Skip to content

release: 13.13.2 #39065

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
metamaskbot wants to merge 11 commits into
base: stable
Choose a base branch
from
+107 −90
Open

release: 13.13.2 #39065

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
8008f5c
bump semvar version to 13.13.2
metamaskbot Jan 7, 2026
526692e
release(runway): cherry-pick chore: bump @metamask/tron-wallet-snap t…
runway-github[bot] Jan 7, 2026
0c715de
bump: necessary packages cp-13.13.2 (#39066)
zone-live Jan 7, 2026
da7e59e
release: update CHANGELOG
HowardBraham Jan 7, 2026
a2fb2d5
release(cp): chore(security): Set yarn resolution for `qs` to patch v…
MajorLift Jan 5, 2026
9a31195
release(cp): ci: Replace expired token with scoped `pr-comment` token…
Gudahtt Dec 18, 2025
2205f3c
fixed invisible characters in CHANGELOG
HowardBraham Jan 8, 2026
b5649c0
release(runway): cherry-pick bump: Update react router to resolve ad…
runway-github[bot] Jan 9, 2026
286310b
release(runway): cherry-pick chore: bump @metamask/tron-wallet-snap t…
runway-github[bot] Jan 9, 2026
9c06a05
release: update CHANGELOG
HowardBraham Jan 9, 2026
402fc1f
release(runway): cherry-pick fix(tron): max energy and bandwidth inco…
runway-github[bot] Jan 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/e2e-chrome.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,7 @@ jobs:
- test-e2e-chrome-api-specs
runs-on: ubuntu-latest
if: ${{ github.event_name == 'pull_request' && vars.AWS_CLOUDFRONT_URL && vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET && failure() }}
environment: pr-comment
env:
GITHUB_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
OWNER: ${{ github.repository_owner }}
Expand Down Expand Up @@ -154,6 +155,7 @@ jobs:
- test-e2e-chrome-api-specs-multichain
runs-on: ubuntu-latest
if: ${{ github.event_name == 'pull_request' && vars.AWS_CLOUDFRONT_URL && vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET && failure() }}
environment: pr-comment
env:
GITHUB_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
OWNER: ${{ github.repository_owner }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/identify-codeowners.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ jobs:
identify-codeowners:
runs-on: ubuntu-latest
timeout-minutes: 30
environment: pr-comment
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v1
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/publish-prerelease.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ jobs:
name: Publish prerelease
runs-on: ubuntu-latest
timeout-minutes: 30
environment: pr-comment
env:
PR_COMMENT_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
OWNER: ${{ github.repository_owner }}
Expand Down
16 changes: 15 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

## [13.13.2]

### Changed

- Bump @metamask/tron-wallet-snap to 1.17.0 (#38986)
- Bump @metamask/keyring-api to 21.3.0 (#39066)
- Bump @metamask/tron-wallet-snap to version 1.19.0 cp-13.13.2 (#39130)
- Update react router to resolve advisory (#39115)

### Fixed

- Fix Tron resources calculation and default value (#39136)

## [13.13.1]

### Fixed
Expand Down Expand Up @@ -1465,7 +1478,8 @@ authorized by the user.` error until the user fully revoked dapp
- This changelog was split off with 12.22.0
- All older changes can be found in [docs/CHANGELOG_older.md](https://github.com/MetaMask/metamask-extension/blob/main/docs/CHANGELOG_older.md)

[Unreleased]: https://github.com/MetaMask/metamask-extension/compare/v13.13.1...HEAD
[Unreleased]: https://github.com/MetaMask/metamask-extension/compare/v13.13.2...HEAD
[13.13.2]: https://github.com/MetaMask/metamask-extension/compare/v13.13.1...v13.13.2
[13.13.1]: https://github.com/MetaMask/metamask-extension/compare/v13.13.0...v13.13.1
[13.13.0]: https://github.com/MetaMask/metamask-extension/compare/v13.12.2...v13.13.0
[13.12.2]: https://github.com/MetaMask/metamask-extension/compare/v13.12.1...v13.12.2
Expand Down
10 changes: 5 additions & 5 deletions attribution.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31895,7 +31895,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
******************************

@metamask/keyring-api
21.2.0 <https://github.com/MetaMask/keyring-api>
21.3.0 <https://github.com/MetaMask/keyring-api>
Copyright ConsenSys Software Inc. 2022. All rights reserved.

You acknowledge and agree that ConsenSys Software Inc. (“ConsenSys”) (or ConsenSys’s licensors) own all legal right, title and interest in and to the work, software, application, source code, documentation and any other documents in this repository (collectively, the “Program”), including any intellectual property rights which subsist in the Program (whether those rights happen to be registered or not, and wherever in the world those rights may exist), whether in source code or any other form.
Expand Down Expand Up @@ -34632,7 +34632,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
******************************

@metamask/tron-wallet-snap
1.16.0 <https://github.com/MetaMask/snap-tron-wallet>
1.19.0 <https://github.com/MetaMask/snap-tron-wallet>
license: (MIT-0 OR Apache-2.0)
authors: undefined

Expand Down Expand Up @@ -38756,7 +38756,7 @@ SOFTWARE.
******************************

react-router
6.26.2 <https://github.com/remix-run/react-router>
6.30.3 <https://github.com/remix-run/react-router>
MIT License

Copyright (c) React Training LLC 2015-2019
Expand Down Expand Up @@ -38813,7 +38813,7 @@ SOFTWARE.
******************************

react-router-dom-v5-compat
6.26.2 <https://github.com/remix-run/react-router>
6.30.3 <https://github.com/remix-run/react-router>
MIT License

Copyright (c) React Training LLC 2015-2019
Expand Down Expand Up @@ -39309,7 +39309,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
******************************

@remix-run/router
1.19.2 <https://github.com/remix-run/react-router>
1.23.2 <https://github.com/remix-run/react-router>
MIT License

Copyright (c) React Training LLC 2015-2019
Expand Down
5 changes: 3 additions & 2 deletions lavamoat/browserify/beta/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4636,7 +4636,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -4927,6 +4927,7 @@
"react-router-dom-v5-compat>react-router": {
"globals": {
"console.error": true,
"console.warn": true,
"define": true
},
"packages": {
Expand Down Expand Up @@ -5591,7 +5592,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
5 changes: 3 additions & 2 deletions lavamoat/browserify/experimental/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4636,7 +4636,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -4927,6 +4927,7 @@
"react-router-dom-v5-compat>react-router": {
"globals": {
"console.error": true,
"console.warn": true,
"define": true
},
"packages": {
Expand Down Expand Up @@ -5591,7 +5592,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
5 changes: 3 additions & 2 deletions lavamoat/browserify/flask/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4636,7 +4636,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -4927,6 +4927,7 @@
"react-router-dom-v5-compat>react-router": {
"globals": {
"console.error": true,
"console.warn": true,
"define": true
},
"packages": {
Expand Down Expand Up @@ -5591,7 +5592,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
5 changes: 3 additions & 2 deletions lavamoat/browserify/main/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4636,7 +4636,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
Copy link

@cursor cursor bot Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lavamoat policy references dev dependency path for production module

Medium Severity

The qs module policy entry changed from browserify>url>qs to mockttp>express>qs, but mockttp is a devDependency not included in production builds. The policy now grants browserify>url access to mockttp>express>qs, which may cause a module identity mismatch at runtime. If Lavamoat cannot match the production qs module (accessed via browserify>url) to the policy entry keyed under a dev dependency path, security sandboxing for the qs module may not be correctly applied. This affects all Lavamoat policy files across browserify and webpack builds.

🔬 Verification Test

Why verification test was not possible:
This requires running the actual MetaMask extension build with Lavamoat enabled to verify whether the policy is correctly applied at runtime. The issue depends on Lavamoat's internal module identity resolution mechanism, which cannot be tested without the full build infrastructure. The concern is that the policy generator used mockttp>express>qs as the canonical name during development (when mockttp is present), but in production the module would be identified differently since mockttp isn't bundled.

Additional Locations (2)

Fix in Cursor Fix in Web

"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -4927,6 +4927,7 @@
"react-router-dom-v5-compat>react-router": {
"globals": {
"console.error": true,
"console.warn": true,
"define": true
},
"packages": {
Expand Down Expand Up @@ -5591,7 +5592,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
4 changes: 2 additions & 2 deletions lavamoat/build-system/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5711,7 +5711,7 @@
"gulp>vinyl-fs>pumpify>pump": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -8218,7 +8218,7 @@
"gulp-livereload>tiny-lr>debug": true,
"gulp-livereload>tiny-lr>faye-websocket": true,
"react>object-assign": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"gulp>vinyl-fs>glob-stream>to-absolute-glob": {
Expand Down
7 changes: 4 additions & 3 deletions lavamoat/webpack/mv2/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4857,7 +4857,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -5164,7 +5164,8 @@
},
"react-router-dom-v5-compat>react-router": {
"globals": {
"console.error": true
"console.error": true,
"console.warn": true
},
"packages": {
"react-router-dom-v5-compat>@remix-run/router": true,
Expand Down Expand Up @@ -5951,7 +5952,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
7 changes: 4 additions & 3 deletions lavamoat/webpack/mv3/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3284,7 +3284,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -3586,7 +3586,8 @@
},
"react-router-dom-v5-compat>react-router": {
"globals": {
"console.error": true
"console.error": true,
"console.warn": true
},
"packages": {
"react-router-dom-v5-compat>@remix-run/router": true,
Expand Down Expand Up @@ -4251,7 +4252,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
11 changes: 6 additions & 5 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "metamask-crx",
"version": "13.13.1",
"version": "13.13.2",
"private": true,
"repository": {
"type": "git",
Expand Down Expand Up @@ -251,7 +251,8 @@
"@metamask/bridge-controller@npm:^63.2.0": "patch:@metamask/bridge-controller@npm%3A64.0.0#~/.yarn/patches/@metamask-bridge-controller-npm-64.0.0-956740f7c8.patch",
"@metamask/assets-controllers@npm:^92.0.0": "patch:@metamask/assets-controllers@patch%3A@metamask/assets-controllers@npm%253A93.0.0%23~/.yarn/patches/@metamask-assets-controllers-npm-93.0.0-ea998cb0bd.patch%3A%3Aversion=93.0.0&hash=224a2c#~/.yarn/patches/@metamask-assets-controllers-patch-0229f60576.patch",
"@metamask/assets-controllers@npm:^93.0.0": "patch:@metamask/assets-controllers@patch%3A@metamask/assets-controllers@npm%253A93.0.0%23~/.yarn/patches/@metamask-assets-controllers-npm-93.0.0-ea998cb0bd.patch%3A%3Aversion=93.0.0&hash=224a2c#~/.yarn/patches/@metamask-assets-controllers-patch-0229f60576.patch",
"@metamask/assets-controllers@npm:^91.0.0": "patch:@metamask/assets-controllers@patch%3A@metamask/assets-controllers@npm%253A93.0.0%23~/.yarn/patches/@metamask-assets-controllers-npm-93.0.0-ea998cb0bd.patch%3A%3Aversion=93.0.0&hash=224a2c#~/.yarn/patches/@metamask-assets-controllers-patch-0229f60576.patch"
"@metamask/assets-controllers@npm:^91.0.0": "patch:@metamask/assets-controllers@patch%3A@metamask/assets-controllers@npm%253A93.0.0%23~/.yarn/patches/@metamask-assets-controllers-npm-93.0.0-ea998cb0bd.patch%3A%3Aversion=93.0.0&hash=224a2c#~/.yarn/patches/@metamask-assets-controllers-patch-0229f60576.patch",
"qs@npm:6.13.0": "^6.14.1"
},
"dependencies": {
"@babel/runtime": "patch:@babel/runtime@npm%3A7.25.9#~/.yarn/patches/@babel-runtime-npm-7.25.9-fe8c62510a.patch",
Expand Down Expand Up @@ -321,7 +322,7 @@
"@metamask/kernel-shims": "^0.3.0",
"@metamask/kernel-ui": "^0.3.0",
"@metamask/kernel-utils": "^0.3.0",
"@metamask/keyring-api": "^21.2.0",
"@metamask/keyring-api": "^21.3.0",
"@metamask/keyring-controller": "^25.0.0",
"@metamask/keyring-internal-api": "^9.1.0",
"@metamask/keyring-internal-snap-client": "^8.0.0",
Expand Down Expand Up @@ -376,7 +377,7 @@
"@metamask/subscription-controller": "^5.3.1",
"@metamask/transaction-controller": "^62.3.1",
"@metamask/transaction-pay-controller": "^10.2.0",
"@metamask/tron-wallet-snap": "^1.16.0",
"@metamask/tron-wallet-snap": "^1.19.0",
"@metamask/user-operation-controller": "^40.0.0",
"@metamask/utils": "^11.4.2",
"@ngraveio/bc-ur": "^1.1.13",
Expand Down Expand Up @@ -449,7 +450,7 @@
"react-popper": "^2.2.3",
"react-redux": "^7.2.9",
"react-router-dom": "^5.3.4",
"react-router-dom-v5-compat": "^6.26.2",
"react-router-dom-v5-compat": "^6.30.3",
"react-simple-file-input": "^2.0.0",
"react-tippy": "^1.2.2",
"react-toggle-button": "^2.2.0",
Expand Down
Loading
Loading