Merge branch 'main' into feat/atomic-batch-transactions

Author: matthewwalsh0

.circleci/config.yml

@@ -159,6 +159,10 @@ workflows:
           requires:
             - prep-build-test
             - get-changed-files-with-git-diff
+      - test-api-specs-multichain:
+          requires:
+            - prep-build-test-flask
+            - get-changed-files-with-git-diff
       - test-e2e-chrome-multiple-providers:
           requires:
             - prep-build-test
@@ -703,6 +707,37 @@ jobs:
       - store_test_results:
           path: test/test-results/e2e
 
+  test-api-specs-multichain:
+    executor: node-browsers-medium-plus
+    steps:
+      - run: *shallow-git-clone-and-enable-vnc
+      - run: sudo corepack enable
+      - attach_workspace:
+          at: .
+      - run:
+          name: Move test build to dist
+          command: mv ./dist-test-flask ./dist
+      - run:
+          name: Move test zips to builds
+          command: mv ./builds-test-flask ./builds
+      - gh/install
+      - run:
+          name: test:api-specs-multichain
+          command: .circleci/scripts/test-run-e2e.sh yarn test:api-specs-multichain
+          no_output_timeout: 5m
+      - run:
+          name: Comment on PR
+          command: |
+            if [  -f html-report-multichain/index.html ]; then
+              gh pr comment "${CIRCLE_PR_NUMBER}" --body ":x: Multichain API Spec Test Failed. View the report [here](https://output.circle-artifacts.com/output/job/${CIRCLE_WORKFLOW_JOB_ID}/artifacts/${CIRCLE_NODE_INDEX}/html-report-multichain/index.html)."
+            else
+              echo "Multichain API Spec Report not found!"
+            fi
+          when: on_fail
+      - store_artifacts:
+          path: html-report-multichain
+          destination: html-report-multichain
+
   test-api-specs:
     executor: node-browsers-medium-plus
     steps:

.depcheckrc.yml

@@ -23,6 +23,7 @@ ignores:
   - '@metamask/forwarder'
   - '@metamask/phishing-warning' # statically hosted as part of some e2e tests
   - '@metamask/test-dapp'
+  - '@metamask/test-dapp-multichain'
   - '@metamask/design-tokens' # Only imported in index.css
   - '@tsconfig/node22' # required dynamically by TS, used in tsconfig.json
   - '@sentry/cli' # invoked as `sentry-cli`

.github/workflows/get-release-timelines.yml

@@ -0,0 +1,18 @@
+name: Get release timelines
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+        type: string
+        description: 'The version of the release'
+
+jobs:
+  get-release-timelines:
+    uses: metamask/github-tools/.github/workflows/get-release-timelines.yml@3e0b0204e41b576263b9060945de3b3b9b8c5448
+    with:
+      version: ${{ github.event.inputs.version }}
+    secrets:
+      RUNWAY_APP_ID: ''
+      RUNWAY_API_KEY: ''

.gitignore

@@ -80,10 +80,13 @@ lavamoat/**/policy-debug.json
 # Attributions
 licenseInfos.json
 
+# Branding
+/app/images/branding
+
 # API Spec tests
 html-report/
+html-report-multichain/
 
-/app/images/branding
 /changed-files
 
 # UI Integration tests

.yarnrc.yml

@@ -49,6 +49,11 @@ npmAuditIgnoreAdvisories:
   # was mistakenly originally created to flag all versions as vulnerable
   - 1101059
 
+  # Issue: axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
+  # URL: https://github.com/advisories/GHSA-jr5f-v2jv-69x6
+  # We are ignoring this on March 11, 2025 to unblock CI, we will follow with a proper fix or confirmation this does not affect our users
+  - 1102472
+
   # Temp fix for https://github.com/MetaMask/metamask-extension/pull/16920 for the sake of 11.7.1 hotfix
   # This will be removed in this ticket https://github.com/MetaMask/metamask-extension/issues/22299
   - 'ts-custom-error (deprecation)'

app/_locales/en/messages.json

@@ -11,6 +11,10 @@
     },
     "default_title": "MetaMask Flask"
   },
+  "externally_connectable": {
+    "matches": ["http://*/*", "https://*/*"],
+    "ids": ["*"]
+  },
   "icons": {
     "16": "images/icon-16.png",
     "19": "images/icon-19.png",

app/_locales/en_GB/messages.json

@@ -406,9 +406,10 @@ browser.runtime.onConnectExternal.addListener(async (...args) => {
   // Queue up connection attempts here, waiting until after initialization
   await isInitialized;
   // This is set in `setupController`, which is called as part of initialization
-  const port = args[0];
 
-  if (port.sender.tab?.id && process.env.BARAD_DUR) {
+  const port = args[0];
+  const isDappConnecting = port.sender.tab?.id;
+  if (isDappConnecting && process.env.MULTICHAIN_API) {
     connectExternalCaip(...args);
   } else {
     connectExternalExtension(...args);
@@ -1036,6 +1037,10 @@ export function setupController(
   };
 
   connectExternalCaip = async (remotePort) => {
+    if (!process.env.MULTICHAIN_API) {
+      return;
+    }
+
     if (metamaskBlockedPorts.includes(remotePort.name)) {
       return;
     }