Skip to content

Conversation

seaona
Copy link
Contributor

@seaona seaona commented Oct 3, 2025

Description

Open in GitHub Codespaces

Changelog

CHANGELOG entry:

Related issues

Fixes:

Manual testing steps

  1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@seaona seaona self-assigned this Oct 3, 2025
@seaona seaona added flaky tests skip-e2e-quality-gate no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed e2e-maintenance labels Oct 3, 2025
Copy link
Contributor

github-actions bot commented Oct 3, 2025

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the team-qa QA team label Oct 3, 2025
@github-actions github-actions bot added the size-S label Oct 3, 2025
@metamaskbot
Copy link
Collaborator

metamaskbot commented Oct 3, 2025

✨ Files requiring CODEOWNER review ✨

🔑 @MetaMask/accounts-engineers (1 files, +1 -0)
  • 📁 test/
    • 📁 e2e/
      • 📁 tests/
        • 📁 multichain-accounts/
          • 📄 common.ts +1 -0

🫰 @MetaMask/core-platform (3 files, +2 -2)

🧩 @MetaMask/extension-devs (5 files, +15 -25)
  • 📁 lavamoat/
    • 📁 browserify/
      • 📁 beta/
        • 📄 policy.json +1 -1
      • 📁 experimental/
        • 📄 policy.json +1 -1
      • 📁 flask/
        • 📄 policy.json +1 -1
      • 📁 main/
        • 📄 policy.json +1 -1
    • 📁 build-system/
      • 📄 policy.json +11 -21

📜 @MetaMask/policy-reviewers (5 files, +15 -25)
  • 📁 lavamoat/
    • 📁 browserify/
      • 📁 beta/
        • 📄 policy.json +1 -1
      • 📁 experimental/
        • 📄 policy.json +1 -1
      • 📁 flask/
        • 📄 policy.json +1 -1
      • 📁 main/
        • 📄 policy.json +1 -1
    • 📁 build-system/
      • 📄 policy.json +11 -21

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.


🧪 @MetaMask/qa (2 files, +30 -21)
  • 📁 test/
    • 📁 e2e/
      • 📄 helpers.js +30 -12
      • 📄 mock-e2e-allowlist.js +0 -9

🔗 @MetaMask/supply-chain (5 files, +15 -25)
  • 📁 lavamoat/
    • 📁 browserify/
      • 📁 beta/
        • 📄 policy.json +1 -1
      • 📁 experimental/
        • 📄 policy.json +1 -1
      • 📁 flask/
        • 📄 policy.json +1 -1
      • 📁 main/
        • 📄 policy.json +1 -1
    • 📁 build-system/
      • 📄 policy.json +11 -21

Copy link

socket-security bot commented Oct 3, 2025

Copy link

socket-security bot commented Oct 3, 2025

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block Low
@emotion/[email protected] has a New author.

New Author: emotion-release-bot

Previous Author: mitchellhamilton

From: yarn.locknpm/@emotion/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emotion/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
@emotion/[email protected] has a New author.

New Author: emotion-release-bot

Previous Author: mitchellhamilton

From: yarn.locknpm/@emotion/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emotion/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
@metamask/[email protected] has a New author.

New Author: lgbot

Previous Author: gudahtt

From: yarn.locknpm/@metamask/[email protected]npm/@metamask/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a New author.

New Author: ljharb

Previous Author: substack

From: yarn.locknpm/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a New author.

New Author: gudahtt

Previous Author: rekmarks

From: yarn.locknpm/@metamask/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a New author.

New Author: jsdnxx

Previous Author: jden

From: yarn.locknpm/[email protected]

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
@emotion/[email protected] is a AI-detected potential code anomaly.

Notes: Overall, this is a standard, non-malicious portion of the Emotion styling library. No evidence of backdoors, credential theft, or external network/data exfiltration. The primary risk vector is the CSS-in-DOM injection path via dangerouslySetInnerHTML, which is expected but should be reviewed in the context of trusted inputs. Security posture is low-to-moderate; no immediate danger, but maintain caution with user-supplied template literals and ensure dependencies are trusted.

Confidence: 1.00

Severity: 0.60

From: yarn.locknpm/@emotion/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emotion/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

'https://metamask.github.io/snap-simple-keyring/1.1.6/framework-fe667a09be4a08a9b5f4.js',
'https://metamask.github.io/snap-simple-keyring/1.1.6/page-data/app-data.json',
'https://metamask.github.io/snap-simple-keyring/1.1.6/page-data/index/page-data.json',
'https://metamask.github.io/snap-simple-keyring/1.1.6/webpack-runtime-f26b9ef4aabef2136bf7.js',
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

less live requests in our e2e, yay! 🎉

Copy link
Contributor Author

@seaona seaona Oct 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ the snap file binary changes are just the result of updating the snap package, by running this command: yarn update-snap-binary [email protected]

export async function installSnapSimpleKeyring(
driver: Driver,
isSyncFlow: boolean = true,
port: number = 8080,
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ we add this new param, to avoid port collisions in the case we need to use both the test dapp and the snap simple keyring page

"@metamask/foundryup": "^1.0.1",
"@metamask/phishing-warning": "^5.0.1",
"@metamask/preferences-controller": "^19.0.0",
"@metamask/snap-simple-keyring-site": "^2.0.0",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ we can now use the npm package

MetaMask/snap-simple-keyring#163

@seaona seaona changed the title test: add snap-simple-keyring-site as a local server test: add snap-simple-keyring-site as a local server and remove live requests to the site Oct 3, 2025
FrederikBolding pushed a commit to MetaMask/snaps-registry that referenced this pull request Oct 3, 2025
<!--
Thanks for your contribution! Take a moment to answer these questions so
that reviewers have the information they need to properly understand
your changes:

* What is the current state of things and why does it need to change?
* What is the solution your changes offer and how does it work?

Are there any issues or other links reviewers should consult to
understand this pull request better? For instance:

* Fixes #12345
* See: #67890
-->
Context:

The update to 2.0.0 doesn't change anything on the snap-simple-keyring.
It's a major update, because we have made the snap-simple-keyring-site
publishable, in order to use it in our e2e as a local server.

See more here:
- MetaMask/snap-simple-keyring#163
- MetaMask/metamask-extension#36557
@github-actions github-actions bot added size-M and removed size-S labels Oct 3, 2025
@seaona
Copy link
Contributor Author

seaona commented Oct 3, 2025

@metamaskbot update-policies

@metamaskbot
Copy link
Collaborator

Policies updated.
👀 Please review the diff for suspicious new powers.

🧠 Learn how: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

@metamaskbot
Copy link
Collaborator

❌ test-e2e-chrome-api-specs failed. View the html report here.

@metamaskbot
Copy link
Collaborator

📊 Page Load Benchmark Results

Current Commit: 2ae9ae5 | Date: 10/3/2025

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.05s (±72ms) 🟡 | historical mean value: 1.06s ⬇️ (historical data)
  • domContentLoaded-> current mean value: 735ms (±69ms) 🟢 | historical mean value: 741ms ⬇️ (historical data)
  • firstContentfulPaint-> current mean value: 77ms (±14ms) 🟢 | historical mean value: 81ms ⬇️ (historical data)
📈 Detailed Results
Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.05s 72ms 1.01s 1.34s 1.29s 1.34s
domContentLoaded 735ms 69ms 700ms 1.00s 944ms 1.00s
firstPaint 77ms 14ms 60ms 204ms 84ms 204ms
firstContentfulPaint 77ms 14ms 60ms 204ms 84ms 204ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms

Results generated automatically by MetaMask CI

@metamaskbot
Copy link
Collaborator

Builds ready [2ae9ae5]
UI Startup Metrics (1243 ± 72 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyHomeuiStartup1243110714147212921362
load107396512016311191193
domContentLoaded106596011976411081187
domInteractive18136381733
firstPaint603142119942810651139
backgroundConnect25523933512257273
firstReactRender24166582542
getState1258691224
initialActions50729614
loadScripts81871694462851940
setupStore96314915
WebpackHomeuiStartup20251431263528622382493
load16211133204222117501981
domContentLoaded16141128203121917411962
domInteractive191296161558
firstPaint1706635967199316
backgroundConnect271676103045
firstReactRender96383397687326
getState234294531462
initialActions62224618
loadScripts16101124202021817371951
setupStore195281411426
FirefoxBrowserifyHomeuiStartup14151206184211614831625
load1216105113898212911354
domContentLoaded1216105113898212911354
domInteractive1043539354115223
firstPaintNaNNaNNaNNaNNaNNaN
backgroundConnect3319150223377
firstReactRender29247483044
getState10316820648
initialActions5115816310
loadScripts1190102613728312651332
setupStore105559829
WebpackHomeuiStartup15901408200614816991880
load13541181170113214301614
domContentLoaded13531181170013214301613
domInteractive1093534264106313
firstPaintNaNNaNNaNNaNNaNNaN
backgroundConnect31206983745
firstReactRender38325144144
getState63192611
initialActions3115235
loadScripts13311153168113214101590
setupStore10613713916
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 54 Bytes (0%)
  • ui: 612 Bytes (0.01%)
  • common: 72 Bytes (0%)

@seaona
Copy link
Contributor Author

seaona commented Oct 3, 2025

@metamaskbot update-policies

@metamaskbot
Copy link
Collaborator

Policies updated.
👀 Please review the diff for suspicious new powers.

🧠 Learn how: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

@metamaskbot
Copy link
Collaborator

📊 Page Load Benchmark Results

Current Commit: 42b02d0 | Date: 10/3/2025

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.06s (±75ms) 🟡 | historical mean value: 1.05s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 740ms (±71ms) 🟢 | historical mean value: 741ms ⬇️ (historical data)
  • firstContentfulPaint-> current mean value: 77ms (±11ms) 🟢 | historical mean value: 81ms ⬇️ (historical data)
📈 Detailed Results
Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.06s 75ms 1.01s 1.33s 1.32s 1.33s
domContentLoaded 740ms 71ms 701ms 1.01s 978ms 1.01s
firstPaint 77ms 11ms 60ms 168ms 88ms 168ms
firstContentfulPaint 77ms 11ms 60ms 168ms 88ms 168ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms

Results generated automatically by MetaMask CI

@metamaskbot
Copy link
Collaborator

Builds ready [42b02d0]
UI Startup Metrics (1252 ± 71 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyHomeuiStartup1252114115687112831397
load107798313846211051183
domContentLoaded106997813766110991175
domInteractive18144361837
firstPaint65282124942810831159
backgroundConnect2562412797260272
firstReactRender25164762739
getState1255171528
initialActions51547614
loadScripts820730111059851925
setupStore1063241019
WebpackHomeuiStartup18271571216414219292089
load1502136817498815631667
domContentLoaded1488135517358715421659
domInteractive171181131350
firstPaint2445416293791841512
backgroundConnect331764113956
firstReactRender4818186255295
getState1252141420
initialActions40367324
loadScripts1484135317328715311657
setupStore154157231336
FirefoxBrowserifyHomeuiStartup1406125517799914571608
load1213109214397212771332
domContentLoaded1213109214397212761332
domInteractive101323165299243
firstPaintNaNNaNNaNNaNNaNNaN
backgroundConnect3118134163353
firstReactRender29245853040
getState8313514613
initialActions3022338
loadScripts1190107214067212541313
setupStore958210826
WebpackHomeuiStartup15161320200611815781715
load1324117816738713731501
domContentLoaded1324117716738713731501
domInteractive972938159100199
firstPaintNaNNaNNaNNaNNaNNaN
backgroundConnect3217108143661
firstReactRender3424144173375
getState9311917614
initialActions51518315
loadScripts1299116116458513421475
setupStore14521526948
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 65 Bytes (0%)
  • ui: 616 Bytes (0.01%)
  • common: 82 Bytes (0%)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
e2e-maintenance flaky tests no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed size-M skip-e2e-quality-gate team-qa QA team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants