@metamask/kyc-controller` 0.12.1 → 0.13.0** (minor). Adds the optional `trackKycAnalytics` constructor callbacks (`verificationOutcome` and `statusChanged`) from MetaMask#11041. Nothing is added to `KycControllerEvents`. This version also includes the unpublished `@metamask/utils` range bump to `^12.0.1` from MetaMask#11107. - **`@metamask/transaction-pay-controller` 30.3.0 → 30.3.1** (patch). Published because `ramps-controller` is a major and this is its only workspace dependent. The range moves from `^27.2.0` to `^28.0.0`. Other packages with unreleased changes are deferred. ## References - Ships MetaMask#11017 - Ships MetaMask#11041 - Also publishes the unpublished utils range bump already on main: MetaMask#11107 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them Made with [Cursor](https://cursor.com) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > The ramps-controller major adds a required messenger action for autoramp transaction polling; hosts that hand-maintain delegated actions must update or delegation fails at runtime. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 2be3977. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
gaohan1994
pushed a commit
to gaohan1994/core
that referenced
this pull request
Oct 28, 2026
## Explanation Release `1368.0.0` with a major version bump for: - **`@metamask/transaction-pay-middleware`** `1.0.0` → `2.0.0` ### `@metamask/transaction-pay-middleware@2.0.0` **Breaking:** `wallet_pay` now selects the requested account before adding the transaction, once the request has passed every check ([MetaMask#11109](MetaMask#11109)) - The messenger must now allow `AccountsController:getAccountByAddress`, `AccountsController:getSelectedAccount` and `AccountTreeController:setSelectedAccountGroupByAccountId`. - A request whose `from` is not a known account is rejected with `4100`. Other changes: - Add support for Node.js 26 ([MetaMask#10981](MetaMask#10981)) - Accept a zero `amount` for `perpsWithdraw`, which opens the confirmation without a prefilled amount; adds optional `allowZeroAmount` to `WalletPayFlow` ([MetaMask#11114](MetaMask#11114)) - Add dependencies `@metamask/accounts-controller` (`^40.1.0`) and `@metamask/account-tree-controller` (`^11.2.0`) ([MetaMask#11109](MetaMask#11109)) - Bump `@metamask/perps-controller` from `^21.0.0` to `^22.0.0` ([MetaMask#11029](MetaMask#11029)) - Bump `@metamask/utils` from `^12.0.0` to `^12.0.1` ([MetaMask#11107](MetaMask#11107)) ### Dependency updates No packages in the monorepo depend on `@metamask/transaction-pay-middleware`, so there are no downstream range updates. All upstream dependencies are already at their released versions and were marked `intentionally-skip`. ## References - [MetaMask#11109](MetaMask#11109) — select the requested account for `wallet_pay` - [MetaMask#11114](MetaMask#11114) — accept a zero amount for `perpsWithdraw` ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Version and changelog edits only; no application code changes in this diff. > > **Overview** > Cuts **monorepo release `1368.0.0`** and publishes **`@metamask/transaction-pay-middleware@2.0.0`** by bumping root and package versions and moving unreleased changelog entries into a **`[2.0.0]`** section with updated compare links. > > The documented **2.0.0** behavior (already merged elsewhere) includes a **breaking** change: `wallet_pay` selects the `from` account before enqueueing the transaction, with new messenger actions and `4100` for unknown accounts; plus Node 26 support, optional zero `amount` for `perpsWithdraw` via `allowZeroAmount`, and dependency bumps. No other monorepo packages declare a dependency on this middleware, so this PR does not update downstream version ranges. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e9c6ee0. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
gaohan1994
pushed a commit
to gaohan1994/core
that referenced
this pull request
Oct 28, 2026
## Packages - [`@metamask/money-account-api-data-service@2.3.1`](https://github.com/MetaMask/core/blob/release/1370.0.0/packages/money-account-api-data-service/CHANGELOG.md#231) (patch) ### `@metamask/money-account-api-data-service` #### Changed - Bump `@metamask/utils` from `^12.0.0` to `^12.0.1` ([MetaMask#11107](MetaMask#11107)) #### Fixed - Validate VBA SIWE challenge messages against the expected Money Account template before signing, rejecting a message whose domain, URI, address, statement, version, chain ID, nonce, or timestamps do not match ([MetaMask#11112](MetaMask#11112)) ### Dependency notes Other changed packages (`@metamask/base-data-service`, `@metamask/controller-utils`, `@metamask/messenger`) were marked `intentionally-skip` in the release spec: their current published versions satisfy this package's dependency ranges, and their pending changes are not required by [MetaMask#11112](MetaMask#11112). The sole dependent of this package, `@metamask/money-account-balance-service`, had its dependency range updated from `^2.3.0` to `^2.3.1` in lockstep. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > The release ships SIWE pre-sign validation for VBA auth; behavior changes for invalid or tampered challenges are security-relevant even though this PR only versions and documents that fix. > > **Overview** > This PR cuts **release 1370.0.0** by bumping the root monorepo version and publishing **`@metamask/money-account-api-data-service@2.3.1`** (patch). The diff is release wiring only: package versions, changelogs, `yarn.lock`, and a dependent range update on **`@metamask/money-account-balance-service`** (`^2.3.0` → `^2.3.1`). > > **2.3.1** (documented in the changelog, not new code in this diff) includes a **`@metamask/utils`** bump to `^12.0.1` and a **security fix** that validates VBA SIWE challenge messages against the expected Money Account template before signing, rejecting mismatches in domain, URI, address, statement, version, chain ID, nonce, or timestamps ([MetaMask#11112](MetaMask#11112)). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c1fef7b. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
Merged
1 task done
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Nov 4, 2026
## Explanation Re-lands the release that was reverted in MetaMask#11187 (the revert happened because CI on main was broken; the CI issue has since been fixed via MetaMask#11191, and Release/1375.0.0 was subsequently shipped by another team in MetaMask#11192, so this release is now **Release/1376.0.0**). To avoid cutting two separate releases, this PR also folds in the `@metamask/profile-controller` patch release that was staged in MetaMask#11197 (that PR is now redundant and closed in favor of this one). Two packages are released: **`@metamask/assets-controller` 20.0.2 (patch)** — 20.0.2 was never published to npm, so this re-release is safe. - **Fixed:** hand-rolled Multicall3 `aggregate3` codecs for balance batches (MetaMask#11078) **`@metamask/profile-controller` 1.2.1 (patch)** - **Added:** `clearState` method on `ProfileController` (MetaMask#11177) - **Changed:** bump `@metamask/utils` from `^12.0.0` to `^12.0.1` (MetaMask#11107) - **Fixed:** `ProfileService.disconnectX` now calls `DELETE profiles/x/account` instead of the non-existent `DELETE profiles/{profileId}/x` endpoint, since the linked X account is resolved server-side from the verified bearer token (MetaMask#11195) All functional changes above are already merged on `main`; this diff contains only version bumps and changelog finalization (plus a merge of `main` to pick up MetaMask#11195). - `@metamask/bridge-controller` and `@metamask/transaction-pay-controller` only have their `@metamask/assets-controller` dependency range bumped to `^20.0.2`; they are intentionally not released. ## Checklist - [x] `yarn changelog:validate` passes
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Nov 4, 2026
## Explanation Releases `@metamask/money-account-mfa-whitelist@0.2.0`. This is a minor bump because the package is still `0.x` and the unreleased changes include a breaking type change. `0.2.0` moves the existing `Unreleased` entries into the new version: ### Added - Add support for Node.js 26 (MetaMask#10981) ### Changed - **BREAKING:** `DelegationFrameworkContracts` requires `TimestampEnforcer` (MetaMask#11185) - Bump `@metamask/utils` from `^12.0.0` to `^12.0.1` (MetaMask#11107) ### Fixed - Whitelist single-use vault deposit delegations that carry a `Timestamp` deadline caveat (MetaMask#11185) Consumers that construct a `DelegationFrameworkContracts` value need to supply `TimestampEnforcer`. ## Notes - `@metamask/utils` has unpublished test and CI changes only, and this package already depends on `^12.0.1`, so that package was intentionally left out of the release. - No workspace package depends on `@metamask/money-account-mfa-whitelist`. The lockfile now resolves the external `@metamask/eth-money-mpc-keyring` range `^0.1.0` to the published `0.1.0`, because `0.2.0` is outside that range. - Dropped non-consumer CI, test, and release commits that the tooling had added under `Uncategorized`. - `yarn changelog:validate` passes for `@metamask/money-account-mfa-whitelist`. ## References * MetaMask#11185 * MetaMask#11107 * MetaMask#10981 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > The release advertises a breaking type change for consumers building `DelegationFrameworkContracts`; the PR itself only bumps versions and the lockfile. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit abd4ae1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
This is the release candidate for version
1364.0.0.References
Checklist
Note
Low Risk
Diff is version and changelog updates only;
@metamask/utils12.0.1 keeps the public API via re-exports while publishing the split utility packages.Overview
Monorepo release
1364.0.0— bumps the root version and aligns workspacepackage.json/ changelog entries; there are no source changes in this diff.The release centers on
@metamask/utils@12.0.1, which pins the newly published split packages@metamask/byte-utils,@metamask/error-utils,@metamask/node-utils, and@metamask/type-utilsat0.1.0. Those four packages get their first versioned release notes in this PR; downstream controllers and services update their@metamask/utilsdependency from^12.0.0to^12.0.1(and a few tools bump the new utils packages directly, e.g.messenger-cli, root devDependencies).Consumers still import from
@metamask/utilsas before (re-exports are unchanged per the utils changelog); this PR is mainly publishing and dependency propagation across the monorepo.Reviewed by Cursor Bugbot for commit 483dd8d. Bugbot is set up for automated code reviews on this repo. Configure here.