cherry-pick(v12.1.1): Bump `@metamask/eth-json-rpc-middleware` to `^14.0.0` (#26143)

[MajorLift]

Description

Cherry-pick of #26143 for ~v12.1.0-rc~ v12.1.1-rc.

This is a very different PR from the original, as I had to remove diffs to a significant amount of code that has not yet been introduced to the release candidate.

The diffs that were excluded here will need to be reapplied to a future release. I'm also keeping an eye out for new cherry-picks that may introduce changes requiring me to restore certain diffs.

Aligning @metamask/eth-block-tracker to ^11.0.1 is deferred, as it's blocked by #26150, which is not included in this release candidate. The @metamask/transaction-controller major version bump from ^34.0.0 to ^35.1.1 is also removed for now.

See below for new changelog.

Changelog

Added

• Add and export PPOMMiddlewareRequest type for JsonRpcRequest types that include the securityAlertResponse property.
  • securityAlertResponse is defined as both optional and nullable.
• Add PPOMRequest type for eth-sendTransaction requests.

Changed

• BREAKING: Bump @metamask/eth-json-rpc-middleware from ^12.1.1 to ^14.0.0.
• Bump @trezor/connect-web from 9.2.2 to 9.3.0.

Fixed

• BREAKING: Narrow Params generic parameter of createPPOMMiddleware function from JsonRpcParams to (string | { to: string })[].
• Add Params generic parameter to handleSnapRequest function, which is constrained by Record<string, unknown> and defaults to JsonRpcParams.
  • handleSnapRequest can now be typed correctly with any params object.

Security

• BREAKING: Typed signature validation only replaces 0X prefix with 0x, and contract address normalization is removed for decimal and octal values.
  • Threat actors have been manipulating eth_signTypedData_v4 fields to cause failures in blockaid's detectors.
  • Extension crashes with an error when performing Malicious permit with a non-0x prefixed integer address.
  • This fixes an issue where the key value row or petname component disappears if a signed address is prefixed by "0X" instead of "0x".

Manual testing steps

1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

• [x] I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
• [x] I've completed the PR template to the best of my ability
• [x] I’ve included tests if applicable
• [ ] I’ve documented my code using JSDoc format if applicable
• [ ] I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[socket-security[bot]]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/[email protected]

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

[MajorLift]

@metamaskbot update-policies

[MajorLift]

@SocketSecurity ignore npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected]

Patch updates auto-applied due to caret specifier in version string: ^7.6.19.

[MajorLift]

@SocketSecurity ignore npm/[email protected]

Benign author change

[MajorLift]

@SocketSecurity ignore npm/[email protected]

Library functionality requires network access.

[metamaskbot]

Policy update failed. You can review the logs or retry the policy update here

[metamaskbot]

Policy update failed. You can review the logs or retry the policy update here

[MajorLift]

@metamaskbot update-policies

[metamaskbot]

Policy update failed. You can review the logs or retry the policy update here

[MajorLift]

@metamaskbot update-policies

[metamaskbot]

Policy update failed. You can review the logs or retry the policy update here

[MajorLift]

@metamaskbot update-policies

[metamaskbot]

Policies updated

[Gudahtt]

We'll be targeting this for v12.1.1 instead, so I've temporarily labelled this as DO-NOT-MERGE until that RC is ready to target.

[metamaskbot]

Builds ready [44264fa]

• builds: chrome, firefox
• builds (beta): chrome
• builds (flask): chrome, firefox
• builds (MMI): chrome, firefox
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• build viz: Build System
• mv3: Background Module Init Stats
• mv3: UI Init Stats
• mv3: Module Load Stats
• mv3: Bundle Size Stats
• mv2: E2e Actions Stats
• code coverage: Report
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts
• bundle viz:

  • background: 0, 1, 2, 3, 4, 5, 6
  • common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
  • content-script: 0
  • offscreen: 0
  • ui: 0, 1, 10, 11, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (251 ± 259 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	76	128	103	16	8
		domContentLoaded	11	58	25	13	6
		load	50	2108	251	539	259
		domInteractive	11	58	25	13	6

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 69.84%. Comparing base (0ef30b9) to head (433c309). Report is 1 commits behind head on Version-v12.1.1.

Additional details and impacted files

@@               Coverage Diff                @@
##           Version-v12.1.1   #26626   +/-   ##
================================================
  Coverage            69.84%   69.84%           
================================================
  Files                 1371     1371           
  Lines                48791    48795    +4     
  Branches             13453    13455    +2     
================================================
+ Hits                 34074    34078    +4     
  Misses               14717    14717           

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[MajorLift]

@metamaskbot update-policies

[github-actions[bot]]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[MajorLift]

@SocketSecurity ignore npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected], npm/@storybook/[email protected]

Patch version bump for trusted @storybook-namespaced packages.

[metamaskbot]

Policies updated

[MajorLift]

@SocketSecurity ignore npm/[email protected]

Benign author change

[MajorLift]

@SocketSecurity ignore npm/[email protected]

Library functionality requires network access.

[MajorLift]

@SocketSecurity ignore npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected] npm/@storybook/[email protected]

Patch version bump for trusted @storybook-namespaced packages.

[MajorLift]

@metamaskbot update-policies

[metamaskbot]

Policies updated

[metamaskbot]

Builds ready [cf3695a]

• builds: chrome, firefox
• builds (beta): chrome
• builds (flask): chrome, firefox
• builds (MMI): chrome, firefox
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• build viz: Build System
• mv3: Background Module Init Stats
• mv3: UI Init Stats
• mv3: Module Load Stats
• mv3: Bundle Size Stats
• mv2: E2e Actions Stats
• code coverage: Report
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts
• bundle viz:

  • background: 0, 1, 2, 3, 4, 5, 6
  • common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
  • content-script: 0
  • offscreen: 0
  • ui: 0, 1, 10, 11, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (198 ± 218 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	70	307	131	51	25
		domContentLoaded	10	188	42	38	18
		load	44	2171	198	455	218
		domInteractive	10	188	42	38	18

[metamaskbot]

Builds ready [af5a270]

• builds: chrome, firefox
• builds (beta): chrome
• builds (flask): chrome, firefox
• builds (MMI): chrome, firefox
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• build viz: Build System
• mv3: Background Module Init Stats
• mv3: UI Init Stats
• mv3: Module Load Stats
• mv3: Bundle Size Stats
• mv2: E2e Actions Stats
• code coverage: Report
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts
• bundle viz:

  • background: 0, 1, 2, 3, 4, 5, 6
  • common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
  • content-script: 0
  • offscreen: 0
  • ui: 0, 1, 10, 11, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (607 ± 421 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	92	384	142	62	30
		domContentLoaded	11	95	37	26	12
		load	62	2248	607	876	421
		domInteractive	11	95	37	26	12

[MajorLift]

Removed the DO-NOT-MERGE label as this PR is now targeting the RC branch for v12.1.1.

[metamaskbot]

Builds ready [5c46dea]

• builds: chrome, firefox
• builds (beta): chrome
• builds (flask): chrome, firefox
• builds (MMI): chrome, firefox
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• build viz: Build System
• mv3: Background Module Init Stats
• mv3: UI Init Stats
• mv3: Module Load Stats
• mv3: Bundle Size Stats
• mv2: E2e Actions Stats
• code coverage: Report
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts
• bundle viz:

  • background: 0, 1, 2, 3, 4, 5, 6
  • common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
  • content-script: 0
  • offscreen: 0
  • ui: 0, 1, 10, 11, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (305 ± 282 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	71	300	106	53	25
		domContentLoaded	9	39	22	8	4
		load	48	1809	305	587	282
		domInteractive	9	39	22	8	4

[metamaskbot]

Builds ready [d833023]

• builds: chrome, firefox
• builds (beta): chrome
• builds (flask): chrome, firefox
• builds (MMI): chrome, firefox
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• build viz: Build System
• mv3: Background Module Init Stats
• mv3: UI Init Stats
• mv3: Module Load Stats
• mv3: Bundle Size Stats
• mv2: E2e Actions Stats
• code coverage: Report
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts
• bundle viz:

  • background: 0, 1, 2, 3, 4, 5, 6
  • common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
  • content-script: 0
  • offscreen: 0
  • ui: 0, 1, 10, 11, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (145 ± 167 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	72	191	101	26	12
		domContentLoaded	11	56	25	13	6
		load	47	1664	145	349	167
		domInteractive	11	56	25	13	6