Repository navigation
fix(profile-controller): call the X account endpoint in disconnectX - #11195
Merged
Merged
Conversation
ProfileService.disconnectX now sends DELETE /v1/profiles/x/account instead of the non-existent DELETE /v1/profiles/{profileId}/x. The linked X account is resolved server-side from the verified bearer token, so no profile-scoped path is used.
montelaidev
temporarily deployed
to
default-branch
October 29, 2026 10:57 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
montelaidev
enabled auto-merge
October 29, 2026 10:59
mathieuartu
reviewed
Oct 29, 2026
mathieuartu
previously approved these changes
Oct 29, 2026
mathieuartu
approved these changes
Oct 29, 2026
Prithpal-Sooriya
added a commit
that referenced
this pull request
Oct 29, 2026
Merged
1 task done
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Nov 4, 2026
## Explanation Re-lands the release that was reverted in MetaMask#11187 (the revert happened because CI on main was broken; the CI issue has since been fixed via MetaMask#11191, and Release/1375.0.0 was subsequently shipped by another team in MetaMask#11192, so this release is now **Release/1376.0.0**). To avoid cutting two separate releases, this PR also folds in the `@metamask/profile-controller` patch release that was staged in MetaMask#11197 (that PR is now redundant and closed in favor of this one). Two packages are released: **`@metamask/assets-controller` 20.0.2 (patch)** — 20.0.2 was never published to npm, so this re-release is safe. - **Fixed:** hand-rolled Multicall3 `aggregate3` codecs for balance batches (MetaMask#11078) **`@metamask/profile-controller` 1.2.1 (patch)** - **Added:** `clearState` method on `ProfileController` (MetaMask#11177) - **Changed:** bump `@metamask/utils` from `^12.0.0` to `^12.0.1` (MetaMask#11107) - **Fixed:** `ProfileService.disconnectX` now calls `DELETE profiles/x/account` instead of the non-existent `DELETE profiles/{profileId}/x` endpoint, since the linked X account is resolved server-side from the verified bearer token (MetaMask#11195) All functional changes above are already merged on `main`; this diff contains only version bumps and changelog finalization (plus a merge of `main` to pick up MetaMask#11195). - `@metamask/bridge-controller` and `@metamask/transaction-pay-controller` only have their `@metamask/assets-controller` dependency range bumped to `^20.0.2`; they are intentionally not released. ## Checklist - [x] `yarn changelog:validate` passes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
ProfileService.disconnectX now sends DELETE /v1/profiles/x/account instead of the DELETE /v1/profiles/{profileId}/x.
References
Checklist
Note
Medium Risk
Touches authenticated profile/X integration, but it corrects a broken endpoint without changing the public method signature; cache invalidation and idempotent 404 handling are preserved.
Overview
Fixes X unlinking by changing
ProfileService.disconnectXto sendDELETEtoprofiles/x/accountinstead of the invalidprofiles/{profileId}/xroute, matching howgetXAccountalready talks to the profile API.The server determines which profile’s X link to remove from the bearer token, not from a path segment. The existing
profileIdargument is unchanged and is still only used to invalidate cached profile data after a successful disconnect; 404 remains treated as success for idempotency.Tests and JSDoc/action-type comments are updated to reflect the shared account endpoint.
Reviewed by Cursor Bugbot for commit 7fa3b1c. Bugbot is set up for automated code reviews on this repo. Configure here.