feat(snap-networks-utils): add shared AssetsProvider (WPN-1784) by ulissesferreira · Pull Request #82 · MetaMask/internal-snaps

ulissesferreira · 2026-07-31T12:52:43Z

Summary

Add AssetsProvider to @metamask/snap-networks-utils as a thin, typed read layer over Core AssetsController
Bump @metamask/assets-controller to ^13.0.0 and wire messenger actions for getAccountAssetByID, getAccountAssetsByIDs, and getAccountAssetsByScope
Export AssetsProvider, AssetsProviderMessenger, and ASSETS_PROVIDER_NAME from the package root
Sync bitcoin and tron snap.manifest.json bundle shasums after lockfile changes

Test plan

yarn workspace @metamask/snap-networks-utils run build
yarn workspace @metamask/snap-networks-utils run test
yarn constraints

socket-security · 2026-07-31T12:52:54Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@metamask/assets-controller@13.0.0

View full report

socket-security · 2026-07-31T12:52:55Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

npm/@tanstack/query-core@5.101.4
npm/ulid@2.4.0
npm/@metamask/assets-controller@13.0.0
npm/@ethersproject/providers@5.8.0
npm/@metamask/assets-controllers@110.0.3
npm/@metamask/config-registry-controller@2.0.0
npm/@metamask/core-backend@8.1.0
npm/@metamask/network-controller@35.0.0
npm/@metamask/phishing-controller@17.3.0
npm/@metamask/remote-feature-flag-controller@5.0.0
npm/@metamask/transaction-controller@69.4.0
npm/@metamask/profile-sync-controller@28.3.0
npm/ethereumjs-wallet@1.0.2
npm/@metamask/eth-json-rpc-infura@10.3.0
npm/@metamask/geolocation-controller@1.0.0
npm/@metamask/multichain-network-controller@3.2.2
npm/keccak@3.0.4
npm/rlp@2.2.7
npm/ws@8.18.0
npm/@metamask/snaps-controllers@19.0.1

View full report

ulissesferreira · 2026-07-31T12:59:37Z

@SocketSecurity ignore npm/shiki@0.14.7
Transitive via typedoc (devDependency only, docs/build tooling).
"Obfuscated" alert is minified highlighter + TextMate grammars.
Network/fetch is for loading onig.wasm and local theme/grammar assets.
Same version already ignored in MetaMask/eth-json-rpc-middleware#426; also present in MetaMask/core via typedoc.

ulissesferreira · 2026-07-31T12:59:38Z

@SocketSecurity ignore npm/vscode-oniguruma@1.7.0
Transitive via typedoc → shiki (devDependency only).
fetch is Emscripten WASM bootstrap (same-origin).
Publisher change alexandrudima → vscode-bot is Microsoft maintainers on microsoft/vscode-oniguruma.
Same version ignored in MetaMask/eth-json-rpc-middleware#426; also in MetaMask/core.

ulissesferreira · 2026-07-31T12:59:40Z

@SocketSecurity ignore npm/cjs-module-lexer@1.4.3
Transitive via @ts-bridge/cli (build tooling only; not in published dist).
Official nodejs/cjs-module-lexer; installed sources use JSON.parse, not eval.
Already present in this repo via Jest as a different major.

ulissesferreira · 2026-07-31T12:59:41Z

@SocketSecurity ignore npm/marked@4.3.0
Transitive via typedoc (docs tooling only; not in published dist).
AI alert is about markdown URL sanitization; only used for typedoc HTML docs.
Same typedoc→marked@4.3.0 stack already in MetaMask/core.

ulissesferreira · 2026-07-31T12:59:49Z

@SocketSecurity ignore npm/@metamask/snaps-controllers@19.0.1
Transitive via @metamask/assets-controller (messenger action types only; controller runtime not in published dist).
First-party MetaMask controller package; obfuscation alert is compiled/transpiled controller bundle.
Same package already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:50Z

@SocketSecurity ignore npm/@metamask/assets-controller@11.2.0
Direct dependency for Core AssetsController messenger action types; published dist does not bundle controller runtime.
Network/fetch is expected for MetaMask controller packages already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:51Z

@SocketSecurity ignore npm/@metamask/eth-json-rpc-infura@10.3.0
Transitive via @metamask/assets-controller. First-party MetaMask JSON-RPC client used by network controllers.
Publisher change gudahtt → metamaskbot is MetaMask org maintainers; package already in MetaMask/core.

ulissesferreira · 2026-07-31T12:59:51Z

@SocketSecurity ignore npm/@metamask/assets-controllers@110.0.2
Transitive via @metamask/assets-controller (types-only usage; controller runtime not shipped in published dist).
First-party MetaMask controller package; network access expected for RPC/API controllers in MetaMask/core.

ulissesferreira · 2026-07-31T12:59:52Z

@SocketSecurity ignore npm/@metamask/multichain-network-controller@3.2.1
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:53Z

@SocketSecurity ignore npm/@ethersproject/providers@5.8.0
Transitive via @metamask/assets-controller. Standard ethers v5 JSON-RPC provider used by MetaMask controllers.
Not executed in @metamask/snap-networks-utils published output; already present across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:54Z

@SocketSecurity ignore npm/@metamask/network-controller@34.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:54Z

@SocketSecurity ignore npm/@metamask/config-registry-controller@1.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:54Z

@SocketSecurity ignore npm/@tanstack/query-core@5.101.4
Transitive via @metamask/assets-controller. Standard TanStack Query core used by MetaMask controllers for data fetching.
Not executed in @metamask/snap-networks-utils published output; already present across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:55Z

@SocketSecurity ignore npm/@metamask/phishing-controller@17.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:55Z

@SocketSecurity ignore npm/@metamask/core-backend@7.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:56Z

@SocketSecurity ignore npm/keccak@3.0.4
Transitive via @metamask/assets-controller → ethereum crypto stack.
Standard keccak native addon used across MetaMask/core for address/hash operations.

ulissesferreira · 2026-07-31T12:59:56Z

@SocketSecurity ignore npm/@metamask/profile-sync-controller@28.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:57Z

@SocketSecurity ignore npm/@metamask/core-backend@8.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:57Z

@SocketSecurity ignore npm/ethereumjs-wallet@1.0.2
Transitive via @metamask/assets-controller. Legacy ethereumjs-wallet used by MetaMask controller dependency tree.
Publisher change is ethereumjs org maintainer rotation; deprecated notice is upstream rename to @ethereumjs/wallet.

ulissesferreira · 2026-07-31T12:59:57Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@4.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:58Z

@SocketSecurity ignore npm/rlp@2.2.7
Transitive via @metamask/assets-controller. Standard RLP encoding library in MetaMask/core dependency tree.
Publisher change holgerd77 → ralxz is ethereumjs org maintainer rotation.

ulissesferreira · 2026-07-31T12:59:59Z

@SocketSecurity ignore npm/@metamask/transaction-controller@69.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T13:00:00Z

@SocketSecurity ignore npm/ulid@2.4.0
Transitive via @metamask/assets-controller. Standard ULID generator used by MetaMask controllers.
Publisher change alizain → perrymitchell is routine npm maintainer handoff on the ulid package.

ulissesferreira · 2026-07-31T13:00:01Z

@SocketSecurity ignore npm/ws@8.18.0
Transitive via @metamask/assets-controller. Standard WebSocket library used by MetaMask controller dependency tree.
AI anomaly is generic EventTarget-style event dispatch; already present across MetaMask/core.

ulissesferreira · 2026-07-31T19:13:15Z

@SocketSecurity ignore npm/@metamask/transaction-controller@69.4.0
Transitive via @metamask/assets-controller@13.0.0 (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T21:54:56Z

@metamaskbot publish-preview

github-actions · 2026-07-31T21:57:21Z

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.

@metamask-previews/bitcoin-wallet-snap@2.0.0-preview-8589132
@metamask-previews/snap-networks-utils@0.0.0-preview-8589132
@metamask-previews/tron-wallet-snap@2.0.0-preview-8589132

…red AssetsProvider Wire @metamask/tron-wallet-snap to @metamask-previews/snap-networks-utils@0.0.0-preview-8589132 (published from PR #82) via npm alias, replacing workspace:^ to satisfy yarn constraints. Allow the preview dependency range in yarn.config.cjs until PR #82 merges. Co-authored-by: Cursor <cursoragent@cursor.com>

mikesposito · 2026-08-03T08:11:34Z


 ### Added

+- Add `AssetsProvider` ([#82](https://github.com/MetaMask/internal-snaps/pull/82))


nit: FYI when releasing this controller for the first time we'll likely squash all CHANGELOG entries in a single one with something like:

- Initial package release ([#82](https://github.com/MetaMask/internal-snaps/pull/82), [#79](https://github.com/MetaMask/internal-snaps/pull/79))

As from the consumer point of view there's no diff from the previous version, since there's no previous version

Sounds good! From my understanding you are suggesting doing that at release time so not changing anything here for now 👁️

I was suggesting to not bother logging changes as they will be removed - and yes, we can consolidate them at release time but it'd be easier if we had an entry already, so that we can easily see all PRs that contributed to the package initial release (see example I posted above with multiple PR links listed at the end of the entry)

Got it 🧠

Addressed ✅

Apply review nits: drop non-consumer Tron changelog entry, use type annotations instead of casts, and move types-only @metamask/messenger to devDependencies.

Replace per-PR entries with a single initial-release line so all contributing PRs are tracked without interim changelog churn.

mikesposito

LGTM!

ulissesferreira mentioned this pull request Jul 31, 2026

feat: add shared AssetsService to snap-networks-utils #80

Closed

4 tasks

ulissesferreira added a commit that referenced this pull request Jul 31, 2026

chore: link AssetsService changelog entry to PR #82

04cc577

ulissesferreira added no-changelog and removed no-changelog labels Jul 31, 2026

MetaMask deleted a comment from cursor Bot Jul 31, 2026

ulissesferreira force-pushed the WPN-1784-shared-assets-service branch 2 times, most recently from 80f3343 to 0d6b38b Compare July 31, 2026 20:16

ulissesferreira added the no-changelog label Jul 31, 2026

ulissesferreira force-pushed the WPN-1784-shared-assets-service branch 3 times, most recently from 76d9473 to f4e8722 Compare July 31, 2026 20:29

feat(snap-network-utils): add shared AssetsProvider

8589132

ulissesferreira force-pushed the WPN-1784-shared-assets-service branch from 8747d44 to 8589132 Compare July 31, 2026 21:24

ulissesferreira changed the title ~~feat: add shared AssetsService to snap-networks-utils (WPN-1784)~~ feat(snap-network-utils): add shared AssetsProvider (WPN-1784) Jul 31, 2026

ulissesferreira assigned ulissesferreira and unassigned ulissesferreira Jul 31, 2026

ulissesferreira marked this pull request as ready for review July 31, 2026 21:25

ulissesferreira temporarily deployed to default-branch July 31, 2026 21:25 — with GitHub Actions Inactive

mikesposito reviewed Aug 3, 2026

View reviewed changes

ulissesferreira added 2 commits August 3, 2026 09:50

Address PR review feedback for AssetsProvider

49e44b5

Apply review nits: drop non-consumer Tron changelog entry, use type annotations instead of casts, and move types-only @metamask/messenger to devDependencies.

chore(snap-networks-utils): consolidate changelog for initial release

450cea2

Replace per-PR entries with a single initial-release line so all contributing PRs are tracked without interim changelog churn.

ulissesferreira enabled auto-merge August 3, 2026 13:01

mikesposito approved these changes Aug 3, 2026

View reviewed changes

ulissesferreira added this pull request to the merge queue Aug 3, 2026

Merged via the queue into main with commit e6f72e1 Aug 3, 2026
46 checks passed

ulissesferreira deleted the WPN-1784-shared-assets-service branch August 3, 2026 13:13

ulissesferreira changed the title ~~feat(snap-network-utils): add shared AssetsProvider (WPN-1784)~~ feat(snap-networks-utils): add shared AssetsProvider (WPN-1784) Aug 4, 2026


		### Added

		- Add `AssetsProvider` ([#82](https://github.com/MetaMask/internal-snaps/pull/82))

Uh oh!

Conversation

ulissesferreira commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

Uh oh!

mikesposito Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

ulissesferreira Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

mikesposito Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

ulissesferreira Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

ulissesferreira commented Jul 31, 2026 •

edited

Loading

socket-security Bot commented Jul 31, 2026 •

edited

Loading

socket-security Bot commented Jul 31, 2026 •

edited

Loading