Release 1367.0.0 by georgeweiler · Pull Request #11141 · MetaMask/core

georgeweiler · 2026-10-27T18:43:15Z

Explanation

Scoped release so clients can pick up #11017 and #11041.

@metamask/ramps-controller 27.2.0 → 28.0.0 (major). Persists autoramp transaction statuses and reports a new id or a changed status string through the optional trackAutorampTransactionStatusChanged callback. BREAKING: RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS now includes NeoBankService:listAutorampTransactions. Hosts that spread that list pick it up on the bump. Hosts that copy the action list by hand must delegate it. This version also includes the unpublished @metamask/utils range bump to ^12.0.1 from Release 1364.0.0 #11107.
@metamask/kyc-controller 0.12.1 → 0.13.0 (minor). Adds the optional trackKycAnalytics constructor callbacks (verificationOutcome and statusChanged) from feat(kyc-controller): publish verificationStatusChanged for analytics #11041. Nothing is added to KycControllerEvents. This version also includes the unpublished @metamask/utils range bump to ^12.0.1 from Release 1364.0.0 #11107.
@metamask/transaction-pay-controller 30.3.0 → 30.3.1 (patch). Published because ramps-controller is a major and this is its only workspace dependent. The range moves from ^27.2.0 to ^28.0.0.

Other packages with unreleased changes are deferred.

References

Ships feat(ramps-controller): diff autoramp transaction statuses #11017
Ships feat(kyc-controller): publish verificationStatusChanged for analytics #11041
Also publishes the unpublished utils range bump already on main: Release 1364.0.0 #11107

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Made with Cursor

Note

Medium Risk
The ramps-controller major adds a required messenger action for autoramp transaction polling; hosts that hand-maintain delegated actions must update or delegation fails at runtime.

^{Reviewed by Cursor Bugbot for commit 2be3977. Bugbot is set up for automated code reviews on this repo. Configure here.}

Co-authored-by: Cursor <cursoragent@cursor.com>

metamask-ci · 2026-10-27T18:47:28Z

✅ No changelog changes needed.

…ask#38322) ## **Description** Adopts the two controller releases that the VBA / KYC analytics work depends on, and nothing else. No app behaviour changes. - `@metamask/kyc-controller` `^0.12.0` → `^0.13.0` - `@metamask/ramps-controller` `^27.1.0` → `^28.0.0` This is deliberately split out from the three analytics PRs that consume these APIs ([MetaMask#38078](MetaMask#38078), [MetaMask#38160](MetaMask#38160), [MetaMask#38161](MetaMask#38161)) for four reasons: 1. **`ramps-controller` is a major bump** (27.1.0 → 28.0.0, also skipping 27.2.0). That is a Ramps/platform review, not an analytics review, and it should not be buried in a PR about Segment events. 2. **One lockfile change instead of three.** If each analytics PR bumped, whichever merged first would force the other two to re-resolve `yarn.lock`. 3. **It makes the analytics PRs verifiable.** All three currently reference APIs that did not exist in the installed versions, so none of them can produce a meaningful `lint:tsc` result until this lands. 4. **Revert safety.** If the bump regresses something unrelated, it reverts on its own. ### The breaking change is a no-op for us `ramps-controller@28.0.0` has one breaking change: > **BREAKING:** `RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS` now includes `NeoBankService:listAutorampTransactions`. Hosts must delegate that action to `RampsController`. No code change is needed here. [`ramps-controller-messenger.ts`](https://github.com/MetaMask/metamask-mobile/blob/main/app/core/Engine/messengers/ramps-controller-messenger/ramps-controller-messenger.ts#L47) already spreads the package-owned list rather than enumerating actions: ```ts actions: [ // Spread the package-owned required list so new service actions // (e.g. getDefaultRedirectCallbackUrl / NeoBankService) cannot be // forgotten at upgrade. ...RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS, ... ], ``` and `NeoBankService` is registered as a messenger client in `Engine.ts`, so the new action is delegated automatically. ### Reviewer note: `ramps-controller` is now duplicated in the tree `@metamask/transaction-pay-controller@30.2.0` depends on `@metamask/ramps-controller@^27.1.0`, so this bump un-dedupes it: ``` ├─ @metamask/transaction-pay-controller@npm:30.2.0 │ └─ @metamask/ramps-controller@npm:27.1.0 (via npm:^27.1.0) └─ metamask@workspace:. └─ @metamask/ramps-controller@npm:28.0.0 (via npm:^28.0.0) ``` TPC references ramps in its messenger types (`RampsControllerGetOrderAction`, `RampsControllerGetQuoteWithFeesAction`). Those action shapes are unchanged in 28.0.0 — the only breaking change was the constant above — and `lint:tsc` passes, so this is a bundle-size cost rather than a correctness one. Flagging it so it is a conscious decision: the clean fix is a TPC release that widens its range to `^28.0.0`, which can follow separately. ## **Changelog** CHANGELOG entry: null ## **Related issues** Refs: MetaMask/core#11017 Refs: MetaMask/core#11041 Refs: MetaMask/core#11141 ## **Manual testing steps** ```gherkin Feature: VBA and KYC flows still work on the bumped controllers Scenario: Autoramp transactions still load on the VBA details screen Given a Money account with an approved autoramp When the user opens the virtual bank account details screen Then the deposit instructions render And no "action not registered" error is raised for NeoBankService:listAutorampTransactions Scenario: KYC identity verification still launches Given a user part way through VBA onboarding When the user reaches the identity verification step Then the SumSub webview opens as before And the stored KYC status still updates when the decision arrives ``` ## **Screenshots/Recordings** N/A — dependency bump with no UI change. ### **Before** N/A ### **After** N/A ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable — no new code, so no new tests. The existing ramps, KYC and ramps-messenger suites were run against the bumped packages (12 suites, 138 tests). - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable — N/A, no new code. - [ ] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. #### Performance checks (if applicable) - [ ] I've tested on Android - [ ] I've tested with a power user scenario - [ ] I've instrumented key operations with Sentry traces for production performance metrics Not applicable: no runtime code changes. The one performance-relevant consequence is the duplicated `ramps-controller` noted above, which is a bundle-size effect rather than a runtime one. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Major ramps-controller bump touches VBA/autoramp and KYC-adjacent flows; runtime wiring appears pre-covered, but regressions in money onboarding are still possible. > > **Overview** > Dependency-only PR that upgrades **`@metamask/kyc-controller`** (`^0.12.0` → `^0.13.0`) and **`@metamask/ramps-controller`** (`^27.1.0` → `^28.0.0`), with matching **`yarn.lock`** resolution. No application logic changes beyond keeping tests aligned with the new controller default state. > > The test background snapshot adds **`autorampTransactionRecords: {}`** under **`RampsController`**, matching new state shipped in ramps-controller 28. **`ramps-controller-messenger.ts`** already spreads **`RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS`**, so the 28.0 breaking requirement to delegate **`NeoBankService:listAutorampTransactions`** does not need a separate host change here. > > This bump is split ahead of VBA/KYC analytics PRs that depend on these package APIs. Note that **`transaction-pay-controller`** may still pull **`ramps-controller@27.x`**, so the tree can temporarily carry two versions until TPC widens its range. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 49c0f97. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

georgeweiler and others added 4 commits October 27, 2026 12:36

Initialize Release 1367.0.0

5944d2a

Update Release 1367.0.0

056650e

chore: drop test-only changelog entries and record the ramps range bump

57fc264

Co-authored-by: Cursor <cursoragent@cursor.com>

chore: link the ramps-controller bump to the release PR

2be3977

Co-authored-by: Cursor <cursoragent@cursor.com>

georgeweiler marked this pull request as ready for review October 27, 2026 18:43

georgeweiler requested a review from a team as a code owner October 27, 2026 18:43

georgeweiler added the release:keep-open Prevent auto-close of inactive release/* PRs (3h) label Oct 27, 2026

georgeweiler requested review from a team as code owners October 27, 2026 18:43

georgeweiler temporarily deployed to default-branch October 27, 2026 18:43 — with GitHub Actions Inactive

cryptodev-2s approved these changes Oct 27, 2026

View reviewed changes

georgeweiler temporarily deployed to default-branch October 27, 2026 18:45 — with GitHub Actions Inactive

georgeweiler enabled auto-merge October 27, 2026 18:48

georgeweiler added this pull request to the merge queue Oct 27, 2026

Merged via the queue into main with commit a045921 Oct 27, 2026
58 checks passed

georgeweiler deleted the release/1367.0.0 branch October 27, 2026 18:55

georgeweiler mentioned this pull request Oct 27, 2026

chore: adopt kyc-controller 0.13.0 and ramps-controller 28.0.0 MetaMask/metamask-mobile#38322

Merged

4 of 10 tasks

Navigation Menu

Repository navigation

Release 1367.0.0 - #11141

Release 1367.0.0#11141
georgeweiler merged 4 commits into
mainfrom
release/1367.0.0

georgeweiler commented Oct 27, 2026 •

edited by cursor Bot

Loading

Uh oh!

metamask-ci Bot commented Oct 27, 2026

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

georgeweiler commented Oct 27, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

References

Checklist

Uh oh!

metamask-ci Bot commented Oct 27, 2026

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

georgeweiler commented Oct 27, 2026 •

edited by cursor Bot

Loading