feat(tron-wallet-snap): wire core messenger and resolve migration stage on reads by ulissesferreira · Pull Request #95 · MetaMask/internal-snaps

ulissesferreira · 2026-07-31T22:08:42Z

Summary

Instantiate Core messenger via getMessenger and endow RemoteFeatureFlagController:getState
Resolve assets migration stage from remote feature flags on each account asset read
No routing decisions yet — all reads still delegate to SnapAssetsAdapter

Part 1 of 2 split from #94. Part 2: WPN-1497-core-adapter-routing.

Jira

WPN-1497
Parent: WPN-1478

Test plan

yarn workspace @metamask/tron-wallet-snap build
yarn workspace @metamask/tron-wallet-snap run jest --no-coverage (887 tests)

Stacks on #92 (WPN-1497-snap-owned-helpers).

socket-security · 2026-07-31T22:09:18Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@metamask/remote-feature-flag-controller@4.2.2
	npm/@metamask/assets-controller@13.1.0

View full report

socket-security · 2026-07-31T22:09:20Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

npm/@tanstack/query-core@5.101.4
npm/ulid@2.4.0
npm/@metamask/remote-feature-flag-controller@4.2.2
npm/@metamask/remote-feature-flag-controller@5.0.0
npm/@metamask/assets-controller@13.1.0
npm/@ethersproject/providers@5.8.0
npm/@metamask/assets-controllers@110.1.0
npm/@metamask/config-registry-controller@2.0.0
npm/@metamask/core-backend@8.1.0
npm/@metamask/network-controller@35.0.0
npm/@metamask/phishing-controller@17.3.1
npm/@metamask/transaction-controller@69.4.0
npm/@metamask/profile-sync-controller@28.3.0
npm/ethereumjs-wallet@1.0.2
npm/@metamask/eth-json-rpc-infura@10.3.0
npm/@metamask/geolocation-controller@1.0.0
npm/@metamask/multichain-network-controller@3.2.2
npm/keccak@3.0.4
npm/rlp@2.2.7
npm/ws@8.18.0
npm/@metamask/snaps-controllers@19.0.1

View full report

ulissesferreira · 2026-08-02T12:29:53Z

@SocketSecurity ignore npm/@metamask/assets-controller@11.2.0
Direct dependency for Core AssetsController messenger action types; published snap dist does not bundle controller runtime.
Network/fetch is expected for MetaMask controller packages already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:54Z

@SocketSecurity ignore npm/@metamask/snaps-controllers@19.0.1
Transitive via @metamask/assets-controller (messenger action types only; controller runtime not in published dist).
First-party MetaMask controller package; obfuscation alert is compiled/transpiled controller bundle.

ulissesferreira · 2026-08-02T12:29:55Z

@SocketSecurity ignore npm/@metamask/assets-controllers@110.1.0
Transitive via @metamask/assets-controller (types-only usage; controller runtime not shipped in published dist).
First-party MetaMask controller package; network access expected for RPC/API controllers in MetaMask/core.

ulissesferreira · 2026-08-02T12:29:56Z

@SocketSecurity ignore npm/@metamask/config-registry-controller@2.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:57Z

@SocketSecurity ignore npm/@metamask/core-backend@7.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:58Z

@SocketSecurity ignore npm/@metamask/core-backend@8.1.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:00Z

@SocketSecurity ignore npm/@metamask/eth-json-rpc-infura@10.3.0
Transitive via @metamask/assets-controller. First-party MetaMask JSON-RPC client used by network controllers.
Publisher change gudahtt → metamaskbot is MetaMask org maintainers; package already in MetaMask/core.

ulissesferreira · 2026-08-02T12:30:01Z

@SocketSecurity ignore npm/@metamask/geolocation-controller@1.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:02Z

@SocketSecurity ignore npm/@metamask/multichain-network-controller@3.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:03Z

@SocketSecurity ignore npm/@metamask/network-controller@34.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:04Z

@SocketSecurity ignore npm/@metamask/network-controller@35.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:06Z

@SocketSecurity ignore npm/@metamask/phishing-controller@17.3.1
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:07Z

@SocketSecurity ignore npm/@metamask/profile-sync-controller@28.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:08Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@4.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:10Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@5.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:11Z

@SocketSecurity ignore npm/@metamask/transaction-controller@69.4.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.
AI anomaly is benign signature-verification utility code.

ulissesferreira · 2026-08-02T12:30:12Z

@SocketSecurity ignore npm/@ethersproject/providers@5.8.0
Transitive via @metamask/assets-controller. Standard ethers v5 JSON-RPC provider used by MetaMask controllers.
Not executed in @metamask/tron-wallet-snap published output; already present across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:13Z

@SocketSecurity ignore npm/@tanstack/query-core@5.101.4
Transitive via @metamask/assets-controller. Standard TanStack Query core used by MetaMask controllers for data fetching.
Not executed in @metamask/tron-wallet-snap published output; already present across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:14Z

@SocketSecurity ignore npm/keccak@3.0.4
Transitive via @metamask/assets-controller → ethereum crypto stack. Standard keccak native addon used across MetaMask/core for address/hash operations.
Native binaries alert is expected for this package.

ulissesferreira · 2026-08-02T12:30:15Z

@SocketSecurity ignore npm/ethereumjs-wallet@1.0.2
Transitive via @metamask/assets-controller. Legacy ethereumjs-wallet used by MetaMask controller dependency tree.
Publisher change is ethereumjs org maintainer rotation; deprecated notice is upstream rename to @ethereumjs/wallet.

ulissesferreira · 2026-08-02T12:30:16Z

@SocketSecurity ignore npm/rlp@2.2.7
Transitive via @metamask/assets-controller. Standard RLP encoding library in MetaMask/core dependency tree.
Publisher change holgerd77 → ralxz is ethereumjs org maintainer rotation.

ulissesferreira · 2026-08-02T12:30:17Z

@SocketSecurity ignore npm/ulid@2.4.0
Transitive via @metamask/assets-controller. Standard ULID generator used by MetaMask controllers.
Publisher change alizain → perrymitchell is routine npm maintainer handoff on the ulid package.

…ge on reads Instantiate the Core messenger endowment and resolve assets migration stage from remote feature flags on each account asset read, without routing decisions yet.

Align AssetsService files with lint:misc after rebasing onto snap-owned-helpers.

Update Linux manifest shasum, replace restricted `in` check with Object.hasOwn, and add AssetsService import suppression.

Bump devDependency to match snap-networks-utils baseline. Update AssetsService test mocks for v13 SnapsAssetsMigrationStage enum names and RemoteFeatureFlagController:getState return shape. Co-authored-by: Cursor <cursoragent@cursor.com>

…ce tests

ulissesferreira · 2026-08-02T23:30:46Z

@SocketSecurity ignore npm/@metamask/assets-controller@13.1.0
Direct devDependency for Core messenger/types wiring in this PR (not bundled into snap output).
First-party MetaMask controller; network access via fetch is expected and already used across MetaMask/core.

@SocketSecurity ignore npm/ws@8.18.0
Transitive via @metamask/assets-controller@13.1.0. Standard WebSocket library; AI anomaly is benign EventTarget mixin code.

ulissesferreira requested review from a team as code owners July 31, 2026 22:08

ulissesferreira mentioned this pull request Jul 31, 2026

feat(tron-wallet-snap): implement feature-flagged AssetsController #94

Closed

2 tasks

ulissesferreira force-pushed the WPN-1497-snap-owned-helpers branch from b67ea64 to 8624473 Compare July 31, 2026 22:18

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from 2339dbc to 1413a43 Compare July 31, 2026 22:32

ulissesferreira added the no-changelog label Jul 31, 2026

ulissesferreira marked this pull request as draft August 2, 2026 17:39

ulissesferreira force-pushed the WPN-1497-snap-owned-helpers branch from b8e5fa7 to d5876a7 Compare August 2, 2026 20:48

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from e2a7495 to 64e6d11 Compare August 2, 2026 20:48

ulissesferreira and others added 7 commits August 3, 2026 00:19

feat(tron-wallet-snap): wire core messenger and resolve migration sta…

9c06904

…ge on reads Instantiate the Core messenger endowment and resolve assets migration stage from remote feature flags on each account asset read, without routing decisions yet.

style(tron-wallet-snap): format messenger plumbing changes

04444d0

Align AssetsService files with lint:misc after rebasing onto snap-owned-helpers.

fix(tron-wallet-snap): satisfy CI for messenger plumbing PR

22b04f2

Update Linux manifest shasum, replace restricted `in` check with Object.hasOwn, and add AssetsService import suppression.

chore: add AssetsService import suppression for messenger plumbing

0f362f7

fix(tron-wallet-snap): update manifest shasum for Linux CI build

55a8558

chore: trigger socket.dev re-evaluation of ignore comments

1663e82

ulissesferreira force-pushed the WPN-1497-snap-owned-helpers branch from d5876a7 to 81eb154 Compare August 2, 2026 23:20

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from b73d987 to 7302e9d Compare August 2, 2026 23:20

fix(tron-wallet-snap): update manifest shasums and format AssetsServi…

f5bde1f

…ce tests

ulissesferreira mentioned this pull request Aug 2, 2026

feat(tron-wallet-snap): remove assets migration feature-flag routing #97

Open

2 tasks

Uh oh!

Conversation

ulissesferreira commented Jul 31, 2026

Summary

Jira

Test plan

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

socket-security Bot commented Jul 31, 2026 •

edited

Loading

socket-security Bot commented Jul 31, 2026 •

edited

Loading