Skip to content

release(runway): cherry-pick chore: bump @metamask/assets-controllers to 109.0.0#43504

Open
runway-github[bot] wants to merge 9 commits into
release/13.36.0from
cherry-pick-13-36-0-aeb7d21
Open

release(runway): cherry-pick chore: bump @metamask/assets-controllers to 109.0.0#43504
runway-github[bot] wants to merge 9 commits into
release/13.36.0from
cherry-pick-13-36-0-aeb7d21

Conversation

@runway-github

@runway-github runway-github Bot commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

Description

  • Bump of @metamask/assets-controllers dependency from ^108.5.0 to
    ^109.0.0 after new core
    release
  • Removed TransactionController:incomingTransactionsReceived from
    TokenBalancesController since described as breaking change in the
    @metamask/assets-controllers
    CHANGELOG

Changelog

CHANGELOG entry: Bump @metamask/assets-controllers from 108.5.0 to
109.0.0

Related issues

Fixes:

Manual testing steps

  1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the
    app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described
    in the ticket it closes and includes the necessary testing evidence such
    as recordings and or screenshots.

Note

Medium Risk
Token balance updates may no longer react to incoming transactions via
TokenBalancesController; verify balance refresh still behaves correctly
after the assets-controllers breaking change.

Overview
Bumps @metamask/assets-controllers from 108.5.0 to
109.0.0 (with lockfile updates, including
@metamask/transaction-controller 67.1.0) and records the change in
CHANGELOG.

Aligns the extension with upstream breaking changes by removing
TransactionController:incomingTransactionsReceived from the
TokenBalancesController messenger allowlist in
token-balances-controller-messenger.ts, so token balance refresh is no
longer wired to that transaction event here.

Regenerates LavaMoat browserify/webpack policies for the new
dependency graph (e.g. nested
@metamask/assets-controller>@metamask/assets-controllers, updated
TanStack query-core package paths, and simplified
keyring-controller references for transaction-pay).

Reviewed by Cursor Bugbot for commit
e8cc21a. Bugbot is set up for automated
code reviews on this repo. Configure
here.


Co-authored-by: MetaMask Bot metamaskbot@users.noreply.github.com aeb7d21

@runway-github runway-github Bot requested a review from a team as a code owner June 12, 2026 14:26
@github-actions

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@mm-token-exchange-service mm-token-exchange-service Bot added the team-bots Bot team (for MetaMask Bot, Runway Bot, etc.) label Jun 12, 2026
@socket-security

socket-security Bot commented Jun 12, 2026

Copy link
Copy Markdown

Warning

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Warn Low
Potential code anomaly (AI signal): npm @metamask/transaction-controller is 100.0% likely to have a medium risk anomaly

Notes: The code performs straightforward signature verification using ethers.js, returning true when the recovered signer matches the provided publicKey. While generally safe, the silent catch and potential mismatch between data formatting and signing process should be addressed to avoid silent failures. Overall, a benign utility with moderate input-format sensitivity.

Confidence: 1.00

Severity: 0.60

From: package.jsonnpm/@metamask/transaction-controller@67.1.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/transaction-controller@67.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@gabrieledm

Copy link
Copy Markdown
Contributor

@metamaskbot update-policies

@mm-token-exchange-service

Copy link
Copy Markdown

Policies updated.
👀 Please review the diff for suspicious new powers.

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.
🧠 Learn how to read policy diffs: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

👀 lavamoat/browserify/beta/policy.json changes differ from lavamoat/browserify/main/policy.json changes
👀 lavamoat/browserify/experimental/policy.json changes differ from lavamoat/browserify/main/policy.json changes
👀 lavamoat/browserify/flask/policy.json changes differ from lavamoat/browserify/main/policy.json changes
👀 lavamoat/webpack/mv2/beta/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/experimental/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/flask/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv3/beta/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes
👀 lavamoat/webpack/mv3/experimental/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes
👀 lavamoat/webpack/mv3/flask/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes

@gabrieledm gabrieledm enabled auto-merge (squash) June 12, 2026 15:13
@gabrieledm gabrieledm force-pushed the cherry-pick-13-36-0-aeb7d21 branch from 83b20bc to 25e9381 Compare June 12, 2026 15:36
@socket-security

socket-security Bot commented Jun 12, 2026

Copy link
Copy Markdown

@gabrieledm gabrieledm force-pushed the cherry-pick-13-36-0-aeb7d21 branch from 828fcc3 to 4e7e132 Compare June 12, 2026 16:04
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

- Bump of `@metamask/assets-controllers` dependency from `^108.5.0` to
`^109.0.0` after new [core
release](MetaMask/core#9078)
- Removed `TransactionController:incomingTransactionsReceived` from
`TokenBalancesController` since described as breaking change in the
[`@metamask/assets-controllers`
CHANGELOG](https://github.com/MetaMask/core/pull/9078/changes#diff-2f986b0c95bbc85106e03a1488e264023e3c500a078db85033a92e7b4da66f2fR10)

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Bump `@metamask/assets-controllers` from 108.5.0 to
109.0.0

Fixes:

1. Go to this page...
2.
3.

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

<!-- [screenshots/recordings] -->

<!-- [screenshots/recordings] -->

- [X] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Token balance updates may no longer react to incoming transactions via
TokenBalancesController; verify balance refresh still behaves correctly
after the assets-controllers breaking change.
>
> **Overview**
> Bumps **`@metamask/assets-controllers`** from **108.5.0** to
**109.0.0** (with lockfile updates, including
**`@metamask/transaction-controller` 67.1.0**) and records the change in
**CHANGELOG**.
>
> Aligns the extension with upstream breaking changes by **removing**
`TransactionController:incomingTransactionsReceived` from the
**TokenBalancesController** messenger allowlist in
`token-balances-controller-messenger.ts`, so token balance refresh is no
longer wired to that transaction event here.
>
> Regenerates **LavaMoat** browserify/webpack policies for the new
dependency graph (e.g. nested
`@metamask/assets-controller>@metamask/assets-controllers`, updated
**TanStack query-core** package paths, and simplified
**keyring-controller** references for transaction-pay).
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
e8cc21a. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: MetaMask Bot <metamaskbot@users.noreply.github.com>
@gabrieledm gabrieledm force-pushed the cherry-pick-13-36-0-aeb7d21 branch from 4e7e132 to e757551 Compare June 12, 2026 16:26
@metamaskbotv2

metamaskbotv2 Bot commented Jun 12, 2026

Copy link
Copy Markdown
Contributor
Builds ready [ccfa55b]
Deprecated Browserify fallback builds
⚡ Performance Benchmarks (Total: 🟢 18 pass · 🟡 6 warn · 🔴 0 fail)

Baseline (latest main): 2f7cd8f | Date: 6/12/2026 | Pipeline: 27430095893 | Baseline logs

Interaction Benchmarks · Samples: 5
Benchmarkchrome-webpackfirefox-webpack
loadNewAccount
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
confirmTx
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
bridgeUserActions
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]

📈 Results compared to the previous 5 runs on main

  • bridgeUserActions/bridge_load_page: -27%
  • bridgeUserActions/longTaskCount: +100%
  • bridgeUserActions/longTaskTotalDuration: +37%
  • bridgeUserActions/tbt: -18%
  • loadNewAccount/load_new_account: +60%
  • loadNewAccount/total: +60%
  • loadNewAccount/fcp: -49%
  • loadNewAccount/lcp: +1020%
  • confirmTx/longTaskCount: -100%
  • confirmTx/longTaskTotalDuration: -100%
  • confirmTx/longTaskMaxDuration: -100%
  • confirmTx/tbt: -100%
  • confirmTx/inp: -18%
  • confirmTx/fcp: -53%
  • confirmTx/lcp: +1140%
  • bridgeUserActions/bridge_load_page: +115%
  • bridgeUserActions/bridge_load_asset_picker: +38%
  • bridgeUserActions/longTaskCount: -100%
  • bridgeUserActions/longTaskTotalDuration: -100%
  • bridgeUserActions/longTaskMaxDuration: -100%
  • bridgeUserActions/tbt: -100%
  • bridgeUserActions/total: +20%
  • bridgeUserActions/inp: +12%
  • bridgeUserActions/lcp: +1078%
Startup Benchmarks · Samples: 100
Benchmarkchrome-webpackfirefox-webpack
startupStandardHome
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
startupPowerUserHome
[Sentry log · main/release]
🟡 [CI log]🟡 [CI log]

📈 Results compared to the previous 5 runs on main

  • startupStandardHome/firstPaint: -13%
  • startupStandardHome/lcp: -12%
  • startupPowerUserHome/firstPaint: +15%
  • startupPowerUserHome/backgroundConnect: +15%
  • startupPowerUserHome/firstReactRender: +13%
  • startupPowerUserHome/setupStore: +20%
  • startupPowerUserHome/numNetworkReqs: -31%
  • startupPowerUserHome/longTaskTotalDuration: +13%
  • startupPowerUserHome/longTaskMaxDuration: +13%
  • startupPowerUserHome/tbt: +12%
  • startupPowerUserHome/inp: +16%
  • startupPowerUserHome/lcp: +14%
  • startupStandardHome/domInteractive: -26%
  • startupStandardHome/firstReactRender: +11%
  • startupStandardHome/initialActions: +11%
  • startupStandardHome/loadScripts: +10%
  • startupStandardHome/inp: -17%
  • startupStandardHome/fcp: -26%
  • startupPowerUserHome/setupStore: +36%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🔴 startupPowerUserHome/INP: p75 560ms
  • 🟡 startupPowerUserHome/LCP: p75 2.8s
User Journey Benchmarks · Samples: 5 · mock API
Benchmarkchrome-webpackfirefox-webpack
onboardingImportWallet
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
onboardingNewWallet
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
🟡 total
assetDetails
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
solanaAssetDetails
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
importSrpHome
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
sendTransactions
[Sentry log · main/release]
🟡 [CI log]🟢 [CI log]
swap
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]

📈 Results compared to the previous 5 runs on main

  • onboardingImportWallet/srpButtonToSrpForm: -22%
  • onboardingImportWallet/confirmSrpToPwForm: -24%
  • onboardingImportWallet/pwFormToMetricsScreen: -25%
  • onboardingImportWallet/metricsToWalletReadyScreen: -24%
  • onboardingImportWallet/doneButtonToHomeScreen: -87%
  • onboardingImportWallet/openAccountMenuToAccountListLoaded: -98%
  • onboardingImportWallet/longTaskCount: -75%
  • onboardingImportWallet/longTaskTotalDuration: -93%
  • onboardingImportWallet/longTaskMaxDuration: -90%
  • onboardingImportWallet/tbt: -100%
  • onboardingImportWallet/total: -87%
  • onboardingNewWallet/doneButtonToAssetList: -18%
  • onboardingNewWallet/longTaskCount: -44%
  • onboardingNewWallet/longTaskTotalDuration: -48%
  • onboardingNewWallet/longTaskMaxDuration: -13%
  • onboardingNewWallet/tbt: -44%
  • onboardingNewWallet/total: -12%
  • solanaAssetDetails/assetClickToPriceChart: -69%
  • solanaAssetDetails/longTaskCount: -100%
  • solanaAssetDetails/longTaskTotalDuration: -100%
  • solanaAssetDetails/longTaskMaxDuration: -100%
  • solanaAssetDetails/tbt: -100%
  • solanaAssetDetails/total: -69%
  • solanaAssetDetails/inp: -24%
  • solanaAssetDetails/cls: -93%
  • importSrpHome/openAccountMenuAfterLogin: +55%
  • importSrpHome/homeAfterImportWithNewWallet: -41%
  • importSrpHome/longTaskCount: -29%
  • importSrpHome/longTaskTotalDuration: -28%
  • importSrpHome/longTaskMaxDuration: -13%
  • importSrpHome/tbt: -28%
  • importSrpHome/total: -33%
  • importSrpHome/inp: -27%
  • importSrpHome/cls: -34%
  • sendTransactions/selectTokenToSendFormLoaded: +16%
  • sendTransactions/reviewTransactionToConfirmationPage: -12%
  • sendTransactions/tbt: +11%
  • sendTransactions/total: -11%
  • sendTransactions/inp: -22%
  • sendTransactions/lcp: -14%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 sendTransactions/INP: p75 208ms
  • 🟡 sendTransactions/FCP: p75 1.9s
  • 🟡 assetDetails/FCP: p75 1.9s
  • 🟡 solanaAssetDetails/FCP: p75 1.9s
Dapp Page Load Benchmarks · Samples: 100

⚠️ Missing data: chrome/webpack/pageLoadBenchmark

✅ No regressions detected

Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: -19 Bytes (0%)
  • ui: 53.41 KiB (0.47%)
  • common: 191.85 KiB (1.46%)

@metamaskbotv2

metamaskbotv2 Bot commented Jun 12, 2026

Copy link
Copy Markdown
Contributor
Builds ready [26a7094]
Deprecated Browserify fallback builds
⚡ Performance Benchmarks (Total: 🟢 15 pass · 🟡 2 warn · 🔴 0 fail)

Baseline (latest main): b349190 | Date: 6/12/2026 | Pipeline: 27435128438 | Baseline logs

Interaction Benchmarks · Samples: 5
Benchmarkchrome-webpackfirefox-webpack
loadNewAccount
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
confirmTx
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
bridgeUserActions
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]

📈 Results compared to the previous 5 runs on main

  • loadNewAccount/inp: -21%
  • bridgeUserActions/bridge_load_page: -21%
  • bridgeUserActions/longTaskTotalDuration: -17%
  • bridgeUserActions/longTaskMaxDuration: -16%
  • bridgeUserActions/tbt: -38%
  • bridgeUserActions/inp: -23%
  • bridgeUserActions/lcp: +10%
  • loadNewAccount/load_new_account: +62%
  • loadNewAccount/total: +62%
  • loadNewAccount/inp: +11%
  • loadNewAccount/fcp: -53%
  • loadNewAccount/lcp: +1247%
  • confirmTx/confirm_tx: +10%
  • confirmTx/longTaskCount: -100%
  • confirmTx/longTaskTotalDuration: -100%
  • confirmTx/longTaskMaxDuration: -100%
  • confirmTx/tbt: -100%
  • confirmTx/total: +10%
  • confirmTx/inp: +43%
  • confirmTx/fcp: -49%
  • confirmTx/lcp: +1171%
  • bridgeUserActions/bridge_load_page: +70%
  • bridgeUserActions/bridge_load_asset_picker: +44%
  • bridgeUserActions/longTaskCount: -100%
  • bridgeUserActions/longTaskTotalDuration: -100%
  • bridgeUserActions/longTaskMaxDuration: -100%
  • bridgeUserActions/tbt: -100%
  • bridgeUserActions/total: +18%
  • bridgeUserActions/inp: -23%
  • bridgeUserActions/lcp: +1225%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 bridgeUserActions/FCP: p75 1.8s
Startup Benchmarks · Samples: 100
Benchmarkchrome-webpackfirefox-webpack
startupStandardHome
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
🟡 loadScripts

📈 Results compared to the previous 5 runs on main

  • startupStandardHome/firstPaint: -12%
  • startupStandardHome/lcp: -10%
  • startupStandardHome/domInteractive: +12%
  • startupStandardHome/setupStore: +10%
  • startupStandardHome/fcp: +12%
User Journey Benchmarks · Samples: 5 · mock API

⚠️ Missing data: chrome/webpack/userJourneyOnboardingImport, chrome/webpack/userJourneyAssets, chrome/webpack/userJourneyTransactions, firefox/webpack/userJourneyOnboardingImport

Benchmarkchrome-webpackfirefox-webpack
onboardingNewWallet
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
importSrpHome
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
assetDetails
[Sentry log · main/release]
🟢 [CI log]
solanaAssetDetails
[Sentry log · main/release]
🟢 [CI log]
sendTransactions
[Sentry log · main/release]
🟢 [CI log]
swap
[Sentry log · main/release]
🟢 [CI log]
Dapp Page Load Benchmarks · Samples: 100
Benchmarkchrome-webpack
dappPageLoad
[Sentry log · main/release]
🟢 [CI log]
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 71.23 KiB (1.05%)
  • ui: 53.5 KiB (0.47%)
  • common: 263.08 KiB (2%)

@metamaskbotv2

metamaskbotv2 Bot commented Jun 12, 2026

Copy link
Copy Markdown
Contributor
Builds ready [26a7094]
Deprecated Browserify fallback builds
⚡ Performance Benchmarks (Total: 🟢 15 pass · 🟡 2 warn · 🔴 0 fail)

Baseline (latest main): a568d9c | Date: 6/12/2026 | Pipeline: 27435128438 | Baseline logs

Interaction Benchmarks · Samples: 5
Benchmarkchrome-webpackfirefox-webpack
loadNewAccount
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
confirmTx
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
bridgeUserActions
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]

📈 Results compared to the previous 5 runs on main

  • loadNewAccount/inp: -22%
  • loadNewAccount/fcp: -11%
  • confirmTx/inp: -10%
  • bridgeUserActions/bridge_load_page: -29%
  • bridgeUserActions/longTaskTotalDuration: -16%
  • bridgeUserActions/longTaskMaxDuration: -17%
  • bridgeUserActions/tbt: -39%
  • bridgeUserActions/inp: -26%
  • loadNewAccount/load_new_account: +51%
  • loadNewAccount/total: +51%
  • loadNewAccount/fcp: -54%
  • loadNewAccount/lcp: +1227%
  • confirmTx/confirm_tx: +10%
  • confirmTx/longTaskCount: -100%
  • confirmTx/longTaskTotalDuration: -100%
  • confirmTx/longTaskMaxDuration: -100%
  • confirmTx/tbt: -100%
  • confirmTx/total: +10%
  • confirmTx/inp: +40%
  • confirmTx/fcp: -49%
  • confirmTx/lcp: +1095%
  • bridgeUserActions/bridge_load_page: +53%
  • bridgeUserActions/bridge_load_asset_picker: +46%
  • bridgeUserActions/longTaskCount: -100%
  • bridgeUserActions/longTaskTotalDuration: -100%
  • bridgeUserActions/longTaskMaxDuration: -100%
  • bridgeUserActions/tbt: -100%
  • bridgeUserActions/total: +20%
  • bridgeUserActions/inp: -26%
  • bridgeUserActions/lcp: +1214%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 bridgeUserActions/FCP: p75 1.8s
Startup Benchmarks · Samples: 100
Benchmarkchrome-webpackfirefox-webpack
startupStandardHome
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
🟡 loadScripts

📈 Results compared to the previous 5 runs on main

  • startupStandardHome/firstPaint: -13%
  • startupStandardHome/lcp: -11%
  • startupStandardHome/domInteractive: +26%
  • startupStandardHome/backgroundConnect: +10%
  • startupStandardHome/setupStore: +14%
  • startupStandardHome/fcp: +24%
User Journey Benchmarks · Samples: 5 · mock API

⚠️ Missing data: chrome/webpack/userJourneyOnboardingImport, chrome/webpack/userJourneyAssets, chrome/webpack/userJourneyTransactions, firefox/webpack/userJourneyOnboardingImport

Benchmarkchrome-webpackfirefox-webpack
onboardingNewWallet
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
importSrpHome
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
assetDetails
[Sentry log · main/release]
🟢 [CI log]
solanaAssetDetails
[Sentry log · main/release]
🟢 [CI log]
sendTransactions
[Sentry log · main/release]
🟢 [CI log]
swap
[Sentry log · main/release]
🟢 [CI log]
Dapp Page Load Benchmarks · Samples: 100
Benchmarkchrome-webpack
dappPageLoad
[Sentry log · main/release]
🟢 [CI log]
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 71.23 KiB (1.05%)
  • ui: 53.5 KiB (0.47%)
  • common: 263.08 KiB (2%)

@metamaskbotv2

metamaskbotv2 Bot commented Jun 14, 2026

Copy link
Copy Markdown
Contributor
Builds ready [26a7094]
Deprecated Browserify fallback builds
⚡ Performance Benchmarks (Total: 🟢 15 pass · 🟡 2 warn · 🔴 0 fail)

Baseline (latest main): 5682526 | Date: 6/13/2026 | Pipeline: 27435128438 | Baseline logs

Interaction Benchmarks · Samples: 5
Benchmarkchrome-webpackfirefox-webpack
loadNewAccount
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
confirmTx
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
bridgeUserActions
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]

📈 Results compared to the previous 5 runs on main

  • loadNewAccount/load_new_account: +32%
  • loadNewAccount/total: +32%
  • confirmTx/inp: -10%
  • bridgeUserActions/bridge_load_page: -27%
  • bridgeUserActions/longTaskTotalDuration: -17%
  • bridgeUserActions/longTaskMaxDuration: -17%
  • bridgeUserActions/tbt: -39%
  • bridgeUserActions/inp: -24%
  • loadNewAccount/load_new_account: +110%
  • loadNewAccount/total: +110%
  • loadNewAccount/inp: +37%
  • loadNewAccount/fcp: -51%
  • loadNewAccount/lcp: +1177%
  • confirmTx/confirm_tx: +11%
  • confirmTx/longTaskCount: -100%
  • confirmTx/longTaskTotalDuration: -100%
  • confirmTx/longTaskMaxDuration: -100%
  • confirmTx/tbt: -100%
  • confirmTx/total: +11%
  • confirmTx/inp: +40%
  • confirmTx/fcp: -48%
  • confirmTx/lcp: +1059%
  • bridgeUserActions/bridge_load_page: +56%
  • bridgeUserActions/bridge_load_asset_picker: +52%
  • bridgeUserActions/longTaskCount: -100%
  • bridgeUserActions/longTaskTotalDuration: -100%
  • bridgeUserActions/longTaskMaxDuration: -100%
  • bridgeUserActions/tbt: -100%
  • bridgeUserActions/total: +21%
  • bridgeUserActions/inp: -24%
  • bridgeUserActions/lcp: +1148%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 bridgeUserActions/FCP: p75 1.8s
Startup Benchmarks · Samples: 100
Benchmarkchrome-webpackfirefox-webpack
startupStandardHome
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
🟡 loadScripts

📈 Results compared to the previous 5 runs on main

  • startupStandardHome/domInteractive: +19%
  • startupStandardHome/backgroundConnect: +11%
  • startupStandardHome/firstReactRender: +13%
  • startupStandardHome/setupStore: +14%
  • startupStandardHome/fcp: +18%
  • startupStandardHome/lcp: +10%
User Journey Benchmarks · Samples: 5 · mock API

⚠️ Missing data: chrome/webpack/userJourneyOnboardingImport, chrome/webpack/userJourneyAssets, chrome/webpack/userJourneyTransactions, firefox/webpack/userJourneyOnboardingImport

Benchmarkchrome-webpackfirefox-webpack
onboardingNewWallet
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
importSrpHome
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
assetDetails
[Sentry log · main/release]
🟢 [CI log]
solanaAssetDetails
[Sentry log · main/release]
🟢 [CI log]
sendTransactions
[Sentry log · main/release]
🟢 [CI log]
swap
[Sentry log · main/release]
🟢 [CI log]
Dapp Page Load Benchmarks · Samples: 100
Benchmarkchrome-webpack
dappPageLoad
[Sentry log · main/release]
🟢 [CI log]
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 71.23 KiB (1.05%)
  • ui: 53.5 KiB (0.47%)
  • common: 263.08 KiB (2%)

@metamaskbotv2

metamaskbotv2 Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor
Builds ready [71dbb2d] [reused from 957bc86]
Deprecated Browserify fallback builds
⚡ Performance Benchmarks (Total: 🟢 12 pass · 🟡 1 warn · 🔴 0 fail)

Baseline (latest main): 5682526 | Date: 6/13/2026 | Pipeline: 27531171348 | Baseline logs

Interaction Benchmarks · Samples: 5
Benchmarkchrome-webpackfirefox-webpack
loadNewAccount
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
confirmTx
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
bridgeUserActions
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
🔴 bridge_load_asset_picker

📈 Results compared to the previous 5 runs on main

  • loadNewAccount/load_new_account: +15%
  • loadNewAccount/total: +15%
  • loadNewAccount/lcp: -10%
  • confirmTx/tbt: +10%
  • bridgeUserActions/bridge_load_page: -33%
  • bridgeUserActions/bridge_load_asset_picker: +28%
  • bridgeUserActions/longTaskTotalDuration: -19%
  • bridgeUserActions/longTaskMaxDuration: -19%
  • bridgeUserActions/tbt: -16%
  • bridgeUserActions/inp: -24%
  • loadNewAccount/load_new_account: +82%
  • loadNewAccount/total: +82%
  • loadNewAccount/lcp: +1128%
  • confirmTx/confirm_tx: +10%
  • confirmTx/longTaskCount: -100%
  • confirmTx/longTaskTotalDuration: -100%
  • confirmTx/longTaskMaxDuration: -100%
  • confirmTx/tbt: -100%
  • confirmTx/total: +10%
  • confirmTx/inp: -10%
  • confirmTx/fcp: -50%
  • confirmTx/lcp: +1123%
  • bridgeUserActions/bridge_load_page: +66%
  • bridgeUserActions/bridge_load_asset_picker: +1285%
  • bridgeUserActions/longTaskCount: -100%
  • bridgeUserActions/longTaskTotalDuration: -100%
  • bridgeUserActions/longTaskMaxDuration: -100%
  • bridgeUserActions/tbt: -100%
  • bridgeUserActions/total: +178%
  • bridgeUserActions/inp: +36%
  • bridgeUserActions/fcp: -42%
  • bridgeUserActions/lcp: +1155%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 loadNewAccount/FCP: p75 1.9s
Startup Benchmarks · Samples: 100
Benchmarkchrome-webpackfirefox-webpack
startupStandardHome
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]

📈 Results compared to the previous 5 runs on main

  • startupStandardHome/uiStartup: -22%
  • startupStandardHome/load: -22%
  • startupStandardHome/domContentLoaded: -22%
  • startupStandardHome/domInteractive: -32%
  • startupStandardHome/backgroundConnect: -19%
  • startupStandardHome/firstReactRender: -19%
  • startupStandardHome/initialActions: -50%
  • startupStandardHome/loadScripts: -22%
  • startupStandardHome/setupStore: -24%
  • startupStandardHome/fcp: -30%
  • startupStandardHome/lcp: -22%
User Journey Benchmarks · Samples: 5 · mock API

⚠️ Missing data: chrome/webpack/userJourneyOnboardingImport, chrome/webpack/userJourneyAssets, chrome/webpack/userJourneyTransactions, firefox/webpack/userJourneyOnboardingImport, firefox/webpack/userJourneyAssets, firefox/webpack/userJourneyTransactions

Benchmarkchrome-webpackfirefox-webpack
onboardingNewWallet
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
importSrpHome
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
Dapp Page Load Benchmarks · Samples: 100
Benchmarkchrome-webpack
dappPageLoad
[Sentry log · main/release]
🟢 [CI log]

📈 Results compared to the previous 5 runs on main

  • dappPageLoad/pageLoadTime: -43%
  • dappPageLoad/domContentLoaded: -42%
  • dappPageLoad/firstPaint: -32%
  • dappPageLoad/firstContentfulPaint: -32%
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 71.23 KiB (1.05%)
  • ui: 53.5 KiB (0.47%)
  • common: 263.36 KiB (2%)

@gabrieledm

Copy link
Copy Markdown
Contributor

@metamaskbot update-policies

@mm-token-exchange-service

Copy link
Copy Markdown

Policies updated.
👀 Please review the diff for suspicious new powers.

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.
🧠 Learn how to read policy diffs: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

👀 lavamoat/browserify/beta/policy.json changes differ from lavamoat/browserify/main/policy.json changes
👀 lavamoat/browserify/experimental/policy.json changes differ from lavamoat/browserify/main/policy.json changes
👀 lavamoat/browserify/flask/policy.json changes differ from lavamoat/browserify/main/policy.json changes
👀 lavamoat/webpack/mv2/beta/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/experimental/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/flask/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv3/beta/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes
👀 lavamoat/webpack/mv3/experimental/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes
👀 lavamoat/webpack/mv3/flask/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes

@metamaskbotv2

metamaskbotv2 Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor
Builds ready [2fd0c09]
Deprecated Browserify fallback builds
⚡ Performance Benchmarks (Total: 🟢 16 pass · 🟡 8 warn · 🔴 0 fail)

Baseline (latest main): 5682526 | Date: 6/13/2026 | Pipeline: 27535604490 | Baseline logs

Interaction Benchmarks · Samples: 5
Benchmarkchrome-webpackfirefox-webpack
loadNewAccount
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
confirmTx
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
bridgeUserActions
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]

📈 Results compared to the previous 5 runs on main

  • loadNewAccount/load_new_account: +18%
  • loadNewAccount/total: +18%
  • bridgeUserActions/bridge_load_page: -31%
  • bridgeUserActions/bridge_load_asset_picker: +11%
  • bridgeUserActions/longTaskTotalDuration: -27%
  • bridgeUserActions/longTaskMaxDuration: -27%
  • bridgeUserActions/tbt: -62%
  • loadNewAccount/load_new_account: +70%
  • loadNewAccount/total: +70%
  • loadNewAccount/inp: +47%
  • loadNewAccount/fcp: -55%
  • loadNewAccount/lcp: +1035%
  • confirmTx/longTaskCount: -100%
  • confirmTx/longTaskTotalDuration: -100%
  • confirmTx/longTaskMaxDuration: -100%
  • confirmTx/tbt: -100%
  • confirmTx/inp: -10%
  • confirmTx/fcp: -52%
  • confirmTx/lcp: +1085%
  • bridgeUserActions/bridge_load_page: +76%
  • bridgeUserActions/bridge_load_asset_picker: +68%
  • bridgeUserActions/bridge_search_token: +25%
  • bridgeUserActions/longTaskCount: -100%
  • bridgeUserActions/longTaskTotalDuration: -100%
  • bridgeUserActions/longTaskMaxDuration: -100%
  • bridgeUserActions/tbt: -100%
  • bridgeUserActions/total: +19%
  • bridgeUserActions/inp: -24%
  • bridgeUserActions/fcp: -59%
  • bridgeUserActions/lcp: +1076%
Startup Benchmarks · Samples: 100
Benchmarkchrome-webpackfirefox-webpack
startupStandardHome
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
startupPowerUserHome
[Sentry log · main/release]
🟡 [CI log]🟡 [CI log]

📈 Results compared to the previous 5 runs on main

  • startupPowerUserHome/firstReactRender: +16%
  • startupPowerUserHome/setupStore: +17%
  • startupStandardHome/inp: +100%
  • startupPowerUserHome/setupStore: +20%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🔴 startupPowerUserHome/INP: p75 520ms
  • 🟡 startupPowerUserHome/INP: p75 216ms
  • 🟡 startupPowerUserHome/LCP: p75 3.1s
User Journey Benchmarks · Samples: 5 · mock API
Benchmarkchrome-webpackfirefox-webpack
onboardingImportWallet
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
onboardingNewWallet
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
🟡 total
assetDetails
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
solanaAssetDetails
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
importSrpHome
[Sentry log · main/release]
🟡 [CI log]🟢 [CI log]
sendTransactions
[Sentry log · main/release]
🟡 [CI log]🟡 [CI log]
swap
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]

📈 Results compared to the previous 5 runs on main

  • onboardingImportWallet/doneButtonToHomeScreen: -87%
  • onboardingImportWallet/openAccountMenuToAccountListLoaded: -49%
  • onboardingImportWallet/longTaskCount: -55%
  • onboardingImportWallet/longTaskTotalDuration: -87%
  • onboardingImportWallet/longTaskMaxDuration: -90%
  • onboardingImportWallet/tbt: -99%
  • onboardingImportWallet/total: -83%
  • onboardingNewWallet/doneButtonToAssetList: -27%
  • onboardingNewWallet/longTaskCount: -55%
  • onboardingNewWallet/longTaskTotalDuration: -58%
  • onboardingNewWallet/longTaskMaxDuration: -33%
  • onboardingNewWallet/tbt: -70%
  • onboardingNewWallet/total: -24%
  • solanaAssetDetails/assetClickToPriceChart: -54%
  • solanaAssetDetails/longTaskCount: -100%
  • solanaAssetDetails/longTaskTotalDuration: -100%
  • solanaAssetDetails/longTaskMaxDuration: -100%
  • solanaAssetDetails/tbt: -100%
  • solanaAssetDetails/total: -54%
  • solanaAssetDetails/lcp: -11%
  • solanaAssetDetails/cls: -89%
  • importSrpHome/loginToHomeScreen: -23%
  • importSrpHome/openAccountMenuAfterLogin: +75%
  • importSrpHome/homeAfterImportWithNewWallet: -35%
  • importSrpHome/longTaskCount: -22%
  • importSrpHome/longTaskTotalDuration: -30%
  • importSrpHome/longTaskMaxDuration: -19%
  • importSrpHome/tbt: -38%
  • importSrpHome/total: -30%
  • importSrpHome/inp: -22%
  • importSrpHome/lcp: +10%
  • sendTransactions/openSendPageFromHome: -26%
  • sendTransactions/selectTokenToSendFormLoaded: +18%
  • sendTransactions/tbt: +17%
  • sendTransactions/inp: -33%
  • sendTransactions/lcp: +17%
  • sendTransactions/cls: -89%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 importSrpHome/FCP: p75 1.9s
  • 🟡 sendTransactions/FCP: p75 1.9s
  • 🟡 assetDetails/FCP: p75 1.9s
  • 🟡 solanaAssetDetails/FCP: p75 2.0s
  • 🟡 sendTransactions/FCP: p75 1.9s
Dapp Page Load Benchmarks · Samples: 100

⚠️ Missing data: chrome/webpack/pageLoadBenchmark

✅ No regressions detected

Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: -19 Bytes (0%)
  • ui: 53.41 KiB (0.47%)
  • common: 192.18 KiB (1.46%)

@gabrieledm

Copy link
Copy Markdown
Contributor

Added "@metamask/keyring-controller@npm:^27.0.0": "^26.0.0" in the resolutions to make the CI actions to pass since the 27.0.0 contains a breaking change that leads to e2e failures with the error

KeyringController - Keyring not found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk:medium team-bots Bot team (for MetaMask Bot, Runway Bot, etc.)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants