fix: bump @metamask/transaction-controller to 69.5.1

[dan437]

Description

Bumps @metamask/transaction-controller from 69.5.0 to 69.5.1 (dependency range and resolutions pin) to pick up the eth_estimateGas fix from MetaMask/core#9797: the value field is now normalized to a canonical hex quantity (leading zero digits stripped, e.g. 0x00 → 0x0, 0x0de0b6b3a7640000 → 0xde0b6b3a7640000) before the estimation request is sent.

Some RPC nodes use strict hex-quantity parsing (e.g. Go's hexutil) and reject quantities with leading zero digits. When a dapp submitted a transaction with a padded value (as some ethers.js toBeHex() usages produce), gas estimation failed on those networks and transactions could not be sent.

Lockfile updated with yarn install --mode=update-lockfile.

Changelog

CHANGELOG entry: Fixed gas estimation failing on networks whose RPC nodes reject hex values with leading zeros (such as 0x00)

Related issues

Fixes: CONF-1740

Manual testing steps

Feature: gas estimation with non-canonical hex value

  Scenario: dapp sends a transaction with a leading-zero value
    Given a network whose RPC rejects hex quantities with leading zeros (e.g. Robinhood Chain)
    And a dapp connected to the wallet

    When the dapp calls eth_sendTransaction with value "0x00"
    Then the confirmation opens and gas estimation succeeds
    And the eth_estimateGas request carries value "0x0"

Screenshots/Recordings

N/A — dependency bump, no UI change.

Before

N/A

After

N/A

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Touches the core transaction/gas-estimation path via a patch bump only; behavior change is narrow but affects all EVM sends that estimate gas.

Overview
Upgrades @metamask/transaction-controller from 69.5.0 to 69.5.1 in package.json (dependency range and resolutions pin) and refreshes yarn.lock. There are no mobile app source changes.

The new patch pulls in upstream behavior that canonicalizes transaction value to hex quantity before eth_estimateGas, so padded values like 0x00 or 0x0de0b6b3a7640000 are sent as 0x0 / 0xde0b6b3a7640000. That unblocks gas estimation and sending on RPCs that reject non-canonical hex (e.g. strict Go hexutil parsers).

^{Reviewed by Cursor Bugbot for commit a9fc379. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[metamask-ci]

PR template — items to address before "Ready for review"

Warnings — informational, address before merging:

• Pre-merge author checklist has unchecked items (e.g. "I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors."). Every box must be consciously checked — see docs/readme/ready-for-review.md.

See docs/readme/ready-for-review.md for the full Definition of Ready for Review.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​metamask/​transaction-controller@​69.5.0 ⏵ 69.5.1			+1

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm @metamask/transaction-controller is 75.0% likely to have a medium risk anomaly Notes: The code performs straightforward signature verification using ethers.js, returning true when the recovered signer matches the provided publicKey. While generally safe, the silent catch and potential mismatch between data formatting and signing process should be addressed to avoid silent failures. Overall, a benign utility with moderate input-format sensitivity. Confidence: 0.75 Severity: 0.50 From: package.json → npm/@metamask/transaction-controller@69.5.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/transaction-controller@69.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.07%. Comparing base (f6a29a0) to head (017cb3f).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #34412   +/-   ##
=======================================
  Coverage   85.06%   85.07%           
=======================================
  Files        6320     6324    +4     
  Lines      172287   172330   +43     
  Branches    42580    42591   +11     
=======================================
+ Hits       146562   146610   +48     
+ Misses      15693    15686    -7     
- Partials    10032    10034    +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

⚡ Performance Test Results

ℹ️ Performance test results are currently non-blocking and will not block this PR.

✅ All tests passed · 2 tests · 1 device

📱 Devices tested (1)

Android: Google Pixel 8 Pro (v14.0)

✅ Passed Tests (2)

Test	Platform	Device	Duration	Team	Recording
Swap flow - ETH to LINK, SRP 1 + SRP 2 + SRP 3	Android	Google Pixel 8 Pro (v14.0)	1.39s	@swap-bridge-dev-team	📹 Watch
Cross-chain swap flow - ETH to SOL - 50+ accounts, SRP 1 + SRP 2 + SRP 3	Android	Google Pixel 8 Pro (v14.0)	5.73s	@swap-bridge-dev-team	📹 Watch

---

Branch: conf-1740-bump-transaction-controller-69.5.1 · Build: E2E · Commit: 0c13ec0 · View full run

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeAccounts, SmokeConfirmations, SmokeNetworkAbstractions, SmokeNetworkExpansion, SmokeSwap, SmokeStake, SmokeWalletPlatform, SmokeMoney, SmokePerps, SmokeMultiChainAPI, SmokePredictions, SmokeSeedlessOnboarding, SmokeBrowser, SmokeSnaps, SmokeMMConnect
• Selected Performance tags: None (no tests recommended)
• Risk Level: high
• AI Confidence: 100%

click to see 🤖 AI reasoning details

E2E Test Selection:
Hard rule (controller-version-update): @MetaMask controller package version updated in package.json: @metamask/transaction-controller. Running all tests.

Performance Test Selection:
This is a patch version bump to @metamask/transaction-controller (69.5.0 → 69.5.1). Patch versions contain bug fixes, not performance-impacting changes. The only dependency change is a peer dep bump for accounts-controller. No performance-sensitive code paths (app launch, onboarding, login, asset loading, swap execution timing) are expected to be affected by this minor fix. No performance tests are warranted.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud