Move peer deps for controller/service packages to direct deps

[mcmire]

Explanation

Some controllers and services expect other controllers and services to pre-exist so that they can communicate with them. Traditionally the way that we have expressed this dependency is via peer dependencies. That is, if a controller in @metamask/foo-controller used a service in @metamask/bar-service, then it would declare a peer dependency on a major version of @metamask/bar-service. This would enforce that clients declare a direct dependency on @metamask/bar-service and the major version used for this dependency matched the major version that @metamask/foo-controller expressed.

However, this approach complicates the release process. If the major version of a package is bumped, it must be synchronized across all peer dependents across the monorepo. But as a result, all peer dependents must be bumped by a major (since changing a peer dependency is a breaking change) and thus must be included in the release. This means that releases can quickly balloon in size, causing pain for other teams.

To address this issue, this commit converts all peer dependencies on controller and service packages to regular direct dependencies. This allows major versions of packages to be released more flexibly as needed.

However, this change also means that, at the client level, it is possible for different versions of packages to be present in the dependency tree. For instance, the client could directly depend on @metamask/foo-controller 1.0.0 and @metamask/bar-controller 1.0.0, but @metamask/bar-controller could itself depend on @metamask/foo-controller 1.1.0. So while @metamask/bar-controller thinks it is talking to a later version of @metamask/foo-controller, it would actually be talking to an earlier version.

In most cases any incompatibilities would show up at compile-time, but they could also show up at runtime. In general we expect client engineers to be aware of these differences when making new releases — perhaps more aware than they might be now.

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
• I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

---

Note

Replaces peerDependencies with direct dependencies across controller/service packages and updates Yarn config/lock/validation to enforce the new model.

• Dependencies:
  • Move controller/service peerDependencies to direct dependencies across many packages (e.g., accounts, assets, bridge, gas-fee, network, profile-sync, signature, transaction, etc.).
  • Remove corresponding peerDependencies and adjust devDependencies accordingly; update yarn.lock.
• Tooling (yarn.config.cjs):
  • Add rule to disallow workspace controller/service packages as peer deps; require them as direct deps instead.
  • Modify peer-deps check to only require devDependencies for non-workspace peers.
  • Update version-sync logic to handle deps listed in either prod or dev when no peer dep exists.
• Docs/Changelogs:
  • Update package changelogs to note the dependency model change and list affected packages where relevant.

^{Written by Cursor Bugbot for commit 47a5aed. This will update automatically on new commits. Configure here.}

[mcmire]

Adding the no-changelog label because controller-utils removes some peer dependencies outright rather that moving them, and I'm not sure this warrants mention in the changelog.

[cryptodev-2s]

LGTM!