chore: tron migration phase B

[taran-a]

Explanation

Reset Tron changelog file
Remove repo-level files and migrate Yarn patch
Update Tron package.json
Update Tron jest versions

References

• Related to WPN-1322

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jest@​29.7.0 ⏵ 30.0.3	+1		+2	+4
	@​metamask/​snaps-jest@​9.8.0 ⏵ 10.2.0	+1			+2
	semver@​7.8.2 ⏵ 7.8.5	+1		+1
	@​metamask/​superstruct@​3.2.1 ⏵ 3.4.1	+1

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm @jest/snapshot-utils is 72.0% likely to have a medium risk anomaly Notes: The code is a legitimate Jest snapshot utility with a notable security consideration: it evaluates snapshot contents via a dynamically created Function. While typical in this tooling context, this presents a potential code execution risk if snapshots can be manipulated. There is no evidence of external network or hardcoded secrets. Overall risk is moderate due to the dynamic execution sink; no clear malware indicators. Recommend ensuring snapshot integrity (e.g., checksums or trusted sources) and minimizing or sandboxing dynamic evaluation where possible. Confidence: 0.72 Severity: 0.60 From: ? → npm/jest@30.0.3 → npm/@jest/snapshot-utils@30.0.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@jest/snapshot-utils@30.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @jest/snapshot-utils is 80.0% likely to have a medium risk anomaly Notes: The code is a standard Jest test suite for snapshot-related utilities. It does not exhibit malicious behavior or deliberate backdoors. The only notable risk is the use of eval on serialized code within tests, which is acceptable in a strictly controlled test scenario but should be avoided or isolated to prevent accidental misuse in real code paths. Overall security risk is low to moderate due to eval in a test context, with no external data exfiltration or persistence mechanisms detected. Confidence: 0.80 Severity: 0.50 From: ? → npm/jest@30.0.3 → npm/@jest/snapshot-utils@30.0.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@jest/snapshot-utils@30.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @metamask/snaps-simulation is 62.0% likely to have a medium risk anomaly Notes: The fragment is primarily an orchestration layer for installing/executing MetaMask Snaps and registering internal RPC/action handlers. The main high-impact risk signals are (1) direct execution of snap source code obtained from fetchSnap(), and (2) sensitive key material derivation (mnemonic/seed) from options.secretRecoveryPhrase in a clearly labeled 'withKeyringV2Unsafe' handler that passes mnemonic+seed into an externally provided operation callback. Additionally, SnapController:getSnapFile forwards caller-controlled path/encoding to getSnapFile(auxiliaryFiles, ...)—which could enable unintended file access depending on that helper’s validation. No clear malicious exfiltration or obfuscation is visible in this snippet alone. Confidence: 0.62 Severity: 0.58 From: ? → npm/@metamask/snaps-jest@10.2.0 → npm/@metamask/snaps-simulation@4.3.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/snaps-simulation@4.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @unrs/resolver-binding-wasm32-wasi is 90.0% likely to have a medium risk anomaly Notes: This loader establishes a Node.js WASI/worker environment that: 1) passes the entire host process.env into the WASI instance (exposing all environment variables, including secrets, to loaded modules); 2) preopens the filesystem root (granting broad file read/write access under the host’s root directory); and 3) implements importScripts via synchronous fs.readFileSync + eval (allowing any local JS file to be executed in the loader context). If an untrusted or compromised WASM module or script is provided, it can read sensitive environment variables, access or modify arbitrary files, and execute arbitrary JavaScript—posing a moderate security risk. Recommended mitigations: restrict WASI preopens to a minimal directory, limit or sanitize environment variables passed into WASI, and replace or sandbox the eval-based importScripts mechanism. Confidence: 0.90 Severity: 0.60 From: ? → npm/jest@30.0.3 → npm/@unrs/resolver-binding-wasm32-wasi@1.12.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@unrs/resolver-binding-wasm32-wasi@1.12.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm glob is 75.0% likely to have a medium risk anomaly Notes: The analyzed code is a conventional, non-malicious implementation of glob pattern expansion and directory traversal. It reads filesystem data based on user-provided patterns but does not exhibit data exfiltration, remote communications, or code execution risks within this fragment. Overall security risk is low, with standard OS-specific handling for nocase behavior. Confidence: 0.75 Severity: 0.60 From: ? → npm/@metamask/snaps-cli@8.4.1 → npm/ts-jest@29.4.11 → npm/@metamask/snaps-jest@10.2.0 → npm/@lavamoat/allow-scripts@3.2.0 → npm/rimraf@5.0.10 → npm/bip322-js@3.0.0 → npm/jest@30.0.3 → npm/@jest/globals@29.7.0 → npm/tsx@4.20.5 → npm/glob@10.5.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@10.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ses is 70.0% likely to have a medium risk anomaly Notes: The file package/dist/ses.umd.min.js contains an SES/Compartment-based module loader/runtime fragment that uses dynamic evaluation and can modify global intrinsics. While heavily obfuscated, there is no evidence of malware behavior such as data exfiltration or backdoors; the behavior aligns with sandbox hardening rather than active exploitation. Confidence: 0.70 Severity: 0.35 From: ? → npm/@metamask/snaps-cli@8.4.1 → npm/@metamask/snaps-jest@10.2.0 → npm/ses@2.2.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ses@2.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• @jest/diff-sequences@30.4.0
• unrs-resolver@1.12.2
• napi-postinstall@0.3.4
• @emnapi/core@1.10.0
• @tybys/wasm-util@0.10.3
• @sinclair/typebox@0.34.52
• @metamask/snaps-controllers@21.0.0

View full report

[taran-a]

@SocketSecurity ignore npm/@metamask/snaps-controllers@21.0.0

[taran-a]

@SocketSecurity ignore npm/@emnapi/core@1.10.0
(already use jest@30.0.3 in Tron snap)

[taran-a]

@SocketSecurity ignore npm/@sinclair/typebox@0.34.52

(already use jest@30.0.3 in Tron snap)

[taran-a]

@SocketSecurity ignore npm/@tybys/wasm-util@0.10.3

(use this lib in core repo)

[taran-a]

@SocketSecurity ignore npm/napi-postinstall@0.3.4

(use this dep in Tron repo, but different version)

[taran-a]

@SocketSecurity ignore npm/unrs-resolver@1.12.2

(use this dep in Tron repo, but different version)

[taran-a]

@SocketSecurity ignore npm/@jest/diff-sequences@30.4.0