feat: bump mobile snaps packages to bring new snaps architecture

[Jonathansoufer]

Description

This PR bumps snaps packages alongside others in order to allow snaps new architecture and refactored code from snaps codebase be used into mobile as an external dependency.

The current PR builds the bases to the 8369. Any failing tests related to snaps can be safely ignored since the snaps "consumer" code is/will be handled/refactored on the PR above.

Related issues

Fixes: N/A

Pre-merge author checklist

• I’ve followed MetaMask Coding Standards.
• I've clearly explained what problem this PR is solving and how it is solved.
• I've linked related issues
• I've included manual testing steps
• I've included screenshots/recordings if applicable
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.
• I’ve properly set the pull request status:
  • In case it's not yet "ready for review", I've set it to "draft".
  • In case it's "ready for review", I've changed it from "draft" to "non-draft".

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@metamask/json-rpc-engine@7.3.2	Transitive: network	+18	3.41 MB	metamaskbot
npm/@metamask/post-message-stream@8.0.0	Transitive: network	+18	3.37 MB	lgbot
npm/@metamask/snaps-controllers@5.0.0	shell Transitive: environment, filesystem, network, unsafe	+146	41.2 MB	metamaskbot
npm/@metamask/snaps-rpc-methods@6.0.0	Transitive: environment, filesystem, network, shell, unsafe	+123	36.9 MB	metamaskbot
npm/@metamask/snaps-sdk@2.0.0	network	+34	5.65 MB	metamaskbot
npm/@metamask/snaps-utils@6.0.0	filesystem, network, shell Transitive: environment, unsafe	+122	36 MB	metamaskbot
npm/@noble/hashes@1.3.3	None	0	761 kB	paulmillr

🚮 Removed packages: npm/@metamask/json-rpc-engine@7.3.0, npm/@metamask/post-message-stream@7.0.0, npm/@metamask/snaps-controllers@3.2.0, npm/@metamask/snaps-rpc-methods@3.2.1, npm/@metamask/snaps-utils@3.2.0, npm/@noble/hashes@1.3.2

View full report↗︎

[socket-security]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/@metamask/post-message-stream@8.0.0, npm/@metamask/snaps-sdk@2.0.0, npm/@metamask/snaps-utils@6.0.0, npm/extension-port-stream@3.0.0

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

[owencraston]

are there any breaking changes that we need to worry about with this base controller change?

[owencraston]

seems like there is: https://github.com/MetaMask/core/blob/main/packages/base-controller/CHANGELOG.md#400

[Jonathansoufer]

This package is used in two files, this and this. The second make usage of this.controllerMessenger.subscribe 14 times. This method was named deprecated on 4.0.0 but restored [here] (MetaMask/core#3698). That's the reason it didn't break anything on our end.

[owencraston]

Thanks for pointing this out. Then I think its safe to move forward here.

[MajorLift]

@Jonathansoufer @owencraston Just a heads-up that subscribe will be removed from BaseController (formerly BaseControllerV2) in its next release.

However, that shouldn't break this.controllerMessenger.subscribe calls, since this.controllerMessenger is an instance of ControllerMessenger, and the subscribe property is not being removed from ControllerMessenger (or RestrictedControllerMessenger).

[owencraston]

can you pleas provide a brief explanation of why we need this path and perhaps what conditions need to be met for us to remove it?

[Jonathansoufer]

This patch is also related to the issue, adding a "default" to the base-controller.

[MajorLift]

This is unrelated to the linked issue. The intended interface for RestrictedControllerMessenger is to require all five generic parameters.

The added default arguments (=string) here allow all possible external actions and events to be used by all messenger instances, which completely negates the allowlist paradigm we have in place for controllers.

This is acceptable if it's absolutely needed to unblock development, but I would suggest that this patch be reverted in the near future as it compromises secure coding practices.

[owencraston]

Looking good. I added a few comments but nothing major. Let me know when you need me to take another pass.

[owencraston]

@SocketSecurity ignore npm/extension-port-stream@3.0.0
@SocketSecurity ignore npm/@metamask/post-message-stream@8.0.0
@SocketSecurity ignore npm/@metamask/snaps-sdk@2.0.0
@SocketSecurity ignore npm/@metamask/snaps-utils@6.0.0

[Jonathansoufer]

All comments addressed.

[Jonathansoufer]

This patch is also related to the issue, adding a "default" to the base-controller.

[owencraston]

💪

[sonarcloud]

Quality Gate passed

Issues
15 New issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud