chore: remove unused deps in core-platform packages by cryptodev-2s · Pull Request #9064 · MetaMask/core

cryptodev-2s · 2026-06-09T14:42:29Z

Explanation

Triages the knip cleanup follow-up entries owned by `@MetaMask/core-platform` in `knip.config.ts` (the per-workspace `ignoreDependencies` block).

Per-package changes

`base-controller`: drop `@metamask/json-rpc-engine` devDep — no longer referenced from source.
`eth-json-rpc-middleware`: drop `pify` runtime dep, `@metamask/network-controller` devDep, and `tsd` devDep. Also delete `src/types.test-d.ts`, the only consumer of those deps — no script ever invoked `tsd` against it, so the type-compatibility check it implemented was never running.
`messenger-cli`: drop `eslint` devDep — only used via the root-level `lint:eslint` script.
`polling-controller`: drop `@metamask/controller-utils` runtime dep — no longer imported.
`network-controller`: drop `async-mutex` runtime dep — no longer imported.
`wallet-framework-docs`: configure knip with `entry` / `project` patterns for `site/docusaurus.config.ts` and `site/sidebars.ts` instead of an `ignoreDependencies` list, so the package's docusaurus deps are now properly resolved rather than silenced.

References

Follow-up to #9049, narrows the deferred per-workspace ignore list.

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Low Risk
Dependency and tooling cleanup only; no runtime logic changes beyond removing packages that were already unused in source.

Overview
Removes unused dependencies across several @MetaMask/core-platform packages and tightens knip so fewer issues are silenced with ignoreDependencies.

Runtime/dev deps dropped where source no longer references them: @metamask/json-rpc-engine from base-controller, pify plus @metamask/network-controller / tsd from eth-json-rpc-middleware (and src/types.test-d.ts deleted—the tsd compatibility test was never run), eslint from messenger-cli, @metamask/controller-utils from polling-controller, and async-mutex from network-controller. Package changelogs and README dependency diagrams are updated to match.

knip.config.ts drops per-workspace ignore entries for those packages. wallet-framework-docs now uses entry / project under site/ so Docusaurus config imports resolve, with a smaller targeted ignoreDependencies list for plugin-string and loader edge cases. yarn.lock shrinks accordingly (including transitive cleanup from removing tsd).

^{Reviewed by Cursor Bugbot for commit 7a02d48. Bugbot is set up for automated code reviews on this repo. Configure here.}

Triages the knip cleanup follow-up entries owned by @MetaMask/core-platform in `knip.config.ts`. Removed: - `base-controller`: drop `@metamask/json-rpc-engine` devDep — no longer referenced from source. - `eth-json-rpc-middleware`: drop `pify` runtime dep, `@metamask/network-controller` devDep, and `tsd` devDep. Also delete `src/types.test-d.ts`, the only consumer of those deps — no script invoked `tsd` against it so the type-compatibility check was never running. - `messenger-cli`: drop `eslint` devDep — only used via the root-level `lint:eslint` script. - `polling-controller`: drop `@metamask/controller-utils` runtime dep — no longer imported. - `network-controller`: drop `async-mutex` runtime dep — no longer imported. `wallet-framework-docs`: configure knip with `entry`/`project` patterns for `site/docusaurus.config.ts` and `site/sidebars.ts` so its docusaurus deps stop being flagged. Drops the corresponding ignore entries from `knip.config.ts`. Adds changelog entries for the three runtime-dep removals.

FrederikBolding · 2026-06-10T07:11:42Z

-// with the type of the `request` method from `AbstractRpcService` in
-// `@metamask/network-controller` (from where it was copied).
-declare const networkControllerRpcService: AbstractRpcService;
-expectAssignable<AbstractRpcServiceLike>(networkControllerRpcService);


Why are we removing this test?

This is a tsd test, and we currently don’t have anything in place to run tsd tests.

I can add it back and include a dedicated script for it, for example:

"test:types": "tsd"

FrederikBolding · 2026-06-10T07:12:12Z

      ignoreDependencies: ['immer'],
    },
    'packages/wallet-framework-docs': {
+      // Docusaurus loads these files at runtime; they're outside knip's


Yeah that wording was misleading, sorry. The real reason isn't docusaurus runtime loading, it's that this package's source lives under site/ instead of src/, so knip's default project glob misses it. Updated the comment in the latest push.

Earlier comment misattributed the entry/project patterns to docusaurus runtime loading; the real reason is that source lives under `site/` instead of `src/`.

## Explanation Release `1169.0.0` with version bumps for: - **`@metamask/eth-json-rpc-middleware`** `23.1.3` → `24.0.0` (major) - **`@metamask/network-controller`** `35.0.0` → `35.0.1` (patch) ### `@metamask/eth-json-rpc-middleware@24.0.0` **Breaking:** Add strict validation for `eth_sendTransaction` and `eth_signTransaction` params ([MetaMask#9482](MetaMask#9482)) - Reject requests whose params do not match the transaction schema (extraneous top-level keys, ill-typed fields such as non-hex `to`/`data`, malformed `accessList` / `authorizationList` entries) or exceed `MAX_TRANSACTION_PARAMS_SIZE_BYTES` when serialized - Prevents downstream normalization / PPOM WASM from crashing on deeply-nested junk fields or padded payloads and silently bypassing security scans Other changes: - Bump `@metamask/utils` from `^11.9.0` to `^11.11.0` ([MetaMask#9074](MetaMask#9074)) - Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.5.0` ([MetaMask#8661](MetaMask#8661), [MetaMask#8746](MetaMask#8746), [MetaMask#8753](MetaMask#8753)) - Bump `@metamask/message-manager` from `^14.1.1` to `^14.1.2` ([MetaMask#8755](MetaMask#8755)) - Drop `pify` dependency, which was no longer used in source ([MetaMask#9064](MetaMask#9064)) ### `@metamask/network-controller@35.0.1` - Bump `@metamask/eth-json-rpc-middleware` from `^23.1.3` to `^24.0.0` ([MetaMask#9758](MetaMask#9758)) ## References - [MetaMask#9482](MetaMask#9482) — feat: validate `eth_sendTransaction` / `eth_signTransaction` params ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  --- > [!NOTE] > **Medium Risk** > The release propagates a major middleware bump that rejects previously accepted malformed transaction RPC params; integrators on strict validation paths should expect possible breakage for non-conformant dapps, though this PR itself only changes versions and docs. > > **Overview** > This PR cuts **monorepo release `1169.0.0`** by versioning packages and aligning dependents—no application source changes beyond manifests and changelogs. > > **`@metamask/eth-json-rpc-middleware@24.0.0`** is published with changelog release notes for the existing **breaking** strict validation on `eth_sendTransaction` / `eth_signTransaction` (schema, size limits, rejection of malformed or oversized params). > > **`@metamask/network-controller@35.0.1`** bumps its dependency on that middleware from `^23.1.3` to `^24.0.0`. Root and many workspace packages update `@metamask/network-controller` to `^35.0.1`, with matching **Unreleased** changelog lines and **`yarn.lock`** resolution updates. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 455c03b. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: cryptodev-2s <109512101+cryptodev-2s@users.noreply.github.com>

cryptodev-2s requested review from a team as code owners June 9, 2026 14:42

cryptodev-2s temporarily deployed to default-branch June 9, 2026 14:42 — with GitHub Actions Inactive

cryptodev-2s force-pushed the chore/core-platform-knip-cleanup branch 3 times, most recently from b018f42 to 5952e08 Compare June 9, 2026 15:02

cryptodev-2s force-pushed the chore/core-platform-knip-cleanup branch from 5952e08 to 785b528 Compare June 9, 2026 15:05

Gudahtt reviewed Jun 9, 2026

View reviewed changes

Comment thread packages/eth-json-rpc-middleware/CHANGELOG.md Outdated

chore: move dep-removal changelog entries from Removed to Changed

5dd1faa

cryptodev-2s enabled auto-merge June 9, 2026 15:14

cryptodev-2s requested a review from Gudahtt June 9, 2026 15:15

cryptodev-2s disabled auto-merge June 9, 2026 15:18

cryptodev-2s commented Jun 9, 2026

View reviewed changes

Comment thread packages/polling-controller/CHANGELOG.md Outdated

Update packages/polling-controller/CHANGELOG.md

36e53b5

cryptodev-2s enabled auto-merge June 9, 2026 15:20

Merge branch 'main' into chore/core-platform-knip-cleanup

b6c123a

FrederikBolding reviewed Jun 10, 2026

View reviewed changes

docs(knip): clarify wallet-framework-docs comment

7a02d48

Earlier comment misattributed the entry/project patterns to docusaurus runtime loading; the real reason is that source lives under `site/` instead of `src/`.

cryptodev-2s requested a review from FrederikBolding June 10, 2026 08:31

FrederikBolding approved these changes Jun 10, 2026

View reviewed changes

cryptodev-2s added this pull request to the merge queue Jun 10, 2026

Merged via the queue into main with commit 5f4f95f Jun 10, 2026
370 checks passed

cryptodev-2s deleted the chore/core-platform-knip-cleanup branch June 10, 2026 10:05

OGPoyraz mentioned this pull request Aug 3, 2026

Release/1169.0.0 #9758

Merged

4 tasks

Navigation Menu

Uh oh!

Uh oh!

chore: remove unused deps in core-platform packages - #9064

chore: remove unused deps in core-platform packages#9064
cryptodev-2s merged 5 commits into
mainfrom
chore/core-platform-knip-cleanup

cryptodev-2s commented Jun 9, 2026 •

edited by cursor Bot

Loading

Uh oh!

Uh oh!

Uh oh!

FrederikBolding Jun 10, 2026

Uh oh!

cryptodev-2s Jun 10, 2026

Uh oh!

FrederikBolding Jun 10, 2026

Uh oh!

cryptodev-2s Jun 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

cryptodev-2s commented Jun 9, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Per-package changes

References

Checklist

Uh oh!

Uh oh!

Uh oh!

FrederikBolding Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

FrederikBolding Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cryptodev-2s commented Jun 9, 2026 •

edited by cursor Bot

Loading