Merge branch 'main' into feat/plan-836-ledger-hid-prompt-up-issue

Author: dawnseeker8

.circleci/config.yml

@@ -159,6 +159,10 @@ workflows:
           requires:
             - prep-build-test
             - get-changed-files-with-git-diff
+      - test-api-specs-multichain:
+          requires:
+            - prep-build-test-flask
+            - get-changed-files-with-git-diff
       - test-e2e-chrome-multiple-providers:
           requires:
             - prep-build-test
@@ -703,6 +707,37 @@ jobs:
       - store_test_results:
           path: test/test-results/e2e
 
+  test-api-specs-multichain:
+    executor: node-browsers-medium-plus
+    steps:
+      - run: *shallow-git-clone-and-enable-vnc
+      - run: sudo corepack enable
+      - attach_workspace:
+          at: .
+      - run:
+          name: Move test build to dist
+          command: mv ./dist-test-flask ./dist
+      - run:
+          name: Move test zips to builds
+          command: mv ./builds-test-flask ./builds
+      - gh/install
+      - run:
+          name: test:api-specs-multichain
+          command: .circleci/scripts/test-run-e2e.sh yarn test:api-specs-multichain
+          no_output_timeout: 5m
+      - run:
+          name: Comment on PR
+          command: |
+            if [  -f html-report-multichain/index.html ]; then
+              gh pr comment "${CIRCLE_PR_NUMBER}" --body ":x: Multichain API Spec Test Failed. View the report [here](https://output.circle-artifacts.com/output/job/${CIRCLE_WORKFLOW_JOB_ID}/artifacts/${CIRCLE_NODE_INDEX}/html-report-multichain/index.html)."
+            else
+              echo "Multichain API Spec Report not found!"
+            fi
+          when: on_fail
+      - store_artifacts:
+          path: html-report-multichain
+          destination: html-report-multichain
+
   test-api-specs:
     executor: node-browsers-medium-plus
     steps:

.depcheckrc.yml

@@ -23,6 +23,7 @@ ignores:
   - '@metamask/forwarder'
   - '@metamask/phishing-warning' # statically hosted as part of some e2e tests
   - '@metamask/test-dapp'
+  - '@metamask/test-dapp-multichain'
   - '@metamask/design-tokens' # Only imported in index.css
   - '@tsconfig/node22' # required dynamically by TS, used in tsconfig.json
   - '@sentry/cli' # invoked as `sentry-cli`

.github/workflows/get-release-timelines.yml

@@ -0,0 +1,18 @@
+name: Get release timelines
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+        type: string
+        description: 'The version of the release'
+
+jobs:
+  get-release-timelines:
+    uses: metamask/github-tools/.github/workflows/get-release-timelines.yml@3e0b0204e41b576263b9060945de3b3b9b8c5448
+    with:
+      version: ${{ github.event.inputs.version }}
+    secrets:
+      RUNWAY_APP_ID: ''
+      RUNWAY_API_KEY: ''

.gitignore

@@ -80,10 +80,13 @@ lavamoat/**/policy-debug.json
 # Attributions
 licenseInfos.json
 
+# Branding
+/app/images/branding
+
 # API Spec tests
 html-report/
+html-report-multichain/
 
-/app/images/branding
 /changed-files
 
 # UI Integration tests

.yarn/patches/@ethereumjs-tx-npm-5.4.0-0c4a0f973e.patch

@@ -0,0 +1,130 @@
+diff --git a/dist/cjs/util.js b/dist/cjs/util.js
+index d60cf924ee8144ee49dd07e8e910d87a2c4bfb6a..ea5494530c05f4c831e301b88fef7855c89f2885 100644
+--- a/dist/cjs/util.js
++++ b/dist/cjs/util.js
+@@ -119,14 +119,11 @@ class AuthorizationLists {
+                 }
+                 const chainId = (0, util_1.hexToBytes)(item.chainId);
+                 const addressBytes = (0, util_1.hexToBytes)(item.address);
+-                const nonceList = [];
+-                for (let j = 0; j < item.nonce.length; j++) {
+-                    nonceList.push((0, util_1.hexToBytes)(item.nonce[j]));
+-                }
++                const nonce = (0, util_1.hexToBytes)(item.nonce);
+                 const yParity = (0, util_1.hexToBytes)(item.yParity);
+                 const r = (0, util_1.hexToBytes)(item.r);
+                 const s = (0, util_1.hexToBytes)(item.s);
+-                newAuthorizationList.push([chainId, addressBytes, nonceList, yParity, r, s]);
++                newAuthorizationList.push([chainId, addressBytes, nonce, yParity, r, s]);
+             }
+             bufferAuthorizationList = newAuthorizationList;
+         }
+@@ -138,18 +135,14 @@ class AuthorizationLists {
+                 const data = bufferAuthorizationList[i];
+                 const chainId = (0, util_1.bytesToHex)(data[0]);
+                 const address = (0, util_1.bytesToHex)(data[1]);
+-                const nonces = data[2];
+-                const nonceList = [];
+-                for (let j = 0; j < nonces.length; j++) {
+-                    nonceList.push((0, util_1.bytesToHex)(nonces[j]));
+-                }
++                const nonce = (0, util_1.bytesToHex)(data[2]);
+                 const yParity = (0, util_1.bytesToHex)(data[3]);
+                 const r = (0, util_1.bytesToHex)(data[4]);
+                 const s = (0, util_1.bytesToHex)(data[5]);
+                 const jsonItem = {
+                     chainId,
+                     address,
+-                    nonce: nonceList,
++                    nonce,
+                     yParity,
+                     r,
+                     s,
+@@ -167,20 +160,14 @@ class AuthorizationLists {
+         for (let key = 0; key < authorizationList.length; key++) {
+             const authorizationListItem = authorizationList[key];
+             const address = authorizationListItem[1];
+-            const nonceList = authorizationListItem[2];
++            const nonce = authorizationListItem[2];
+             const yParity = authorizationListItem[3];
+             const r = authorizationListItem[4];
+             const s = authorizationListItem[5];
+-            (0, util_1.validateNoLeadingZeroes)({ yParity, r, s });
++            (0, util_1.validateNoLeadingZeroes)({ yParity, r, s, nonce });
+             if (address.length !== 20) {
+                 throw new Error('Invalid EIP-7702 transaction: address length should be 20 bytes');
+             }
+-            if (nonceList.length > 1) {
+-                throw new Error('Invalid EIP-7702 transaction: nonce list should consist of at most 1 item');
+-            }
+-            else if (nonceList.length === 1) {
+-                (0, util_1.validateNoLeadingZeroes)({ nonce: nonceList[0] });
+-            }
+         }
+     }
+     static getDataFeeEIP7702(authorityList, common) {
+diff --git a/dist/esm/util.js b/dist/esm/util.js
+index 36fa7e9917f72b042efc753ba5d1c9cd0d5572db..de454fa2f09a98b2a8716e173d1cd1f87101a490 100644
+--- a/dist/esm/util.js
++++ b/dist/esm/util.js
+@@ -114,14 +114,11 @@ export class AuthorizationLists {
+                 }
+                 const chainId = hexToBytes(item.chainId);
+                 const addressBytes = hexToBytes(item.address);
+-                const nonceList = [];
+-                for (let j = 0; j < item.nonce.length; j++) {
+-                    nonceList.push(hexToBytes(item.nonce[j]));
+-                }
++                const nonce = hexToBytes(item.nonce);
+                 const yParity = hexToBytes(item.yParity);
+                 const r = hexToBytes(item.r);
+                 const s = hexToBytes(item.s);
+-                newAuthorizationList.push([chainId, addressBytes, nonceList, yParity, r, s]);
++                newAuthorizationList.push([chainId, addressBytes, nonce, yParity, r, s]);
+             }
+             bufferAuthorizationList = newAuthorizationList;
+         }
+@@ -133,18 +130,14 @@ export class AuthorizationLists {
+                 const data = bufferAuthorizationList[i];
+                 const chainId = bytesToHex(data[0]);
+                 const address = bytesToHex(data[1]);
+-                const nonces = data[2];
+-                const nonceList = [];
+-                for (let j = 0; j < nonces.length; j++) {
+-                    nonceList.push(bytesToHex(nonces[j]));
+-                }
++                const nonce = bytesToHex(data[2]);
+                 const yParity = bytesToHex(data[3]);
+                 const r = bytesToHex(data[4]);
+                 const s = bytesToHex(data[5]);
+                 const jsonItem = {
+                     chainId,
+                     address,
+-                    nonce: nonceList,
++                    nonce,
+                     yParity,
+                     r,
+                     s,
+@@ -162,20 +155,14 @@ export class AuthorizationLists {
+         for (let key = 0; key < authorizationList.length; key++) {
+             const authorizationListItem = authorizationList[key];
+             const address = authorizationListItem[1];
+-            const nonceList = authorizationListItem[2];
++            const nonce = authorizationListItem[2];
+             const yParity = authorizationListItem[3];
+             const r = authorizationListItem[4];
+             const s = authorizationListItem[5];
+-            validateNoLeadingZeroes({ yParity, r, s });
++            validateNoLeadingZeroes({ yParity, r, s, nonce });
+             if (address.length !== 20) {
+                 throw new Error('Invalid EIP-7702 transaction: address length should be 20 bytes');
+             }
+-            if (nonceList.length > 1) {
+-                throw new Error('Invalid EIP-7702 transaction: nonce list should consist of at most 1 item');
+-            }
+-            else if (nonceList.length === 1) {
+-                validateNoLeadingZeroes({ nonce: nonceList[0] });
+-            }
+         }
+     }
+     static getDataFeeEIP7702(authorityList, common) {

.yarn/patches/@metamask-transaction-controller-npm-45.0.0-010fef9da6.patch

@@ -49,6 +49,11 @@ npmAuditIgnoreAdvisories:
   # was mistakenly originally created to flag all versions as vulnerable
   - 1101059
 
+  # Issue: axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
+  # URL: https://github.com/advisories/GHSA-jr5f-v2jv-69x6
+  # We are ignoring this on March 11, 2025 to unblock CI, we will follow with a proper fix or confirmation this does not affect our users
+  - 1102472
+
   # Temp fix for https://github.com/MetaMask/metamask-extension/pull/16920 for the sake of 11.7.1 hotfix
   # This will be removed in this ticket https://github.com/MetaMask/metamask-extension/issues/22299
   - 'ts-custom-error (deprecation)'

.yarnrc.yml

@@ -11,6 +11,10 @@
     },
     "default_title": "MetaMask Flask"
   },
+  "externally_connectable": {
+    "matches": ["http://*/*", "https://*/*"],
+    "ids": ["*"]
+  },
   "icons": {
     "16": "images/icon-16.png",
     "19": "images/icon-19.png",