Repository navigation
fix(deps): update dependency bn.js to ^5.2.5 - #10362
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
cryptodev-2s
approved these changes
Sep 22, 2026
pull Bot
pushed a commit
to Reality2byte/core
that referenced
this pull request
Sep 23, 2026
## Explanation Release `1275.0.0` with a **major** version bump for `@metamask/transaction-controller` and a **minor** version bump for `@metamask/transaction-pay-controller`. - **`@metamask/transaction-controller`** `70.1.0` → `71.0.0` (major) - **`@metamask/transaction-pay-controller`** `29.0.2` → `29.1.0` (minor) ### `@metamask/transaction-controller@71.0.0` **Breaking:** Move sponsorship and signing decisions to optional approval-time `isSponsored` and `shouldSign` hooks ([MetaMask#10109](MetaMask#10109)) - The hooks default to non-sponsored and local signing when omitted. Sponsored transactions skip the `shouldSign` hook and local signing, while transactions that skip local signing retain an existing nonce and require a publish hook. - `isGasFeeSponsored` and `isExternalSign` remain in the public types as deprecated compatibility properties but no longer control the transaction lifecycle; `isGasFeeSponsored` remains available as migration metadata. - Add `TransactionMeta.isGasFeeSponsoredAvailable` and refresh it during approval preparation when simulation is enabled so sponsorship hooks receive current availability without overriding simulation preferences. Other changes: - Add `membershipSubscription` transaction type ([MetaMask#10340](MetaMask#10340)) - Bump `bn.js` from `^5.2.1` to `^5.2.5` ([MetaMask#10362](MetaMask#10362)) ### `@metamask/transaction-pay-controller@29.1.0` - Support subsidized max Relay deposits using atomic `EXACT_OUTPUT` quotes with transaction calls embedded, gated by `payStrategies.relay.atomicMaxEnabled` ([MetaMask#10224](MetaMask#10224)) - Bump `bn.js` from `^5.2.1` to `^5.2.5` ([MetaMask#10362](MetaMask#10362)) - Bump `immer` from `^9.0.6` to `^9.0.21` ([MetaMask#10331](MetaMask#10331)) ### Dependency updates 16 packages had their `@metamask/transaction-controller` dependency range updated to `^71.0.0` with `package.json` changes under this release branch. Changelog entries for those packages will be generated by commenting `@metamaskbot update-changelogs` on this PR. ## References - [MetaMask#10109](MetaMask#10109) — Move sponsorship and signing decisions to optional approval-time hooks - [MetaMask#10340](MetaMask#10340) — Add `membershipSubscription` transaction type - [MetaMask#10224](MetaMask#10224) — Support subsidized max Relay deposits using atomic `EXACT_OUTPUT` quotes ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > The major transaction-controller release changes core transaction approval, sponsorship, and signing behavior across many downstream packages that depend on it. > > **Overview** > Release **`1275.0.0`** cuts published versions for **`@metamask/transaction-controller`** `71.0.0` (major) and **`@metamask/transaction-pay-controller`** `29.1.0` (minor), and bumps the monorepo root version accordingly. > > The transaction-controller release documents **breaking** approval-time behavior: sponsorship and signing now flow through optional **`isSponsored`** / **`shouldSign`** hooks instead of **`isGasFeeSponsored`** / **`isExternalSign`**, plus a new **`membershipSubscription`** transaction type. This PR mostly **propagates** that major by setting dependent packages’ `@metamask/transaction-controller` ranges to **`^71.0.0`**, updating **`yarn.lock`**, and recording bump entries in package changelogs (including transaction-pay’s dependency bump under `29.1.0`). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b93ad54. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^5.2.1→^5.2.5^5.1.5→^5.2.0Release Notes
indutny/bn.js (bn.js)
v5.2.5Compare Source
v5.2.4Compare Source
v5.2.3Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate CLI.
Note
Medium Risk
bn.jsbacks gas and amount math in transaction-related controllers; patch fixes can change numeric edge-case behavior even without API changes.Overview
Bumps
bn.jsfrom^5.2.1to^5.2.5and@types/bn.jsfrom^5.1.5to^5.2.0across six workspace packages (assets-controllers,controller-utils,gas-fee-controller,transaction-controller,transaction-pay-controller,user-operation-controller), with matching Unreleased changelog entries andyarn.lockresolution updates (runtimebn.js5.2.5, types 5.2.0).There are no application source changes—only dependency manifests, changelogs, and the lockfile. The newer
bn.jsreleases are patch-level fixes (e.g.divRoundwith negative operands,imulnsign when multiplying by zero, bitwise helpers).Reviewed by Cursor Bugbot for commit 463dbd0. Bugbot is set up for automated code reviews on this repo. Configure here.