1242.0.0

@metamask/account-tree-controller 9.0.0

Added

• Add AccountTreeSnapshot:strip{Metadata,Secrets} support (#10112)
  • This can be used to mutate the snapshot before calling :importState and ease custom flow integration where secrets and metadata would be imported in 2-steps.

Changed

• BREAKING: metadata is now optional on AccountWalletPayloadMetadata, AccountWalletGroupPayloadMetadata, and all wallet/group payload entry types (#10112)
  • Consumers reading metadata from a snapshot or payload must now guard against undefined (e.g. after calling AccountTreeSnapshot.stripMetadata()).
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/assets-controller 15.1.0

Changed

• Enhance spam asset cleanup to collect candidates from assetsBalance and remove swept assets from assetsPrice (#10095)
• Bump @metamask/core-backend from ^9.0.0 to ^9.1.1 (#10138, #10139)
• Bump @metamask/transaction-controller from ^69.8.0 to ^69.8.1 (#10124)
• Bump @metamask/remote-feature-flag-controller from ^6.1.0 to ^6.1.1 (#10129)
• Bump @metamask/account-tree-controller from ^8.1.0 to ^9.0.0 (#10139)
• Bump @metamask/assets-controllers from ^111.1.3 to ^111.1.4 (#10139)

Fixed

• Fix #start() re-entrancy so a second unlock/init/state-change trigger can't run a duplicate startup asset refresh while the first one is still in flight (#10131)
• Filter asset IDs by supported networks before calling the Price API v3 spot-prices endpoint. Prevent HTTP 400 errors (#10132)

@metamask/assets-controllers 111.2.0

Changed

• Set persist: false on state metadata for legacy assets controllers so their state is no longer written to disk (TokensController, CurrencyRateController, TokenRatesController, TokenBalancesController, AccountTrackerController, MultichainAssetsController, MultichainAssetsRatesController, MultichainBalancesController) (#9842)
• Bump @metamask/core-backend from ^9.0.0 to ^9.1.1 (#10138, #10139)
• Bump @metamask/phishing-controller from ^17.4.0 to ^17.4.1 (#10080)
• Bump @metamask/remote-feature-flag-controller from ^6.0.0 to ^6.1.1 (#9980, #10129)
• Bump @metamask/transaction-controller from ^69.6.1 to ^69.8.1 (#10046, #10080, #10124)
• Bump @metamask/utils from ^11.11.0 to ^11.12.0 (#10076)
• Bump @metamask/account-tree-controller from ^8.0.0 to ^9.0.0 (#10088, #10139)
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/bridge-controller 80.2.1

Changed

• Bump @metamask/transaction-controller from ^69.8.0 to ^69.8.1 (#10124)
• Bump @metamask/remote-feature-flag-controller from ^6.1.0 to ^6.1.1 (#10129)
• Bump @metamask/assets-controller from ^15.0.0 to ^15.0.1 (#10139)
• Bump @metamask/assets-controllers from ^111.1.3 to ^111.1.4 (#10139)
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/bridge-status-controller 75.5.1

Changed

• Bump @metamask/transaction-controller from ^69.8.0 to ^69.8.1 (#10124)
• Bump @metamask/bridge-controller from ^80.2.0 to ^80.2.1 (#10139)
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/claims-controller 0.6.2

Changed

• Bump @metamask/utils from ^11.11.0 to ^11.12.0 (#10076)
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/core-backend 9.1.1

Changed

• Bump @metamask/account-tree-controller from ^8.1.0 to ^9.0.0 (#10139)
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/earn-controller 12.2.7

Changed

• Bump @metamask/transaction-controller from ^69.7.0 to ^69.8.0 (#10080)
• Bump @metamask/account-tree-controller from ^8.0.0 to ^9.0.0 (#10088, #10139)

@metamask/notification-services-controller 27.0.2

Changed

• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/profile-metrics-controller 4.0.4

Changed

• Bump @metamask/transaction-controller from ^69.4.0 to ^69.8.1 (#9780, #10080, #9798, #9823, #9960, #9969, #10046, #10124)
• Bump @metamask/superstruct from ^3.1.0 to ^3.4.1 (#9754)
• Bump @metamask/accounts-controller from ^39.0.6 to ^39.1.1 (#9791, #9807, #9969)
• Bump @metamask/keyring-controller from ^27.1.0 to ^27.1.1 (#9791)
• Bump @metamask/utils from ^11.11.0 to ^11.12.0 (#10076)
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/profile-sync-controller 30.0.0

Added

• BREAKING: Add social identifier pairing after SRP sign-in (POST /api/v2/profile/pair/identifier) (#10128)
  • Add needsSocialPairing?: boolean to state (defaults true; cleared on success or 409 Conflict; left true on other failures so the next performSignIn retries; cleared without an API call when the user never logged in with a social provider). If authConnection is set but the seedless vault is not written yet, the flag stays true so onboarding-in-flight sign-ins can retry. Optional in the type so partial-state selectors stay assignable; treat undefined as true.
  • Add optional isSocialPairingEnabled config callback (defaults to () => false). When it returns true, Google/Apple/Telegram seedless users are paired after SRP login and profile pairing. Telegram never sends email (clients store a display name there).
  • Use SeedlessOnboardingController:getAccessToken to fetch the social JWT (refreshed when expired).
  • Add pairSocialIdentifier to JwtBearerAuth / SRPJwtBearerAuth and PairConflictError for 409 Conflict.

Changed

• BREAKING: Derive auth and user-storage message-signing keys natively via SIP-6 from HD keyring seeds instead of calling @metamask/message-signing-snap through SnapController. AuthenticationController and UserStorageController now require KeyringController:withKeyringV2Unsafe and no longer call SnapController:handleRequest. The message-signing snap remains for Portfolio / external origins (#9824)
  • Derive native SIP-6 keys with @noble/hashes HMAC-SHA-512 instead of Web Crypto, so auth works on React Native, whose SubtleCrypto cannot HMAC.
• Resolve HD entropy source IDs from KeyringController instead of the message-signing snap (getBearerToken primary ID, performSignIn SRP enumeration) (#9794)
• Bump @metamask/keyring-controller from ^27.1.0 to ^27.1.1 (#9791)
• Add @metamask/key-tree and @noble/curves; remove unused @metamask/snaps-controllers, @metamask/snaps-sdk, and @metamask/snaps-utils dependencies (#9824)
• Bump @metamask/utils from ^11.11.0 to ^11.12.0 (#10076)

@metamask/ramps-controller 20.3.0

Added

• Add NeoBankService for MetaMask Ramp API neo-bank-proxy endpoints under the /neobank prefix on the Ramp API host, including messenger actions for getAutoramp, registerPixAddress, getAutorampQuote, createAutoramp, getAutorampQuoteForAutoramp, attachAutorampQuote, getCustomerByExternalId, getMoonpayCustomerId, getWalletRegistrationStatus, and registerSelfHostedWallet. Mutating POSTs do not retry (to avoid duplicate Pix/autoramp creates without a stable Idempotency-Key); GETs still retry 429/5xx/network errors. Optional Idempotency-Key is forwarded when callers supply one. Also exports mapNeoBankAutorampToRemoteSnapshot, AutorampRemoteSnapshot, and wallet-registration HTTP types (WalletRegistrationError, RegistrationStatus, RegistrationOutcome). (#10031)
• Add RampsController autoramp last-seen cursor and Money Account wallet registration: persisted autoramps state, createAutoramp / refreshAutoramp(s) / applyAutorampStatusFromPush, registerMoneyAccountWallet, and RampsController:autorampStatusChanged. MoonPay remains the source of truth; hosts should call refreshAutoramps on resume to catch webhooks missed while the app was closed. Hosts must delegate RAMPS_CONTROLLER_REQUIRED_CONTROLLER_ACTIONS (AuthenticationController:getSessionProfile, KeyringController:signPersonalMessage, RemoteFeatureFlagController:getState) plus the NeoBank actions listed in RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS. (#10032)

Changed

• Bump @metamask/remote-feature-flag-controller from ^6.1.0 to ^6.1.1 (#10129)
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/shield-controller 6.0.2

Changed

• Bump @metamask/transaction-controller from ^69.6.1 to ^69.8.1 (#10046, #10080, #10124)
• Bump @metamask/utils from ^11.11.0 to ^11.12.0 (#10076)
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/smart-transactions-controller 26.0.1

Changed

• Bump @metamask/transaction-controller from ^69.6.1 to ^69.8.1 (#10046, #10080, #10124)
• Bump @metamask/utils from ^11.11.0 to ^11.12.0 (#10076)
• Bump @metamask/remote-feature-flag-controller from ^6.1.0 to ^6.1.1 (#10129)
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/social-controllers 2.8.1

Changed

• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)

@metamask/subscription-controller 8.1.0

Added

• Add selectIsActiveSubscriber to check whether a product has an active, trialing, or provisional subscription. (#10017)
• Add product-scoped entitlements to SubscriptionController state and export type-safe selectHasEntitlement and selectIsUsageAvailable selectors for Money Account Plus and Shield (#10017)
• Add getBenefits to fetch and persist Money Account Plus subscription benefits. (#10103)
  • New persisted SubscriptionControllerState.benefits field and SubscriptionController:getBenefits messenger action.
  • Requires an active MONEY_ACCOUNT_PLUS subscription; otherwise throws UserNotSubscribed without calling the service.
  • Lifecycle refreshes after entitlement polling, crypto subscribe, cancel, and uncancel are best-effort and do not fail the primary operation.

Changed

• Bump @metamask/transaction-controller from ^69.6.1 to ^69.8.1 (#10046, #10080, #10124)
• Bump @metamask/utils from ^11.11.0 to ^11.12.0 (#10076)
• Add fast-deep-equal ^3.1.3 as a dependency.
• Bump @metamask/profile-sync-controller from ^29.0.0 to ^30.0.0 (#10139)