Release 1059.0.0 by FrederikBolding · Pull Request #9218 · MetaMask/core

FrederikBolding · 2026-06-22T08:16:51Z

Explanation

Release PR for network-controller and wallet which both have breaking changes. To dedupe the dependencies, this PR also releases all controllers that depend on network-controller. This PR also releases controller-utils which is needed as part of the network-controller release.

Note

High Risk
Releases @metamask/network-controller v33 with documented breaking changes (required init, RPC failover wired via feature flags, removed constructor options/types) across most of the monorepo; misaligned consumer upgrades could break wallet networking and initialization.

Overview
Monorepo release 1059.0.0 that cuts new package versions and refreshes changelinks across the workspace, driven mainly by @metamask/network-controller 33.0.0 and @metamask/controller-utils 12.3.0, with downstream patch/minor bumps (e.g. accounts-controller 39.0.2, transaction-controller 68.1.1, assets-controller 9.0.2, bridge controllers, polling, gas-fee, etc.).

The diff is almost entirely version + CHANGELOG.md + package.json dependency range updates; the root workspace also moves its dev dependency on network-controller from ^32 to ^33. Notable versioned entries called out in changelogs include network-controller@33.0.0 (breaking RPC failover/init and API changes from prior work) and smaller releases such as money-account-upgrade-controller@2.1.0 (step error wrapping) and accounts-controller@39.0.2 (changelog reclassification of optional constructor state).

Consumers upgrading via this release train inherit the network stack v33 breaking surface everywhere those dependency pins propagate.

^{Reviewed by Cursor Bugbot for commit 0196cb4. Bugbot is set up for automated code reviews on this repo. Configure here.}

metamask-ci · 2026-06-22T08:22:12Z

✅ Changelogs updated and pushed.

cryptodev-2s · 2026-06-22T08:29:22Z


 ## [Unreleased]

+## [39.0.2]


Does this needs to be a minor because of the constructor state property change ?

It was a bug in the type as the underlying controller has always supported the optional state property. So I would vote for patch.

Should it be under "Fixed" then?

## @metamask/money-account-api-data-service ## [0.3.0] ### Added - Add optional `trace` callback to `MoneyAccountApiDataService` constructor for network request tracing ([MetaMask#9451](MetaMask#9451)) - All HTTP calls (`fetchPositions`, `fetchInterest`, `fetchHistory`, `fetchRateHistory`) emit best-effort backdated traces with `startTime`, `success`, and `errorName` attributes - Tracing is isolated from fetch/retry logic; trace failures do not impact queries ## @metamask/chomp-api-service ## [4.0.0] ### Added - Add `getAssociatedAddresses` method, exposed as the `ChompApiService:getAssociatedAddresses` messenger action, which fetches the active address associations of the authenticated profile via `GET /v1/auth/address` ([MetaMask#9387](MetaMask#9387)) - Also adds the `ProfileAddressEntry` type describing each returned entry and the `ChompApiServiceGetAssociatedAddressesAction` type - Returned addresses are parsed into canonical lowercase form, entries are guaranteed to have `status: 'active'`, and results are never served from cache - The query cache key is scoped to the authenticated profile via a SHA-256 digest of the bearer token, so concurrent calls only share an in-flight request when they are for the same profile and one profile's associations are never cached under another's key ### Changed - **BREAKING:** `associateAddress` now throws an `HttpError` on a 409 response instead of returning the parsed body ([MetaMask#9387](MetaMask#9387)) - A 409 from `POST /v1/auth/address` indicates the address is associated with a _different_ profile; the previous handling attempted to parse the error body as an association result and failed with a confusing validation error. An address already associated with the authenticated profile is reported via a 201 response with `status: 'active'`, which is unchanged. - Bump `@metamask/utils` from `^11.9.0` to `^11.11.0` ([MetaMask#9074](MetaMask#9074)) - Bump `@metamask/controller-utils` from `^12.0.0` to `^12.3.0` ([MetaMask#8774](MetaMask#8774), [MetaMask#9058](MetaMask#9058), [MetaMask#9083](MetaMask#9083), [MetaMask#9218](MetaMask#9218)) - Bump `@metamask/base-data-service` from `^0.1.2` to `^0.1.3` ([MetaMask#8799](MetaMask#8799)) - Bump `@metamask/messenger` from `^1.2.0` to `^2.0.0` ([MetaMask#9392](MetaMask#9392)) - Update `LICENSE` text ([MetaMask#9472](MetaMask#9472)) ## @metamask/money-account-upgrade-controller ## [3.0.0] - **BREAKING:** Add persisted state tracking fully upgraded accounts ([MetaMask#9500](MetaMask#9500)) - `MoneyAccountUpgradeControllerState` changes from `Record<string, never>` to `{ upgradedAccounts }`, keyed by lowercased account address. Each entry records when the upgrade sequence completed and a fingerprint of the config it completed under (see new `MoneyAccountUpgradeStatus` type). Code constructing the state type (e.g. `{}` in tests or default-state maps) must include `upgradedAccounts`. - The constructor now accepts an optional `state` option, merged with the defaults; add `getDefaultMoneyAccountUpgradeControllerState` to construct those defaults. - Add `TerminalUpgradeError` and `isTerminalMoneyAccountUpgradeError`, and a `terminal` property on `MoneyAccountUpgradeStepError`, marking failures that cannot resolve by retrying — currently an account delegated to a third-party EIP-7702 implementation, an account with unexpected on-chain code, or an address confirmed to be associated with a different CHOMP profile ([MetaMask#9500](MetaMask#9500)) - The controller does not retry on its own; clients implementing their own retry logic around `upgradeAccount` can use `isTerminalMoneyAccountUpgradeError` to stop retrying failures that cannot succeed. ### Changed - **BREAKING:** The `associate-address` upgrade step now checks the profile's existing address associations via `ChompApiService:getAssociatedAddresses` before signing, and reports `already-done` without signing or submitting anything when the address is already associated ([MetaMask#9387](MetaMask#9387)) - `MoneyAccountUpgradeControllerMessenger` consumers must grant the `ChompApiService:getAssociatedAddresses` action alongside the previously required actions, and must provide a `@metamask/chomp-api-service` version that registers it (`>=4.0.0`). - The lookup is an optimization: if it fails, the step falls through to the previous sign-and-submit behavior. - A 409 conflict from the association request is disambiguated by re-fetching the associations, so a same-profile create race reports `already-done` instead of failing the upgrade; a genuine conflict (address associated with a different profile) still fails the step. - `upgradeAccount` now skips the step sequence entirely when the account is recorded in state as upgraded under the active config fingerprint, and records the account after a successful run. If the chain, CHOMP contract addresses, or Delegation Framework version change, the fingerprint no longer matches and the sequence re-runs ([MetaMask#9500](MetaMask#9500)) - Bump `@metamask/messenger` from `^1.2.0` to `^2.0.0` ([MetaMask#9392](MetaMask#9392)) - Bump `@metamask/authenticated-user-storage` from `^3.0.0` to `^3.0.1` ([MetaMask#9458](MetaMask#9458)) - Bump `@metamask/chomp-api-service` from `^3.1.0` to `^4.0.0` ([MetaMask#9586](MetaMask#9586))  ## References  ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  --- > [!NOTE] > **High Risk** > Multiple breaking releases affect CHOMP address association error handling and Money account upgrade state/messenger permissions; consumers must adopt new versions and migration steps together. > > **Overview** > **Monorepo release `1137.0.0`** — version bumps, finalized changelogs, and `yarn.lock` alignment for Money/CHOMP packages (no new implementation in this diff beyond release metadata). > > **`@metamask/chomp-api-service@4.0.0` (breaking):** ships `getAssociatedAddresses` and changes **`associateAddress`** to **throw on HTTP 409** instead of parsing the error body. > > **`@metamask/money-account-upgrade-controller@3.0.0` (breaking):** persisted **`upgradedAccounts`** state (config fingerprint), **terminal upgrade errors**, associate-address pre-check via **`getAssociatedAddresses`**, and **409 disambiguation**; depends on **`chomp-api-service@^4.0.0`**. > > **`@metamask/money-account-api-data-service@0.3.0`:** optional constructor **`trace`** callback for Money API HTTP calls. **`money-account-balance-service`** only bumps that dependency to `^0.3.0` (changelog under Unreleased; no package version bump in this diff). > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit edd0ba1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…er` (MetaMask#44766)  ## **Description**  ~~Using preview build from MetaMask/core#9611 Bumping `@metamask/network-enablement-controller` to `^6.0.0` ```markdown ## [6.0.0] ### Added - Expose missing public `NetworkEnablementController` method through its messenger ([MetaMask#9660](MetaMask/core#9660)) - The following action is now available: - `NetworkEnablementController:restoreEnabledNetworkMap` - Corresponding action type (`NetworkEnablementControllerRestoreEnabledNetworkMapAction`) is available as well. ### Changed - **BREAKING:** Popular-network classification is now augmented by `ConfigRegistryController` ([MetaMask#9611](MetaMask/core#9611)) - `NetworkEnablementControllerMessenger` now requires the `ConfigRegistryController:getState` action to be available. - Bump `@metamask/transaction-controller` from `^69.0.0` to `^69.3.0` ([MetaMask#9568](MetaMask/core#9568), [MetaMask#9589](MetaMask/core#9589), [MetaMask#9593](MetaMask/core#9593), [MetaMask#9693](MetaMask/core#9693)) - Bump `@metamask/keyring-api` from `^23.5.0` to `^23.7.0` ([MetaMask#9676](MetaMask/core#9676)) - Bump `@metamask/config-registry-controller` from `^0.4.1` to `^1.0.0` ([MetaMask#9706](MetaMask/core#9706)) ``` and `@metamask/config-registry-controller` to `^1.0.0` ```markdown ## [1.0.0] ### Added - Add `ConfigRegistryControllerStateChangedEvent` (`ConfigRegistryController:stateChanged`) to the controller's events ([MetaMask#9595](MetaMask/core#9595)) - Add `ConfigRegistryController.getNetworkConfigByCaip2ChainId` method to retrieve a network config by its CAIP-2 chain ID ([MetaMask#9597](MetaMask/core#9597), [MetaMask#9606](MetaMask/core#9606)) - The method returns the network config if found, or `undefined` if not found. - The method is also accessible via the controller's messenger as `ConfigRegistryController:getNetworkConfigByCaip2ChainId`. ### Changed - **BREAKING:** `ConfigRegistryControllerState.configs.networks` is now a `Record<Caip2ChainId, RegistryNetworkConfig>` instead of a `Record<string, RegistryNetworkConfig>` ([MetaMask#9606](MetaMask/core#9606)) - Bump `@metamask/utils` from `^11.9.0` to `^11.11.0` ([MetaMask#9074](MetaMask/core#9074)) - Bump `@metamask/controller-utils` from `^12.1.1` to `^12.3.0` ([MetaMask#9083](MetaMask/core#9083), [MetaMask#9218](MetaMask/core#9218)) - Bump `@metamask/profile-sync-controller` from `^28.1.1` to `^28.3.0` ([MetaMask#9119](MetaMask/core#9119), [MetaMask#9463](MetaMask/core#9463)) - Bump `@metamask/keyring-controller` from `^27.0.0` to `^27.1.0` ([MetaMask#9129](MetaMask/core#9129)) - Bump `@metamask/polling-controller` from `^16.0.6` to `^16.0.8` ([MetaMask#9218](MetaMask/core#9218), [MetaMask#9349](MetaMask/core#9349)) - Bump `@metamask/messenger` from `^1.2.0` to `^2.0.0` ([MetaMask#9392](MetaMask/core#9392)) ### Removed - **BREAKING:** Removed `ConfigRegistryControllerStateChangeEvent` type in favor of `ConfigRegistryControllerStateChangedEvent` ([MetaMask#9595](MetaMask/core#9595)) ``` ## **Changelog**  CHANGELOG entry: null ## **Related issues** Related: https://consensyssoftware.atlassian.net/browse/WPN-1710 ## **Manual testing steps** 1. Verify the network switching and asset polling work same as before ## **Screenshots/Recordings**  ### **Before**  ### **After**  ## **Pre-merge author checklist** - [ ] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [ ] I've completed the PR template to the best of my ability - [ ] I’ve included tests if applicable - [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Popular-network behavior now depends on config registry state at runtime; incorrect messenger wiring would break network enablement, but the change is limited to dependency versions and one delegate action. > > **Overview** > Bumps **`@metamask/network-enablement-controller`** to `^6.0.0` and **`@metamask/config-registry-controller`** to `^1.0.0`, with lockfile updates. > > Wires **`NetworkEnablementController`** to the config registry by delegating **`ConfigRegistryController:getState`** on its messenger so v6 can use registry data for popular-network classification. > > Config-registry selector tests now build mock registry entries with the **`RegistryNetworkConfig`** type instead of untyped inline objects, matching the v1 typed `configs.networks` shape. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1ddf8cd. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: MetaMask Bot <metamaskbot@users.noreply.github.com> Co-authored-by: Guillaume Roux <guillaumeroux123@gmail.com>

…er` (#44766)  ## **Description**  ~~Using preview build from MetaMask/core#9611 Bumping `@metamask/network-enablement-controller` to `^6.0.0` ```markdown ## [6.0.0] ### Added - Expose missing public `NetworkEnablementController` method through its messenger ([#9660](MetaMask/core#9660)) - The following action is now available: - `NetworkEnablementController:restoreEnabledNetworkMap` - Corresponding action type (`NetworkEnablementControllerRestoreEnabledNetworkMapAction`) is available as well. ### Changed - **BREAKING:** Popular-network classification is now augmented by `ConfigRegistryController` ([#9611](MetaMask/core#9611)) - `NetworkEnablementControllerMessenger` now requires the `ConfigRegistryController:getState` action to be available. - Bump `@metamask/transaction-controller` from `^69.0.0` to `^69.3.0` ([#9568](MetaMask/core#9568), [#9589](MetaMask/core#9589), [#9593](MetaMask/core#9593), [#9693](MetaMask/core#9693)) - Bump `@metamask/keyring-api` from `^23.5.0` to `^23.7.0` ([#9676](MetaMask/core#9676)) - Bump `@metamask/config-registry-controller` from `^0.4.1` to `^1.0.0` ([#9706](MetaMask/core#9706)) ``` and `@metamask/config-registry-controller` to `^1.0.0` ```markdown ## [1.0.0] ### Added - Add `ConfigRegistryControllerStateChangedEvent` (`ConfigRegistryController:stateChanged`) to the controller's events ([#9595](MetaMask/core#9595)) - Add `ConfigRegistryController.getNetworkConfigByCaip2ChainId` method to retrieve a network config by its CAIP-2 chain ID ([#9597](MetaMask/core#9597), [#9606](MetaMask/core#9606)) - The method returns the network config if found, or `undefined` if not found. - The method is also accessible via the controller's messenger as `ConfigRegistryController:getNetworkConfigByCaip2ChainId`. ### Changed - **BREAKING:** `ConfigRegistryControllerState.configs.networks` is now a `Record<Caip2ChainId, RegistryNetworkConfig>` instead of a `Record<string, RegistryNetworkConfig>` ([#9606](MetaMask/core#9606)) - Bump `@metamask/utils` from `^11.9.0` to `^11.11.0` ([#9074](MetaMask/core#9074)) - Bump `@metamask/controller-utils` from `^12.1.1` to `^12.3.0` ([#9083](MetaMask/core#9083), [#9218](MetaMask/core#9218)) - Bump `@metamask/profile-sync-controller` from `^28.1.1` to `^28.3.0` ([#9119](MetaMask/core#9119), [#9463](MetaMask/core#9463)) - Bump `@metamask/keyring-controller` from `^27.0.0` to `^27.1.0` ([#9129](MetaMask/core#9129)) - Bump `@metamask/polling-controller` from `^16.0.6` to `^16.0.8` ([#9218](MetaMask/core#9218), [#9349](MetaMask/core#9349)) - Bump `@metamask/messenger` from `^1.2.0` to `^2.0.0` ([#9392](MetaMask/core#9392)) ### Removed - **BREAKING:** Removed `ConfigRegistryControllerStateChangeEvent` type in favor of `ConfigRegistryControllerStateChangedEvent` ([#9595](MetaMask/core#9595)) ``` ## **Changelog**  CHANGELOG entry: null ## **Related issues** Related: https://consensyssoftware.atlassian.net/browse/WPN-1710 ## **Manual testing steps** 1. Verify the network switching and asset polling work same as before ## **Screenshots/Recordings**  ### **Before**  ### **After**  ## **Pre-merge author checklist** - [ ] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [ ] I've completed the PR template to the best of my ability - [ ] I’ve included tests if applicable - [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Popular-network behavior now depends on config registry state at runtime; incorrect messenger wiring would break network enablement, but the change is limited to dependency versions and one delegate action. > > **Overview** > Bumps **`@metamask/network-enablement-controller`** to `^6.0.0` and **`@metamask/config-registry-controller`** to `^1.0.0`, with lockfile updates. > > Wires **`NetworkEnablementController`** to the config registry by delegating **`ConfigRegistryController:getState`** on its messenger so v6 can use registry data for popular-network classification. > > Config-registry selector tests now build mock registry entries with the **`RegistryNetworkConfig`** type instead of untyped inline objects, matching the v1 typed `configs.networks` shape. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1ddf8cd. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: MetaMask Bot <metamaskbot@users.noreply.github.com> Co-authored-by: Guillaume Roux <guillaumeroux123@gmail.com>

FrederikBolding added 2 commits June 22, 2026 10:06

Initialize Release 1059.0.0

df85f92

Update Release 1059.0.0

cb9ba9d

FrederikBolding marked this pull request as ready for review June 22, 2026 08:19

FrederikBolding requested review from a team as code owners June 22, 2026 08:20

FrederikBolding temporarily deployed to default-branch June 22, 2026 08:20 — with GitHub Actions Inactive

chore: Update dependency bump changelog entries

ba1b5c7