refactor: add .js import extensions to Product Safety packages - #9620
Merged
Conversation
Mrtenz
force-pushed
the
mrtenz/esm-import-extensions-product-safety
branch
from
July 23, 2026 21:10
cde9818 to
6476503
Compare
cryptotavares
approved these changes
Jul 24, 2026
pull Bot
pushed a commit
to Reality2byte/core
that referenced
this pull request
Jul 31, 2026
## Explanation Phishing controller ## [17.3.1] ### Changed - Bump `@metamask/transaction-controller` from `^69.0.0` to `^69.4.0` ([MetaMask#9568](MetaMask#9568), [MetaMask#9589](MetaMask#9589), [MetaMask#9593](MetaMask#9593), [MetaMask#9693](MetaMask#9693), [MetaMask#9735](MetaMask#9735)) ### Fixed - Address poisoning known recipients now use the actual token recipient decoded from calldata for confirmed ERC-20/ERC-721/ERC-1155 token transfers, instead of the token contract address from `txParams.to` ([MetaMask#9699](MetaMask#9699)) ### Notes for reviewers **Why a patch.** Nothing here extends the package's surface area, so per [reviewing-release-prs.md](https://github.com/MetaMask/core/blob/main/docs/processes/reviewing-release-prs.md#4-review-new-version-strings) this lands on patch. The only code change since `17.3.0` is one line in `PhishingController` (`transaction.txParams.to` → `getEffectiveRecipient(transaction)`); the rest of the diff to this package is `.js` import-extension churn from MetaMask#9620 and the Jest 30 migration. No new exports, types, or arguments. The `@metamask/transaction-controller` range bump doesn't push this to a minor either — the same doc lists "adding or upgrading a runtime dependency" under "Everything else" rather than as an addition. Note that `checkAddressPoisoning` output does shift in both directions: lookalikes of the real ERC-20/721/1155 recipient now match, and lookalikes of the token contract address no longer do. That's captured in the `Fixed` entry above. **`@metamask/transaction-controller` needs no release here.** The `getEffectiveRecipient` export this fix depends on already shipped in `69.4.0`, published as part of release 1163.0.0. **Intentionally skipped.** `@metamask/address-book-controller`, `@metamask/base-controller`, `@metamask/controller-utils`, and `@metamask/messenger` all have unreleased changes and are dependencies of `@metamask/phishing-controller`, so the release tool flagged them. Their pending entries are pre-existing chore/refactor/deprecation work unrelated to this fix (and still uncategorized), so releasing them is a separate call for their codeowners. **Dependent bumps.** `@metamask/assets-controller` and `@metamask/assets-controllers` had their `@metamask/phishing-controller` range bumped to `^17.3.1` by the release tooling; both are recorded in their changelogs under `Unreleased`. ## References - Releases the fix from MetaMask#9699 - Unblocks pulling the fix into the mobile and extension clients ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/contributing.md#updating-changelogs), highlighting breaking changes as necessary - [x] I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > The released phishing-controller fix alters security-sensitive address-poisoning heuristics for token transfers; this PR is dependency/version churn but ships that behavior to extension/mobile consumers. > > **Overview** > **Monorepo release 1167.0.0** publishes **`@metamask/phishing-controller@17.3.1`** and wires consumers to that version. > > The new phishing-controller patch (documented in its changelog, not in this diff’s source) fixes **address-poisoning “known recipient” tracking** for confirmed ERC-20/721/1155 transfers: recipients are taken from **decoded calldata via `getEffectiveRecipient`** instead of **`txParams.to`** (the token contract). That can change which lookalike warnings fire—real transfer recipients match; token contract addresses no longer do. > > **`@metamask/assets-controller`** and **`@metamask/assets-controllers`** bump their **`@metamask/phishing-controller`** dependency from **`^17.3.0`** to **`^17.3.1`**, with matching **Unreleased** changelog entries. **`yarn.lock`** and root **`package.json`** version are updated accordingly. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1f778f9. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds
.jsimport extensions to all relative imports in theProduct Safety packages, in preparation for the ESM refactor.
The ESLint rule that enforces this (
n/file-extension-in-import+import-x/extensions) has been added for these packages ineslint.config.mjs.Packages
@metamask/phishing-controllerNote
Low Risk
Mechanical import-path and tooling updates only; no changes to security-sensitive runtime logic in the phishing controller.
Overview
Prepares
@metamask/phishing-controllerfor the ESM refactor by appending.jsto every relative import/export acrosssrc/(including tests,index.ts, and generated method-action types). No phishing, scanning, or caching behavior changes—only module specifiers.eslint.config.mjsnow includespackages/phishing-controller/**in the shared block that enforcesn/file-extension-in-importandimport-x/extensions.package.jsonmessenger-action-type scripts gain the--esmflag so generated types stay aligned with ESM import paths.Reviewed by Cursor Bugbot for commit 6476503. Bugbot is set up for automated code reviews on this repo. Configure here.