release: 13.13.2 #39065
Merged
release: 13.13.2 #39065
+107
−90
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
metamaskbot
added
team-bots
…o 1.17.0 (#39067) - chore: bump @metamask/tron-wallet-snap to 1.17.0 (#38986) CHANGELOG entry: Bump @metamask/tron-wallet-snap to 1.17.0 --------- Co-authored-by: Ulisses Ferreira <[email protected]> Co-authored-by: MetaMask Bot <[email protected]>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
--------- Co-authored-by: Ulisses Ferreira <[email protected]> Co-authored-by: MetaMask Bot <[email protected]> Co-authored-by: Alejandro Garcia Anglada <[email protected]>
Contributor
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
Contributor
✨ Files requiring CODEOWNER review ✨📜 @MetaMask/policy-reviewers (7 files, +22 -16)
Tip Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers. |
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
Contributor
Builds ready [9a31195]
UI Startup Metrics (1220 ± 97 ms)
|
chloeYue
previously approved these changes
Jan 7, 2026
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| } | ||
| }, | ||
| "browserify>url>qs": { | ||
| "mockttp>express>qs": { |
There was a problem hiding this comment.
Lavamoat policy references dev dependency path for production module
Medium Severity
The qs module policy entry changed from browserify>url>qs to mockttp>express>qs, but mockttp is a devDependency not included in production builds. The policy now grants browserify>url access to mockttp>express>qs, which may cause a module identity mismatch at runtime. If Lavamoat cannot match the production qs module (accessed via browserify>url) to the policy entry keyed under a dev dependency path, security sandboxing for the qs module may not be correctly applied. This affects all Lavamoat policy files across browserify and webpack builds.
🔬 Verification Test
Why verification test was not possible:
This requires running the actual MetaMask extension build with Lavamoat enabled to verify whether the policy is correctly applied at runtime. The issue depends on Lavamoat's internal module identity resolution mechanism, which cannot be tested without the full build infrastructure. The concern is that the policy generator used mockttp>express>qs as the canonical name during development (when mockttp is present), but in production the module would be identified differently since mockttp isn't bundled.
Additional Locations (2)
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring alerts on: |
Contributor
|
@SocketSecurity ignore npm/[email protected] Mark says "This is a false positive, the fetch global is not used in this package." |
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
Contributor
Builds ready [b5649c0]
UI Startup Metrics (1237 ± 102 ms)
|
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
Contributor
Builds ready [286310b]
UI Startup Metrics (1230 ± 113 ms)
|
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
Contributor
Builds ready [9c06a05]
UI Startup Metrics (1202 ± 121 ms)
|
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
HowardBraham
temporarily deployed
to
pr-comment
GitHub Actions
Inactive
Contributor
Builds ready [402fc1f]
UI Startup Metrics (1202 ± 111 ms)
|
chloeYue
approved these changes
Jan 12, 2026
Gudahtt
approved these changes
Jan 12, 2026
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🚀 v13.13.2 Testing & Release Quality Process
Hi Team,
As part of our new MetaMask Release Quality Process, here’s a quick overview of the key processes, testing strategies, and milestones to ensure a smooth and high-quality deployment.
📋 Key Processes
Testing Strategy
Conduct regression and exploratory testing for your functional areas, including automated and manual tests for critical workflows.
Focus on exploratory testing across the wallet, prioritize high-impact areas, and triage any Sentry errors found during testing.
Validate new functionalities and provide feedback to support release monitoring.
GitHub Signoff
Issue Resolution
Cherry-Picking Criteria
🗓️ Timeline and Milestones
✅ Signoff Checklist
Each team is responsible for signing off via GitHub. Use the checkbox below to track signoff completion:
Team sign-off checklist
This process is a major step forward in ensuring release stability and quality. Let’s stay aligned and make this release a success! 🚀
Feel free to reach out if you have questions or need clarification.
Many thanks in advance
Reference
Note
Prepares v13.13.2 with a small bug fix and dependency/infra updates.
useTronResources(keepsmaxas 0 when absent; uses safe divisor) with updated tests@metamask/[email protected],@metamask/[email protected],react-router/react-router-dom-v5-compat/@remix-run/routerto 6.30.3/1.23.2, and[email protected]; updatesyarn.lockandattribution.txtbrowserify>url>qstomockttp>express>qs, allowconsole.warnforreact-router-dom-v5-compat>react-router)environment: pr-commentto PR-commenting jobs ine2e-chrome,identify-codeowners, andpublish-prerelease13.13.2and updatesCHANGELOG.md/linksWritten by Cursor Bugbot for commit 402fc1f. This will update automatically on new commits. Configure here.