Skip to content

chore: Bump messenger and controller dependencies#3930

Merged
FrederikBolding merged 4 commits intomainfrom
fb/bump-core-packages
Mar 27, 2026
Merged

chore: Bump messenger and controller dependencies#3930
FrederikBolding merged 4 commits intomainfrom
fb/bump-core-packages

Conversation

@FrederikBolding
Copy link
Copy Markdown
Member

@FrederikBolding FrederikBolding commented Mar 27, 2026

Replacement for Dependabot PRs as more than one dependency needed to be bumped to get passing CI.

Bumps messenger, base-controller, storage-service, permission-controller & approval-controller.


Note

Medium Risk
Upgrades @metamask/messenger to 1.0.0 and bumps several core controller dependencies, which can subtly affect controller messaging/type contracts across Snaps runtime components. Code changes are mostly type-level, but they touch central controllers (SnapController, routing, UI) so integration/CI coverage is important.

Overview
Updates Snaps packages to newer controller/messenger releases (notably @metamask/messenger@1.0.0, plus approval-controller, base-controller, permission-controller@12.3.0, and storage-service).

Refactors Snaps controllers to match updated permission-controller action typings by replacing legacy types (e.g., GetPermissions, HasPermission, UpdateCaveat) with the new PermissionController*Action type exports in SnapController, CronjobController, SnapInsightsController, SnapInterfaceController, and MultichainRoutingService.

Adjusts the simulation setup to align with the updated permission-controller generics by simplifying PermissionController typing and pruning now-unneeded constraint type imports, and updates yarn.lock accordingly.

Written by Cursor Bugbot for commit 24da3f4. This will update automatically on new commits. Configure here.

@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 27, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​metamask/​base-controller@​9.0.0 ⏵ 9.0.1100 +11007393 +6100
Updated@​metamask/​approval-controller@​9.0.0 ⏵ 9.0.11001007693 +2100
Updated@​metamask/​messenger@​0.3.0 ⏵ 1.0.010010076 +191 +6100
Updated@​metamask/​permission-controller@​12.2.1 ⏵ 12.3.09910079 +194 +2100
Updated@​metamask/​storage-service@​1.0.0 ⏵ 1.0.110010010091 +2100

View full report

@FrederikBolding FrederikBolding marked this pull request as ready for review March 27, 2026 09:32
@FrederikBolding FrederikBolding requested a review from a team as a code owner March 27, 2026 09:32
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 27, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.56%. Comparing base (1d0d356) to head (24da3f4).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3930   +/-   ##
=======================================
  Coverage   98.56%   98.56%           
=======================================
  Files         426      426           
  Lines       12316    12316           
  Branches     1935     1935           
=======================================
  Hits        12139    12139           
  Misses        177      177           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@FrederikBolding FrederikBolding added this pull request to the merge queue Mar 27, 2026
Merged via the queue into main with commit 6ad0161 Mar 27, 2026
129 checks passed
@FrederikBolding FrederikBolding deleted the fb/bump-core-packages branch March 27, 2026 09:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants