Skip to content

release: 13.13.2 #39065

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Gudahtt merged 11 commits into from
Jan 12, 2026
Merged

release: 13.13.2 #39065

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
8008f5c
bump semvar version to 13.13.2
metamaskbot Jan 7, 2026
526692e
release(runway): cherry-pick chore: bump @metamask/tron-wallet-snap t…
runway-github[bot] Jan 7, 2026
0c715de
bump: necessary packages cp-13.13.2 (#39066)
zone-live Jan 7, 2026
da7e59e
release: update CHANGELOG
HowardBraham Jan 7, 2026
a2fb2d5
release(cp): chore(security): Set yarn resolution for `qs` to patch v…
MajorLift Jan 5, 2026
9a31195
release(cp): ci: Replace expired token with scoped `pr-comment` token…
Gudahtt Dec 18, 2025
2205f3c
fixed invisible characters in CHANGELOG
HowardBraham Jan 8, 2026
b5649c0
release(runway): cherry-pick bump: Update react router to resolve ad…
runway-github[bot] Jan 9, 2026
286310b
release(runway): cherry-pick chore: bump @metamask/tron-wallet-snap t…
runway-github[bot] Jan 9, 2026
9c06a05
release: update CHANGELOG
HowardBraham Jan 9, 2026
402fc1f
release(runway): cherry-pick fix(tron): max energy and bandwidth inco…
runway-github[bot] Jan 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/e2e-chrome.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,7 @@ jobs:
- test-e2e-chrome-api-specs
runs-on: ubuntu-latest
if: ${{ github.event_name == 'pull_request' && vars.AWS_CLOUDFRONT_URL && vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET && failure() }}
environment: pr-comment
env:
GITHUB_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
OWNER: ${{ github.repository_owner }}
Expand Down Expand Up @@ -154,6 +155,7 @@ jobs:
- test-e2e-chrome-api-specs-multichain
runs-on: ubuntu-latest
if: ${{ github.event_name == 'pull_request' && vars.AWS_CLOUDFRONT_URL && vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET && failure() }}
environment: pr-comment
env:
GITHUB_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
OWNER: ${{ github.repository_owner }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/identify-codeowners.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ jobs:
identify-codeowners:
runs-on: ubuntu-latest
timeout-minutes: 30
environment: pr-comment
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v1
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/publish-prerelease.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ jobs:
name: Publish prerelease
runs-on: ubuntu-latest
timeout-minutes: 30
environment: pr-comment
env:
PR_COMMENT_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
OWNER: ${{ github.repository_owner }}
Expand Down
10 changes: 9 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

## [13.13.2]

### Changed

- Bump @metamask/tron-wallet-snap to 1.17.0
- Bump @metamask/keyring-api to 21.3.0

## [13.13.1]

### Fixed
Expand Down Expand Up @@ -1465,7 +1472,8 @@ authorized by the user.` error until the user fully revoked dapp
- This changelog was split off with 12.22.0
- All older changes can be found in [docs/CHANGELOG_older.md](https://github.com/MetaMask/metamask-extension/blob/main/docs/CHANGELOG_older.md)

[Unreleased]: https://github.com/MetaMask/metamask-extension/compare/v13.13.1...HEAD
[Unreleased]: https://github.com/MetaMask/metamask-extension/compare/v13.13.2...HEAD
[13.13.2]: https://github.com/MetaMask/metamask-extension/compare/v13.13.1...v13.13.2
[13.13.1]: https://github.com/MetaMask/metamask-extension/compare/v13.13.0...v13.13.1
[13.13.0]: https://github.com/MetaMask/metamask-extension/compare/v13.12.2...v13.13.0
[13.12.2]: https://github.com/MetaMask/metamask-extension/compare/v13.12.1...v13.12.2
Expand Down
4 changes: 2 additions & 2 deletions attribution.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31895,7 +31895,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
******************************

@metamask/keyring-api
21.2.0 <https://github.com/MetaMask/keyring-api>
21.3.0 <https://github.com/MetaMask/keyring-api>
Copyright ConsenSys Software Inc. 2022. All rights reserved.

You acknowledge and agree that ConsenSys Software Inc. (“ConsenSys”) (or ConsenSys’s licensors) own all legal right, title and interest in and to the work, software, application, source code, documentation and any other documents in this repository (collectively, the “Program”), including any intellectual property rights which subsist in the Program (whether those rights happen to be registered or not, and wherever in the world those rights may exist), whether in source code or any other form.
Expand Down Expand Up @@ -34632,7 +34632,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
******************************

@metamask/tron-wallet-snap
1.16.0 <https://github.com/MetaMask/snap-tron-wallet>
1.17.0 <https://github.com/MetaMask/snap-tron-wallet>
license: (MIT-0 OR Apache-2.0)
authors: undefined

Expand Down
4 changes: 2 additions & 2 deletions lavamoat/browserify/beta/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4636,7 +4636,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -5591,7 +5591,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
4 changes: 2 additions & 2 deletions lavamoat/browserify/experimental/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4636,7 +4636,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -5591,7 +5591,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
4 changes: 2 additions & 2 deletions lavamoat/browserify/flask/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4636,7 +4636,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -5591,7 +5591,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
4 changes: 2 additions & 2 deletions lavamoat/browserify/main/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4636,7 +4636,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
Copy link

@cursor cursor bot Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lavamoat policy references dev dependency path for production module

Medium Severity

The qs module policy entry changed from browserify>url>qs to mockttp>express>qs, but mockttp is a devDependency not included in production builds. The policy now grants browserify>url access to mockttp>express>qs, which may cause a module identity mismatch at runtime. If Lavamoat cannot match the production qs module (accessed via browserify>url) to the policy entry keyed under a dev dependency path, security sandboxing for the qs module may not be correctly applied. This affects all Lavamoat policy files across browserify and webpack builds.

🔬 Verification Test

Why verification test was not possible:
This requires running the actual MetaMask extension build with Lavamoat enabled to verify whether the policy is correctly applied at runtime. The issue depends on Lavamoat's internal module identity resolution mechanism, which cannot be tested without the full build infrastructure. The concern is that the policy generator used mockttp>express>qs as the canonical name during development (when mockttp is present), but in production the module would be identified differently since mockttp isn't bundled.

Additional Locations (2)

Fix in Cursor Fix in Web

"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -5591,7 +5591,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
4 changes: 2 additions & 2 deletions lavamoat/build-system/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5711,7 +5711,7 @@
"gulp>vinyl-fs>pumpify>pump": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -8218,7 +8218,7 @@
"gulp-livereload>tiny-lr>debug": true,
"gulp-livereload>tiny-lr>faye-websocket": true,
"react>object-assign": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"gulp>vinyl-fs>glob-stream>to-absolute-glob": {
Expand Down
4 changes: 2 additions & 2 deletions lavamoat/webpack/mv2/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4857,7 +4857,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -5951,7 +5951,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
4 changes: 2 additions & 2 deletions lavamoat/webpack/mv3/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3284,7 +3284,7 @@
"react": true
}
},
"browserify>url>qs": {
"mockttp>express>qs": {
"packages": {
"string.prototype.matchall>side-channel": true
}
Expand Down Expand Up @@ -4251,7 +4251,7 @@
"browserify>url": {
"packages": {
"browserify>url>punycode": true,
"browserify>url>qs": true
"mockttp>express>qs": true
}
},
"react-focus-lock>use-callback-ref": {
Expand Down
9 changes: 5 additions & 4 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "metamask-crx",
"version": "13.13.1",
"version": "13.13.2",
"private": true,
"repository": {
"type": "git",
Expand Down Expand Up @@ -251,7 +251,8 @@
"@metamask/bridge-controller@npm:^63.2.0": "patch:@metamask/bridge-controller@npm%3A64.0.0#~/.yarn/patches/@metamask-bridge-controller-npm-64.0.0-956740f7c8.patch",
"@metamask/assets-controllers@npm:^92.0.0": "patch:@metamask/assets-controllers@patch%3A@metamask/assets-controllers@npm%253A93.0.0%23~/.yarn/patches/@metamask-assets-controllers-npm-93.0.0-ea998cb0bd.patch%3A%3Aversion=93.0.0&hash=224a2c#~/.yarn/patches/@metamask-assets-controllers-patch-0229f60576.patch",
"@metamask/assets-controllers@npm:^93.0.0": "patch:@metamask/assets-controllers@patch%3A@metamask/assets-controllers@npm%253A93.0.0%23~/.yarn/patches/@metamask-assets-controllers-npm-93.0.0-ea998cb0bd.patch%3A%3Aversion=93.0.0&hash=224a2c#~/.yarn/patches/@metamask-assets-controllers-patch-0229f60576.patch",
"@metamask/assets-controllers@npm:^91.0.0": "patch:@metamask/assets-controllers@patch%3A@metamask/assets-controllers@npm%253A93.0.0%23~/.yarn/patches/@metamask-assets-controllers-npm-93.0.0-ea998cb0bd.patch%3A%3Aversion=93.0.0&hash=224a2c#~/.yarn/patches/@metamask-assets-controllers-patch-0229f60576.patch"
"@metamask/assets-controllers@npm:^91.0.0": "patch:@metamask/assets-controllers@patch%3A@metamask/assets-controllers@npm%253A93.0.0%23~/.yarn/patches/@metamask-assets-controllers-npm-93.0.0-ea998cb0bd.patch%3A%3Aversion=93.0.0&hash=224a2c#~/.yarn/patches/@metamask-assets-controllers-patch-0229f60576.patch",
"qs@npm:6.13.0": "^6.14.1"
},
"dependencies": {
"@babel/runtime": "patch:@babel/runtime@npm%3A7.25.9#~/.yarn/patches/@babel-runtime-npm-7.25.9-fe8c62510a.patch",
Expand Down Expand Up @@ -321,7 +322,7 @@
"@metamask/kernel-shims": "^0.3.0",
"@metamask/kernel-ui": "^0.3.0",
"@metamask/kernel-utils": "^0.3.0",
"@metamask/keyring-api": "^21.2.0",
"@metamask/keyring-api": "^21.3.0",
"@metamask/keyring-controller": "^25.0.0",
"@metamask/keyring-internal-api": "^9.1.0",
"@metamask/keyring-internal-snap-client": "^8.0.0",
Expand Down Expand Up @@ -376,7 +377,7 @@
"@metamask/subscription-controller": "^5.3.1",
"@metamask/transaction-controller": "^62.3.1",
"@metamask/transaction-pay-controller": "^10.2.0",
"@metamask/tron-wallet-snap": "^1.16.0",
"@metamask/tron-wallet-snap": "^1.17.0",
"@metamask/user-operation-controller": "^40.0.0",
"@metamask/utils": "^11.4.2",
"@ngraveio/bc-ur": "^1.1.13",
Expand Down
39 changes: 15 additions & 24 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7245,15 +7245,15 @@ __metadata:
languageName: node
linkType: hard

"@metamask/keyring-api@npm:^21.0.0, @metamask/keyring-api@npm:^21.2.0":
version: 21.2.0
resolution: "@metamask/keyring-api@npm:21.2.0"
"@metamask/keyring-api@npm:^21.0.0, @metamask/keyring-api@npm:^21.2.0, @metamask/keyring-api@npm:^21.3.0":
version: 21.3.0
resolution: "@metamask/keyring-api@npm:21.3.0"
dependencies:
"@metamask/keyring-utils": "npm:^3.1.0"
"@metamask/superstruct": "npm:^3.1.0"
"@metamask/utils": "npm:^11.1.0"
bitcoin-address-validation: "npm:^2.2.3"
checksum: 10/cc3cd9f9ef65b33aa0af2f4aa556fab7ebab78ce21a09b8e1cb6f328b456c444e0169d7aac08dd62425fb12895d68dfee0ddb6e3d8a43950a8ba1852c6b92609
checksum: 10/5d1f2705d76d8cfc70378f740e054fca163735b7b77b86b092cfd311d1befb27fac16f81b210ef2c719ce32010e1db55916b7b78d1f7a84239e47b771e5d84cc
languageName: node
linkType: hard

Expand Down Expand Up @@ -9077,10 +9077,10 @@ __metadata:
languageName: node
linkType: hard

"@metamask/tron-wallet-snap@npm:^1.16.0":
version: 1.16.0
resolution: "@metamask/tron-wallet-snap@npm:1.16.0"
checksum: 10/86be8ef0b7258b8375b9ab43eb4a8f55018f02a226a3784b727a25c03c249afa75e9adacecbf72f982dbf720db4107882a1b8304634bc5dad25ce2db760beff0
"@metamask/tron-wallet-snap@npm:^1.17.0":
version: 1.17.0
resolution: "@metamask/tron-wallet-snap@npm:1.17.0"
checksum: 10/b7ec689ed01d55342a12dc25cb9da7bd03e2d8df65a52e15c11a2e69842339d57cf7ea30d66ebff1e902d6dd43dff5cf7b559a4b6a5c3d1b910fb1f64192b549
languageName: node
linkType: hard

Expand Down Expand Up @@ -33397,7 +33397,7 @@ __metadata:
"@metamask/kernel-shims": "npm:^0.3.0"
"@metamask/kernel-ui": "npm:^0.3.0"
"@metamask/kernel-utils": "npm:^0.3.0"
"@metamask/keyring-api": "npm:^21.2.0"
"@metamask/keyring-api": "npm:^21.3.0"
"@metamask/keyring-controller": "npm:^25.0.0"
"@metamask/keyring-internal-api": "npm:^9.1.0"
"@metamask/keyring-internal-snap-client": "npm:^8.0.0"
Expand Down Expand Up @@ -33462,7 +33462,7 @@ __metadata:
"@metamask/test-snaps": "npm:^3.0.0"
"@metamask/transaction-controller": "npm:^62.3.1"
"@metamask/transaction-pay-controller": "npm:^10.2.0"
"@metamask/tron-wallet-snap": "npm:^1.16.0"
"@metamask/tron-wallet-snap": "npm:^1.17.0"
"@metamask/user-operation-controller": "npm:^40.0.0"
"@metamask/utils": "npm:^11.4.2"
"@ngraveio/bc-ur": "npm:^1.1.13"
Expand Down Expand Up @@ -37529,21 +37529,12 @@ __metadata:
languageName: node
linkType: hard

"qs@npm:6.13.0":
version: 6.13.0
resolution: "qs@npm:6.13.0"
dependencies:
side-channel: "npm:^1.0.6"
checksum: 10/f548b376e685553d12e461409f0d6e5c59ec7c7d76f308e2a888fd9db3e0c5e89902bedd0754db3a9038eda5f27da2331a6f019c8517dc5e0a16b3c9a6e9cef8
languageName: node
linkType: hard

"qs@npm:^6.10.0, qs@npm:^6.12.3, qs@npm:^6.4.0":
version: 6.14.0
resolution: "qs@npm:6.14.0"
"qs@npm:^6.10.0, qs@npm:^6.12.3, qs@npm:^6.14.1, qs@npm:^6.4.0":
version: 6.14.1
resolution: "qs@npm:6.14.1"
dependencies:
side-channel: "npm:^1.1.0"
checksum: 10/a60e49bbd51c935a8a4759e7505677b122e23bf392d6535b8fc31c1e447acba2c901235ecb192764013cd2781723dc1f61978b5fdd93cc31d7043d31cdc01974
checksum: 10/34b5ab00a910df432d55180ef39c1d1375e550f098b5ec153b41787f1a6a6d7e5f9495593c3b112b77dbc6709d0ae18e55b82847a4c2bbbb0de1e8ccbb1794c5
languageName: node
linkType: hard

Expand Down Expand Up @@ -40765,7 +40756,7 @@ __metadata:
languageName: node
linkType: hard

"side-channel@npm:^1.0.4, side-channel@npm:^1.0.6, side-channel@npm:^1.1.0":
"side-channel@npm:^1.0.4, side-channel@npm:^1.1.0":
version: 1.1.0
resolution: "side-channel@npm:1.1.0"
dependencies:
Expand Down
Loading