Skip to content

chore(deps): bump immer to v11 - #10382

Merged
cryptodev-2s merged 26 commits into
mainfrom
renovate/immer-11.x
Sep 25, 2026
Merged

cryptodev-2s merged 26 commits into
mainfrom
renovate/immer-11.x

Conversation

@metamask-ci

@metamask-ci metamask-ci Bot commented Sep 22, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
immer ^9.0.21 → ^11.1.18 age confidence

Release Notes

immerjs/immer (immer)

v11.1.18

Compare Source

Bug Fixes

v11.1.17

Compare Source

Bug Fixes
  • preserve structural sharing for no-op array-methods calls (0c3efdd)

v11.1.16

Compare Source

Bug Fixes
  • key inserted array indices by name in the array-methods plugin (e3df956)

v11.1.15

Compare Source

Bug Fixes

v11.1.14

Compare Source

Bug Fixes
  • throw proper immer error when applyPatches path traverses null (#​1251) (e38ad71)

v11.1.13

Compare Source

Bug Fixes
  • draft relocated base refs after reverse/sort in array-methods plugin (#​1255) (a73672a)

v11.1.12

Compare Source

Bug Fixes

v11.1.11

Compare Source

Bug Fixes

v11.1.10

Compare Source

Bug Fixes
  • undefined assigned to a prototype-inherited key gets dropped (#​1262) (16e225b)

v11.1.9

Compare Source

Bug Fixes
  • prevent prototype pollution via constructor.prototype access (CVE-2026-XXXX) (#​1259) (48fc378)

v11.1.8

Compare Source

Bug Fixes
  • update current and original typings to assert draft value is unwrapped (#​1236) (bf2d154)

v11.1.7

Compare Source

Bug Fixes
  • improve higher order type inference for WritableDraft (#​1205) (7390d6c)

v11.1.6

Compare Source

Bug Fixes

v11.1.5

Compare Source

Bug Fixes
  • handle nested proxies after spreading and inserting into an array (d3bc436)

v11.1.4

Compare Source

Bug Fixes
  • handle nested proxies after spreading and inserting into an array (90a7765)

v11.1.3

Compare Source

Bug Fixes

v11.1.2

Compare Source

Bug Fixes
  • bogus commit to retest release (c329ddb)

v11.1.0

Compare Source

This feature release adds a new optional "array method overrides" plugin that significantly speeds up array methods when accessing drafts.

Changelog
Performance Improvements

As part of the recent performance optimization work, our benchmarks showed that all Proxy-based immutable update libraries were drastically slower than vanilla JS when calling both mutating and non-mutating array methods. After investigation, it turns out that an array method like arr.filter() causes the Proxy's get trap to trigger for every single item in the array. This in turn forces creation of a new Proxy and internal Immer metadata for every item, even though this was just a read operation and no items were being updated.

This release adds a new enableArrayMethods plugin that will override draft array methods to bypass the draft and directly operate on the underlying wrapped array instance. This significantly speeds up array operations.

When enabled, the plugin overrides these array methods:

  • Mutating: push, pop, shift, unshift, splice, reverse, sort
  • Non-mutating: filter, slice, concat, flat, find, findIndex, findLast, findLastIndex, some, every, indexOf, lastIndexOf, includes, join, toString, toLocaleString

Our benchmarks show that the overridden methods (plus the other perf changes in Immer 10.2 and 11.0) are 50-80% faster than the baseline behavior of Immer 10.1.

The plugin adds about 1.5-2K minified to Immer's bundle size.

It's important to note that the plugin does change the "safe to mutate a draft" semantics of Immer. Any of these methods that receives an array item as a callback argument will not automatically wrap that item in a Proxy!. That means that if you try to mutate an argument in a method such as filter, it will actually mutate the real underlying object, which will cause bugs in your app. This is an intentional design tradeoff. Semantically, all of these methods imply read-only access to array values, so if your code tries to mutate an array item in a callback, that is a bug in your code.

Note that this does not override map, flatMap, forEach, or reduce / reduceRight. Those methods do imply either side effects and potential mutations, or returning arbitrary values. Given that, we determined it was both safest and simplest to keep their behavior as-is.

See the Array Methods Plugin docs page for further details on the behavior of the overridden methods.

What's Changed

v11.0.1

Compare Source

Bug Fixes

v11.0.0

Compare Source

Performance Improvements
  • Rewrite finalization system to use a callback approach instead of tree traversal (#​1183) (d6c1202)
BREAKING CHANGES
  • enable loose iteration by default

  • Simplify some iteration checks

  • Allow passing type to get/set utils to skip archetype lookup

  • Convert assigned_ to Map

  • Enable loose iteration

  • Replace recursive tree finalization with targeted callbacks

Ported Mutative's "finalization callback" approach as a more targeted and performant implementation for finalization compared to the existing recursive tree traversal approach:

  • Added cleanup callbacks for each draft that's created
  • Added callbacks to handle root drafts, assigned values, and recursing
    inside of plain values
  • Updated state creation to return [draft, state] to avoid a lookup
  • Rewrote patch generation system to work with callbacks instead of
    during tree traversal
  • Update self-reference test with new behavior
  • Apply code review suggestions
  • Byte-shave scopes and patch plugin usage
  • Inline finalizeAssigned
  • Move fixPotentialSetContents to plugin
  • Byte-shave typeof utils
  • Byte-shave Object references
  • Byte-shave field names and arrow functions

v10.2.0

Compare Source

Features
  • Optimize Immer performance where possible, introduce setUseStrictIteration (#​1164) (e1996ce)

v10.1.3

Compare Source

Bug Fixes

v10.1.2

Compare Source

Bug Fixes

v10.1.1

Compare Source

Bug Fixes

v10.1.0

Compare Source

Features
  • performance: Make non-strict mode faster for classes. Addresses #​1071 (53e3203). Immer 10.x solved slow iteration for plain JS objects. This update applies the same handling to class instances. In cases this makes class instance handling 3 times faster. Note that this slightly modifies the behavior of Immer with classes in obscure corner cases, in ways that match current documentation, but do not match previous behavior. If you run into issues with this release icmw. class instances, use setUseStrictShallowCopy("class_only") to revert to the old behavior. For more details see https://immerjs.github.io/immer/complex-objects#semantics-in-detail

v10.0.4

Compare Source

Bug Fixes

v10.0.3

Compare Source

Bug Fixes

v10.0.2

Compare Source

Bug Fixes

v10.0.1

Compare Source

Bug Fixes

v10.0.0

Compare Source

Release notes
  • [breaking change] Immer 10 only supports modern browsers, that have support for Proxy, Reflect, Symbol and Map and Set.
  • [breaking change] There is no longer a UMD build exposed (thanks Mark Erikson for modernizing the build setup in #​1032!
  • [breaking change] getters and setters are ignored by default on plain object, as this is a very uncommon case and provides a significant performance boost (ca 33%, but depends a lot on the scenario). Fixes #​867, #​1012. Thanks hrsh7th for implementing it in #​941!
  • [breaking change] Promise based reducers are no longer supported. Conceptually it is an anti pattern to hold on to drafts over time. If needed the old behavior can still be achieved by leveraging createDraft and finishDraft.
  • [breaking change] ES5 mode (for legacy browsers) has been dropped. If your project relies on enableES5(), you SHOULD NOT upgrade Immer. enableES5 has been removed.
  • [breaking change] produce is no longer exposed as the default export. This improves eco system compatibility, and makes sure that there is only one correct way of doing things
  • [breaking change] enableAllPlugins has been removed, use enablePatches(); enableMapSet() instead
  • [breaking change] shortening the length of a JSON array now results in delete patches, rather than a mutation of the length property, in accordance with JSON spec. Thanks kshramt for implementing this in #​964!
  • Immer is now an ESM package that can be directly imported into the browser. CJS should still work, UMD support has been removed.

Overall, there is a rough performance increase of 33% for Immer (and in some cases significantly higher), and the (non gzipped) bundle size has reduced from 16 to 11.5 KB, while the the minimal gzipped import of just produce has remained roughly the same at 3.3 KB.

For more details, see #​1015

Migration steps
  1. If you have any enableES5() call, don't migrate
  2. When using getters/ setters icmw plain objects, call useStrictShallowCopy(true) at startup
  3. Replace all default imports: Replace import produce from "immer" with import {produce} from "immer"
  4. Replace all calls to enableAllPlugins() with enablePatches(); enableMapSet(); to be more specific and smoothen future migrations.
  5. If any producer returned a Promise, refactor it to leverage createDraft instead. Roughly:
const newState = await produce(oldState, recipe)

// becomes
const draft  = createDraft(oldState)
await recipe(draft)
const newState = finishDraft(draft)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.


Note

Medium Risk
Immer v11 is a major bump used by nearly all controller state updates; regressions could affect wallet state, permissions, and transactions even though the diff is mostly dependency and type cleanup.

Overview
This PR upgrades immer from ^9.0.21 to ^11.1.18 across the monorepo (accounts, base-controller, keyring, network, permission, transaction, wallet-cli, and related packages), with matching CHANGELOG entries and yarn.lock resolution.

Follow-up code changes align with Immer 11’s typing and export surface: public WritableDraft imports from 'immer' (replacing 'immer/dist/internal.js'), fewer manual casts in AccountsController, simplified draft typing in AbstractMessageManager and transaction-controller batch helpers, and removal of @ts-expect-error workarounds for “excessively deep” types in PermissionController and SubjectMetadataController. One oxlint suppression for typescript/no-unsafe-argument on PermissionController is dropped as a result.

There is no new application logic beyond what the dependency bump implies (Immer 11 includes performance and iteration/finalization behavior changes documented upstream).

Reviewed by Cursor Bugbot for commit 47540b2. Bugbot is set up for automated code reviews on this repo. Configure here.

@metamask-ci
metamask-ci Bot requested review from a team as code owners September 22, 2026 21:10
@metamask-ci
metamask-ci Bot deployed to dependabot September 22, 2026 21:10 Active
@metamask-ci
metamask-ci Bot deployed to default-branch September 22, 2026 21:10 Active
@socket-security

socket-security Bot commented Sep 22, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedimmer@​11.1.18991008392100

View full report

@metamask-ci

metamask-ci Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@cryptodev-2s cryptodev-2s changed the title fix(deps): update dependency immer to v11 chore(deps): bump immer to v11 Sep 23, 2026
immer v10 closed its package exports map, so the `immer/dist/internal.js`
deep import no longer resolves. `WritableDraft` is exported from the main
entry now, so import it from there.

Also drops casts and ts-expect-error directives that v11's typings made
redundant.
`src/utils/batch.ts` imports immer and the import survives into the
published `dist/utils/batch.d.ts`, which consumers reach through the
`generateBatchId` re-export. It needs to be a real dependency, not a
devDependency.
@cryptodev-2s
cryptodev-2s marked this pull request as draft September 23, 2026 15:34
@cryptodev-2s cryptodev-2s self-assigned this Sep 23, 2026
@cryptodev-2s

Copy link
Copy Markdown
Contributor

@metamaskbot publish-preview

@cryptodev-2s

Copy link
Copy Markdown
Contributor

@metamaskbot publish-preview

@github-actions

Copy link
Copy Markdown
Contributor

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@10.0.1-preview-7304fd253
@metamask-previews/accounts-controller@40.0.0-preview-7304fd253
@metamask-previews/address-book-controller@8.0.0-preview-7304fd253
@metamask-previews/ai-controllers@2.0.0-preview-7304fd253
@metamask-previews/analytics-controller@3.1.0-preview-7304fd253
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-7304fd253
@metamask-previews/announcement-controller@9.0.0-preview-7304fd253
@metamask-previews/app-metadata-controller@3.0.0-preview-7304fd253
@metamask-previews/approval-controller@10.0.0-preview-7304fd253
@metamask-previews/assets-controller@16.1.0-preview-7304fd253
@metamask-previews/assets-controllers@112.0.2-preview-7304fd253
@metamask-previews/authenticated-user-storage@4.1.0-preview-7304fd253
@metamask-previews/base-controller@10.0.0-preview-7304fd253
@metamask-previews/base-data-service@2.0.0-preview-7304fd253
@metamask-previews/bitcoin-regtest-up@2.0.0-preview-7304fd253
@metamask-previews/bridge-controller@81.3.0-preview-7304fd253
@metamask-previews/bridge-status-controller@76.3.0-preview-7304fd253
@metamask-previews/build-utils@4.0.0-preview-7304fd253
@metamask-previews/chain-agnostic-permission@2.0.0-preview-7304fd253
@metamask-previews/chomp-api-service@5.0.0-preview-7304fd253
@metamask-previews/claims-controller@1.0.1-preview-7304fd253
@metamask-previews/client-controller@2.0.0-preview-7304fd253
@metamask-previews/client-utils@3.0.2-preview-7304fd253
@metamask-previews/compliance-controller@3.0.0-preview-7304fd253
@metamask-previews/composable-controller@13.0.0-preview-7304fd253
@metamask-previews/config-registry-controller@4.0.0-preview-7304fd253
@metamask-previews/connectivity-controller@1.0.0-preview-7304fd253
@metamask-previews/controller-utils@13.0.0-preview-7304fd253
@metamask-previews/core-backend@11.0.0-preview-7304fd253
@metamask-previews/cryptography@0.0.0-preview-7304fd253
@metamask-previews/delegation-controller@4.0.0-preview-7304fd253
@metamask-previews/earn-controller@13.0.0-preview-7304fd253
@metamask-previews/eip-5792-middleware@4.0.0-preview-7304fd253
@metamask-previews/eip-7702-internal-rpc-middleware@1.0.0-preview-7304fd253
@metamask-previews/eip1193-permission-middleware@3.0.0-preview-7304fd253
@metamask-previews/eth-block-tracker@16.0.0-preview-7304fd253
@metamask-previews/eth-json-rpc-middleware@25.0.0-preview-7304fd253
@metamask-previews/eth-json-rpc-provider@7.0.0-preview-7304fd253
@metamask-previews/foundryup@2.0.0-preview-7304fd253
@metamask-previews/gas-fee-controller@27.0.0-preview-7304fd253
@metamask-previews/gator-permissions-controller@6.0.0-preview-7304fd253
@metamask-previews/geolocation-controller@2.0.0-preview-7304fd253
@metamask-previews/java-tron-up@2.0.0-preview-7304fd253
@metamask-previews/json-rpc-engine@11.0.0-preview-7304fd253
@metamask-previews/json-rpc-middleware-stream@9.0.0-preview-7304fd253
@metamask-previews/keyring-controller@28.0.0-preview-7304fd253
@metamask-previews/kyc-controller@0.4.0-preview-7304fd253
@metamask-previews/local-node-utils@2.0.0-preview-7304fd253
@metamask-previews/logging-controller@10.0.0-preview-7304fd253
@metamask-previews/message-manager@15.0.0-preview-7304fd253
@metamask-previews/messenger@3.0.0-preview-7304fd253
@metamask-previews/messenger-cli@1.0.0-preview-7304fd253
@metamask-previews/money-account-api-data-service@1.0.0-preview-7304fd253
@metamask-previews/money-account-balance-service@3.0.0-preview-7304fd253
@metamask-previews/money-account-controller@2.0.0-preview-7304fd253
@metamask-previews/money-account-upgrade-controller@5.0.0-preview-7304fd253
@metamask-previews/money-account-utils@2.0.0-preview-7304fd253
@metamask-previews/multichain-account-service@14.0.0-preview-7304fd253
@metamask-previews/multichain-api-middleware@5.0.0-preview-7304fd253
@metamask-previews/multichain-network-controller@4.0.0-preview-7304fd253
@metamask-previews/multichain-transactions-controller@8.0.0-preview-7304fd253
@metamask-previews/name-controller@10.0.0-preview-7304fd253
@metamask-previews/network-connection-banner-controller@1.0.0-preview-7304fd253
@metamask-previews/network-controller@37.0.0-preview-7304fd253
@metamask-previews/network-enablement-controller@7.0.0-preview-7304fd253
@metamask-previews/notification-services-controller@29.0.0-preview-7304fd253
@metamask-previews/passkey-controller@4.1.0-preview-7304fd253
@metamask-previews/permission-controller@14.0.0-preview-7304fd253
@metamask-previews/permission-log-controller@6.0.0-preview-7304fd253
@metamask-previews/perps-controller@17.4.0-preview-7304fd253
@metamask-previews/phishing-controller@18.1.0-preview-7304fd253
@metamask-previews/platform-api-docs@0.2.1-preview-7304fd253
@metamask-previews/polling-controller@17.0.0-preview-7304fd253
@metamask-previews/preferences-controller@24.0.0-preview-7304fd253
@metamask-previews/profile-metrics-controller@5.1.0-preview-7304fd253
@metamask-previews/profile-sync-controller@32.2.0-preview-7304fd253
@metamask-previews/ramps-controller@25.1.0-preview-7304fd253
@metamask-previews/rate-limit-controller@8.0.0-preview-7304fd253
@metamask-previews/react-data-query@2.0.0-preview-7304fd253
@metamask-previews/remote-feature-flag-controller@7.0.0-preview-7304fd253
@metamask-previews/sample-controllers@6.0.0-preview-7304fd253
@metamask-previews/seedless-onboarding-controller@11.0.0-preview-7304fd253
@metamask-previews/selected-network-controller@27.0.0-preview-7304fd253
@metamask-previews/sentinel-api-service@2.0.0-preview-7304fd253
@metamask-previews/shield-controller@7.0.1-preview-7304fd253
@metamask-previews/signature-controller@40.0.0-preview-7304fd253
@metamask-previews/smart-transactions-controller@27.0.1-preview-7304fd253
@metamask-previews/snap-account-service@3.0.0-preview-7304fd253
@metamask-previews/social-controllers@3.1.0-preview-7304fd253
@metamask-previews/solana-test-validator-up@2.0.0-preview-7304fd253
@metamask-previews/stellar-quickstart-up@0.0.0-preview-7304fd253
@metamask-previews/storage-service@2.0.0-preview-7304fd253
@metamask-previews/subscription-controller@9.1.0-preview-7304fd253
@metamask-previews/transaction-controller@71.0.0-preview-7304fd253
@metamask-previews/transaction-pay-controller@29.1.1-preview-7304fd253
@metamask-previews/user-operation-controller@42.0.0-preview-7304fd253
@metamask-previews/utils@12.0.0-preview-7304fd253
@metamask-previews/wallet@14.0.1-preview-7304fd253
@metamask-previews/wallet-cli@0.0.0-preview-7304fd253

@cryptodev-2s

cryptodev-2s commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

Heads up: one extension PR should land before this merges

Blocker: MetaMask/metamask-extension#46594.

The extension applies our state patches using its own copy of immer, and it never turns immer's patch plugin on. It gets away with that today because the extension and core both use immer 9, so yarn installs one shared copy and base-controller switches the plugin on for everybody.

Bump us to immer 11 and that sharing stops. The extension ends up with a copy nobody initialised, and every state update coming from the background throws.

We checked with preview builds of this PR:

extension CI result
without the extension fix 58 e2e jobs fail
with it all 64 pass

That fix is one line, and it is correct today regardless of this PR, so it can go in first at no cost.

Mobile is unaffected. MetaMask/metamask-mobile#36740 is 96 pass, 0 fail. It has no immer code of its own, and Metro resolves immer 11 fine.

Why the bump is worth it

BaseController.update() calls produceWithPatches on nearly every state change. Measured on realistic controller state (1000 accounts plus 1000 transactions):

immer 9 immer 11
change one field 1.07ms 0.42ms
add one account 1.06ms 0.41ms

So roughly 60% faster on the common path, and the gap grows as state grows. Array heavy recipes are 6 to 10% slower, recoverable later with immer's optional array plugin if we care.

Patches are also more correct. Shortening an array used to emit {"op":"replace","path":["txs","length"]}, which is not valid JSON Patch. v11 emits proper remove operations instead, and our patches get serialized across processes and persisted, so this is a real fix.

One caveat so nobody is surprised: bundle size is not a win. It is about 760 bytes worse gzipped, not smaller.

Method, and why the client CI numbers are not usable as immer evidence

Timings are produceWithPatches called directly on immer 9.0.21 vs 11.1.18, same state and same recipe, 200 iterations after warmup. Bundle figures are the shipped production builds (immer.cjs.production.min.js vs immer.production.mjs).

Do not read the bundle or benchmark numbers on those client test PRs as immer's doing. The preview base-controller differs from released 10.0.0 in two dependencies, not one:

@metamask/utils   ^11.12.0  ->  ^12.0.0
immer             ^9.0.6    ->  ^11.1.18

I also checked the mixed version window, since clients will run our immer 11 patches through their own immer 9 for a while. 10 scenarios (splice, length = 0, pop/shift, sort/reverse, filter reassign, nested, key delete, undefined assign, subtree replace) all gave identical results.

For whoever does the extension bump: LavaMoat policies need regenerating, and immer 11 needs a global that SES blocks by default ("@metamask/base-controller>immer": { "globals": { "Iterator": true } }). metamaskbot generates it automatically on the PR.

ccharly
ccharly previously approved these changes Sep 25, 2026

@ccharly ccharly left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM for accounts

@cryptodev-2s
cryptodev-2s added this pull request to the merge queue Sep 25, 2026
Merged via the queue into main with commit bbc8983 Sep 25, 2026
340 of 341 checks passed
@cryptodev-2s
cryptodev-2s deleted the renovate/immer-11.x branch September 25, 2026 14:30
pull Bot pushed a commit to Ramyromel/metamask-extension that referenced this pull request Sep 25, 2026
## **Description**

`applyPatches` in `ui/store/actions.ts` folds background state patches
into the Redux store. immer's patch support is a plugin you have to turn
on, and the registry is per copy of immer, so someone has to enable it
for the copy this file imports.

Nobody here ever did. It works by accident: we and the core packages
both want immer 9, so yarn dedupes them to one module and
`@metamask/base-controller` enables the plugin for us as a side effect.

Core is moving to immer 11 (MetaMask/core#10382). Once `base-controller`
ships with it, we get a second copy of immer that nobody enables, and
every background state update throws. Measured in MetaMask#46595: **58 e2e jobs
red without this change, 64 green with it.**

## **Changelog**

CHANGELOG entry: null

## **Related issues**

MetaMask/core#10382
Tested by: MetaMask#46595

## **Manual testing steps**

Normal CI covers current behaviour. For the failure this prevents, see
MetaMask#46595.

## **Screenshots/Recordings**

N/A, no UI change.

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Single module-load initialization with no intended behavior change
today; it hardens the critical background-to-Redux patch path ahead of
an immer version split.
> 
> **Overview**
> Calls **`enablePatches()`** in `ui/store/actions.ts` on the extension
UI’s own **`immer`** import, right before **`applyPatches`** runs during
**`updateMetamaskState`**.
> 
> Patch support in immer is opt-in and **per module instance**.
**`applyPatches`** already merges background **`Patch[]`** into Redux
**`metamask`** state; today that often works only because
**`@metamask/base-controller`** enables patches on a deduped shared
**`immer@9`**. When core moves to **`immer@11`** (MetaMask/core#10382),
the UI can get a second copy with patches never enabled, and **every
background state update throws**.
> 
> This makes patch application reliable for the UI regardless of how
dependencies dedupe immer.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
5903dcc. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
FrederikBolding pushed a commit that referenced this pull request Sep 28, 2026
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [immer](https://redirect.github.com/immerjs/immer) | [`^9.0.21` →
`^11.1.18`](https://renovatebot.com/diffs/npm/immer/9.0.21/11.1.18) |
![age](https://developer.mend.io/api/mc/badges/age/npm/immer/11.1.18?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/immer/9.0.21/11.1.18?slim=true)
|

---

### Release Notes

<details>
<summary>immerjs/immer (immer)</summary>

###
[`v11.1.18`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.18)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.17...v11.1.18)

##### Bug Fixes

- remove global `var Iterator` declaration conflicting with ESNext lib
([#&#8203;1290](https://redirect.github.com/immerjs/immer/issues/1290))
([b00474e](https://redirect.github.com/immerjs/immer/commit/b00474e3755954f6b27a392dcb4bce97254c100c)),
closes
[#&#8203;1273](https://redirect.github.com/immerjs/immer/issues/1273)

###
[`v11.1.17`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.17)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.16...v11.1.17)

##### Bug Fixes

- preserve structural sharing for no-op array-methods calls
([0c3efdd](https://redirect.github.com/immerjs/immer/commit/0c3efdd4eae2d44a9c436c554499c68c45b4eccc))

###
[`v11.1.16`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.16)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.15...v11.1.16)

##### Bug Fixes

- key inserted array indices by name in the array-methods plugin
([e3df956](https://redirect.github.com/immerjs/immer/commit/e3df956dca6f62c9053ab750b2c8b8a518f3e001))

###
[`v11.1.15`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.15)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.14...v11.1.15)

##### Bug Fixes

- correct curried produceWithPatches return type
([#&#8203;1249](https://redirect.github.com/immerjs/immer/issues/1249))
([a3be9df](https://redirect.github.com/immerjs/immer/commit/a3be9df762c1dbe9959a011ddbab0ce838cbc468)),
closes
[#&#8203;1045](https://redirect.github.com/immerjs/immer/issues/1045)

###
[`v11.1.14`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.14)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.13...v11.1.14)

##### Bug Fixes

- throw proper immer error when applyPatches path traverses null
([#&#8203;1251](https://redirect.github.com/immerjs/immer/issues/1251))
([e38ad71](https://redirect.github.com/immerjs/immer/commit/e38ad71f256844bf2dc28c1120c33c930c881bb6))

###
[`v11.1.13`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.13)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.12...v11.1.13)

##### Bug Fixes

- draft relocated base refs after reverse/sort in array-methods plugin
([#&#8203;1255](https://redirect.github.com/immerjs/immer/issues/1255))
([a73672a](https://redirect.github.com/immerjs/immer/commit/a73672ab76b5d9fd94f278a23c6c1931a03147e5))

###
[`v11.1.12`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.12)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.11...v11.1.12)

##### Bug Fixes

- Revert "prevent prototype pollution via constructor.prototype access
(CVE-2026-XXXX)
([#&#8203;1259](https://redirect.github.com/immerjs/immer/issues/1259))"
([#&#8203;1271](https://redirect.github.com/immerjs/immer/issues/1271))
([4d3d6ff](https://redirect.github.com/immerjs/immer/commit/4d3d6ff88caa85734a802a91cdb3dbe004d88b17)),
closes
[#&#8203;1266](https://redirect.github.com/immerjs/immer/issues/1266)
[#&#8203;1268](https://redirect.github.com/immerjs/immer/issues/1268)
[#&#8203;1265](https://redirect.github.com/immerjs/immer/issues/1265)

###
[`v11.1.11`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.11)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.10...v11.1.11)

##### Bug Fixes

- improve DraftMap.{entries,values}()
compatibility[#&#8203;1228](https://redirect.github.com/immerjs/immer/issues/1228)
([#&#8203;1228](https://redirect.github.com/immerjs/immer/issues/1228))
([858d036](https://redirect.github.com/immerjs/immer/commit/858d0365aa292a1f2028ccac3dfa8fccfbfa75c4))

###
[`v11.1.10`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.10)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.9...v11.1.10)

##### Bug Fixes

- undefined assigned to a prototype-inherited key gets dropped
([#&#8203;1262](https://redirect.github.com/immerjs/immer/issues/1262))
([16e225b](https://redirect.github.com/immerjs/immer/commit/16e225b5a316d9ef6695e9aee45eab6e7bf4258a))

###
[`v11.1.9`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.9)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.8...v11.1.9)

##### Bug Fixes

- prevent prototype pollution via constructor.prototype access
(CVE-2026-XXXX)
([#&#8203;1259](https://redirect.github.com/immerjs/immer/issues/1259))
([48fc378](https://redirect.github.com/immerjs/immer/commit/48fc3788609ce46dd789c313768bae4f48b00ec5))

###
[`v11.1.8`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.8)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.7...v11.1.8)

##### Bug Fixes

- update current and original typings to assert draft value is unwrapped
([#&#8203;1236](https://redirect.github.com/immerjs/immer/issues/1236))
([bf2d154](https://redirect.github.com/immerjs/immer/commit/bf2d15439259887f98f2737cf7ebde4234d5adea))

###
[`v11.1.7`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.7)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.6...v11.1.7)

##### Bug Fixes

- improve higher order type inference for WritableDraft
([#&#8203;1205](https://redirect.github.com/immerjs/immer/issues/1205))
([7390d6c](https://redirect.github.com/immerjs/immer/commit/7390d6c3ae8b54df165c003b14b088a085950f76))

###
[`v11.1.6`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.6)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.5...v11.1.6)

##### Bug Fixes

- remove invalid curried producer type
([#&#8203;1216](https://redirect.github.com/immerjs/immer/issues/1216))
([b40b04f](https://redirect.github.com/immerjs/immer/commit/b40b04f789a59f7948c7e5de29ce4dc5ddca3e38))

###
[`v11.1.5`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.5)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.4...v11.1.5)

##### Bug Fixes

- handle nested proxies after spreading and inserting into an array
([d3bc436](https://redirect.github.com/immerjs/immer/commit/d3bc436d0f39dd9c273f1fad3061c17f73ffd82a))

###
[`v11.1.4`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.4)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.3...v11.1.4)

##### Bug Fixes

- handle nested proxies after spreading and inserting into an array
([90a7765](https://redirect.github.com/immerjs/immer/commit/90a77655af5a9dd3fbf7688f95952d32511b430c))

###
[`v11.1.3`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.3)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.2...v11.1.3)

##### Bug Fixes

- recursive T for WritableDraft
([#&#8203;1197](https://redirect.github.com/immerjs/immer/issues/1197))
([78ea694](https://redirect.github.com/immerjs/immer/commit/78ea6941f0de564e10c9e20c91449ea37d477991))

###
[`v11.1.2`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.2)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.1.0...v11.1.2)

##### Bug Fixes

- bogus commit to retest release
([c329ddb](https://redirect.github.com/immerjs/immer/commit/c329ddb1f4b8d3988458978ace36988d3a9eab24))

###
[`v11.1.0`](https://redirect.github.com/immerjs/immer/releases/tag/v11.1.0)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.0.1...v11.1.0)

This **feature release** adds a new optional "array method overrides"
plugin that significantly speeds up array methods when accessing drafts.

##### Changelog

##### Performance Improvements

As part of the recent performance optimization work, our benchmarks
showed that all Proxy-based immutable update libraries were drastically
slower than vanilla JS when calling both mutating and non-mutating array
methods. After investigation, it turns out that an array method like
`arr.filter()` causes the Proxy's `get` trap to trigger for every single
item in the array. This in turn forces creation of a new Proxy and
internal Immer metadata for every item, even though this was just a read
operation and no items were being updated.

This release adds a new `enableArrayMethods` plugin that will override
draft array methods to bypass the draft and directly operate on the
underlying wrapped array instance. This *significantly* speeds up array
operations.

When enabled, the plugin overrides these array methods:

- Mutating: `push`, `pop`, `shift`, `unshift`, `splice`, `reverse`,
`sort`
- Non-mutating: `filter`, `slice`, `concat`, `flat`, `find`,
`findIndex`, `findLast`, `findLastIndex`, `some`, `every`, `indexOf`,
`lastIndexOf`, `includes`, `join`, `toString`, `toLocaleString`

Our benchmarks show that the overridden methods (plus the other perf
changes in Immer 10.2 and 11.0) are [50-80% faster than the baseline
behavior of Immer
10.1](https://redirect.github.com/immerjs/immer/pull/1184).

The plugin adds about 1.5-2K minified to Immer's bundle size.

It's important to note that **the plugin does change the "safe to mutate
a draft" semantics of Immer**. Any of these methods that receives an
array item as a callback argument ***will not* automatically wrap that
item in a Proxy!**. That means that if you try to mutate an argument in
a method such as `filter`, it *will* actually mutate the real underlying
object, which *will* cause bugs in your app. This is an intentional
design tradeoff. Semantically, all of these methods imply read-only
access to array values, so if your code tries to mutate an array item in
a callback, that is a bug in your code.

Note that this does *not* override `map`, `flatMap`, `forEach`, or
`reduce` / `reduceRight`. Those methods do imply either side effects and
potential mutations, or returning arbitrary values. Given that, we
determined it was both safest and simplest to keep their behavior as-is.

See the [Array Methods Plugin docs
page](https://immerjs.github.io/immer/array-methods) for further details
on the behavior of the overridden methods.

##### What's Changed

- Override array methods to avoid proxy creation while iterating and
updating by
[@&#8203;markerikson](https://redirect.github.com/markerikson) in
[#&#8203;1184](https://redirect.github.com/immerjs/immer/pull/1184)

###
[`v11.0.1`](https://redirect.github.com/immerjs/immer/releases/tag/v11.0.1)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v11.0.0...v11.0.1)

##### Bug Fixes

- (dummy fix to release freeze fix per
[#&#8203;1193](https://redirect.github.com/immerjs/immer/issues/1193))
([99e59a8](https://redirect.github.com/immerjs/immer/commit/99e59a8d127fac1a3b98f943a90347a46d1779fa))

###
[`v11.0.0`](https://redirect.github.com/immerjs/immer/releases/tag/v11.0.0)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.2.0...v11.0.0)

##### Performance Improvements

- Rewrite finalization system to use a callback approach instead of tree
traversal
([#&#8203;1183](https://redirect.github.com/immerjs/immer/issues/1183))
([d6c1202](https://redirect.github.com/immerjs/immer/commit/d6c12028c05c1f7bbbdba0e3978b7c06988aa7f2))

##### BREAKING CHANGES

- enable loose iteration by default

- Simplify some iteration checks

- Allow passing type to get/set utils to skip archetype lookup

- Convert assigned\_ to Map

- Enable loose iteration

- Replace recursive tree finalization with targeted callbacks

Ported Mutative's "finalization callback" approach as a more targeted
and performant implementation for finalization compared to the existing
recursive tree traversal approach:

- Added cleanup callbacks for each draft that's created
- Added callbacks to handle root drafts, assigned values, and recursing
  inside of plain values
- Updated state creation to return \[draft, state] to avoid a lookup
- Rewrote patch generation system to work with callbacks instead of
  during tree traversal

* Update self-reference test with new behavior
* Apply code review suggestions
* Byte-shave scopes and patch plugin usage
* Inline finalizeAssigned
* Move fixPotentialSetContents to plugin
* Byte-shave typeof utils
* Byte-shave Object references
* Byte-shave field names and arrow functions

###
[`v10.2.0`](https://redirect.github.com/immerjs/immer/releases/tag/v10.2.0)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.1.3...v10.2.0)

##### Features

- Optimize Immer performance where possible, introduce
`setUseStrictIteration`
([#&#8203;1164](https://redirect.github.com/immerjs/immer/issues/1164))
([e1996ce](https://redirect.github.com/immerjs/immer/commit/e1996ceb8a3a180c565b7304a4f3c4ce3b1a08ff))

###
[`v10.1.3`](https://redirect.github.com/immerjs/immer/releases/tag/v10.1.3)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.1.2...v10.1.3)

##### Bug Fixes

- Mark exports as pure, for better tree-shakability
([#&#8203;1124](https://redirect.github.com/immerjs/immer/issues/1124))
([85faaa2](https://redirect.github.com/immerjs/immer/commit/85faaa24d4095c7887913a1a4fb218bf2bb881f3))

###
[`v10.1.2`](https://redirect.github.com/immerjs/immer/releases/tag/v10.1.2)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.1.1...v10.1.2)

##### Bug Fixes

- non-enumerable (immutable) methods on Map/Set
([#&#8203;1069](https://redirect.github.com/immerjs/immer/issues/1069))
([aa24400](https://redirect.github.com/immerjs/immer/commit/aa24400ea1f53b20927ac3619ea4fcd98c3a2172))
- Update package.json exports for react-native
([#&#8203;1159](https://redirect.github.com/immerjs/immer/issues/1159))
([b2fcc66](https://redirect.github.com/immerjs/immer/commit/b2fcc6608773f0886ccc673d62deb1ca7f4a0e83))

###
[`v10.1.1`](https://redirect.github.com/immerjs/immer/releases/tag/v10.1.1)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.1.0...v10.1.1)

##### Bug Fixes

- export lost types
([#&#8203;1116](https://redirect.github.com/immerjs/immer/issues/1116))
([5a8f6e7](https://redirect.github.com/immerjs/immer/commit/5a8f6e7bee76407502ca128f95ad25d277c054e3))
- Make `applyPatches` to accept `readonly Patch[]`
([#&#8203;1094](https://redirect.github.com/immerjs/immer/issues/1094))
([4da2e0d](https://redirect.github.com/immerjs/immer/commit/4da2e0d5af3c155ba26af1364a7095366adff6ba))

###
[`v10.1.0`](https://redirect.github.com/immerjs/immer/releases/tag/v10.1.0)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.0.4...v10.1.0)

##### Features

- **performance:** Make non-strict mode faster for classes. Addresses
[#&#8203;1071](https://redirect.github.com/immerjs/immer/issues/1071)
([53e3203](https://redirect.github.com/immerjs/immer/commit/53e3203984058b8e5ce81a67b81c60069481c568)).
Immer 10.x solved slow iteration for plain JS objects. This update
applies the same handling to class instances. In cases this makes class
instance handling 3 times faster. Note that this slightly modifies the
behavior of Immer with classes in obscure corner cases, in ways that
match current documentation, but do not match previous behavior. If you
run into issues with this release icmw. class instances, use
`setUseStrictShallowCopy("class_only")` to revert to the old behavior.
For more details see
<https://immerjs.github.io/immer/complex-objects#semantics-in-detail>

###
[`v10.0.4`](https://redirect.github.com/immerjs/immer/releases/tag/v10.0.4)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.0.3...v10.0.4)

##### Bug Fixes

- Fix handling of Symbol and non-enumerable properties in finalization /
freeze. Fixes
[#&#8203;1096](https://redirect.github.com/immerjs/immer/issues/1096),
[#&#8203;1087](https://redirect.github.com/immerjs/immer/issues/1087),
[#&#8203;1091](https://redirect.github.com/immerjs/immer/issues/1091)
([#&#8203;1105](https://redirect.github.com/immerjs/immer/issues/1105)))
([8949a3e](https://redirect.github.com/immerjs/immer/commit/8949a3ee68f187573e61f5345f2b8b59bcd0813c))

###
[`v10.0.3`](https://redirect.github.com/immerjs/immer/releases/tag/v10.0.3)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.0.2...v10.0.3)

##### Bug Fixes

- don't use `.mjs` file for react-native, which isn't supported by
default. Fixes
[#&#8203;1058](https://redirect.github.com/immerjs/immer/issues/1058)
[#&#8203;1065](https://redirect.github.com/immerjs/immer/issues/1065)
([#&#8203;1075](https://redirect.github.com/immerjs/immer/issues/1075))
([f6736a4](https://redirect.github.com/immerjs/immer/commit/f6736a4beef727c6e5b41c312ce1b202ad3afb23))

###
[`v10.0.2`](https://redirect.github.com/immerjs/immer/releases/tag/v10.0.2)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.0.1...v10.0.2)

##### Bug Fixes

- export `Objectish` type
([#&#8203;1043](https://redirect.github.com/immerjs/immer/issues/1043))
([75e004d](https://redirect.github.com/immerjs/immer/commit/75e004db1374e059773047e786d6d01ee1e90a0f))
- Move index.js.flow from dist/ -> dist/cjs/ to match index.js
([#&#8203;1038](https://redirect.github.com/immerjs/immer/issues/1038))
([a3b5603](https://redirect.github.com/immerjs/immer/commit/a3b5603c7270ba5b5267b41312a66931026c21c9))

###
[`v10.0.1`](https://redirect.github.com/immerjs/immer/releases/tag/v10.0.1)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v10.0.0...v10.0.1)

##### Bug Fixes

- production bundle was loaded incorrectly, fixes
[#&#8203;1037](https://redirect.github.com/immerjs/immer/issues/1037)
([707e72b](https://redirect.github.com/immerjs/immer/commit/707e72b49f7c06b623242a3b66c2bda83e786d63))

###
[`v10.0.0`](https://redirect.github.com/immerjs/immer/releases/tag/v10.0.0)

[Compare
Source](https://redirect.github.com/immerjs/immer/compare/v9.0.21...v10.0.0)

##### Release notes

- \[breaking change] Immer 10 only supports modern browsers, that have
support for `Proxy`, `Reflect`, `Symbol` and `Map` and `Set`.
- \[breaking change] There is no longer a UMD build exposed (thanks
[Mark Erikson](https://redirect.github.com/markerikson) for modernizing
the build setup in
[#&#8203;1032](https://redirect.github.com/immerjs/immer/issues/1032)!
- \[breaking change] getters and setters are ignored by default on plain
object, as this is a very uncommon case and provides a significant
performance boost (ca 33%, but depends a lot on the scenario). Fixes
[#&#8203;867](https://redirect.github.com/immerjs/immer/issues/867),
[#&#8203;1012](https://redirect.github.com/immerjs/immer/issues/1012).
Thanks [hrsh7th](https://redirect.github.com/hrsh7th) for implementing
it in
[#&#8203;941](https://redirect.github.com/immerjs/immer/issues/941)!
- \[breaking change] Promise based reducers are no longer supported.
Conceptually it is an anti pattern to hold on to drafts over time. If
needed the old behavior can still be achieved by leveraging
`createDraft` and `finishDraft`.
- \[breaking change] ES5 mode (for legacy browsers) has been dropped. If
your project relies on `enableES5()`, you SHOULD NOT upgrade Immer.
`enableES5` has been removed.
- \[breaking change] `produce` is no longer exposed as the `default`
export. This improves eco system compatibility, and makes sure that
there is only one correct way of doing things
- \[breaking change] `enableAllPlugins` has been removed, use
`enablePatches(); enableMapSet()` instead
- \[breaking change] shortening the length of a JSON array now results
in delete patches, rather than a mutation of the `length` property, in
accordance with JSON spec. Thanks
[kshramt](https://redirect.github.com/kshramt) for implementing this in
[#&#8203;964](https://redirect.github.com/immerjs/immer/issues/964)!
- Immer is now an ESM package that can be directly imported into the
browser. CJS should still work, UMD support has been removed.

Overall, there is a rough performance increase of 33% for Immer (and in
some cases significantly higher), and the (non gzipped) bundle size has
reduced from 16 to 11.5 KB, while the the minimal gzipped import of just
`produce` has remained roughly the same at 3.3 KB.

For more details, see
[#&#8203;1015](https://redirect.github.com/immerjs/immer/issues/1015)

##### Migration steps

1. If you have any `enableES5()` call, don't migrate
2. When using getters/ setters icmw plain objects, call
`useStrictShallowCopy(true)` at startup
3. Replace all default imports: Replace `import produce from "immer"`
with `import {produce} from "immer"`
4. Replace all calls to `enableAllPlugins()` with `enablePatches();
enableMapSet();` to be more specific and smoothen future migrations.
5. If any producer returned a Promise, refactor it to leverage
`createDraft` instead. Roughly:

```javascript
const newState = await produce(oldState, recipe)

// becomes
const draft  = createDraft(oldState)
await recipe(draft)
const newState = finishDraft(draft)
```

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend Renovate
CLI](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDYuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEwNi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Immer v11 is a major bump used by nearly all controller state updates;
regressions could affect wallet state, permissions, and transactions
even though the diff is mostly dependency and type cleanup.
> 
> **Overview**
> This PR upgrades **`immer`** from `^9.0.21` to **`^11.1.18`** across
the monorepo (accounts, base-controller, keyring, network, permission,
transaction, wallet-cli, and related packages), with matching
**CHANGELOG** entries and **`yarn.lock`** resolution.
> 
> Follow-up code changes align with **Immer 11’s typing and export
surface**: public **`WritableDraft`** imports from `'immer'` (replacing
`'immer/dist/internal.js'`), fewer manual casts in
**`AccountsController`**, simplified draft typing in
**`AbstractMessageManager`** and **`transaction-controller`** batch
helpers, and removal of **`@ts-expect-error`** workarounds for
“excessively deep” types in **`PermissionController`** and
**`SubjectMetadataController`**. One **oxlint** suppression for
**`typescript/no-unsafe-argument`** on **`PermissionController`** is
dropped as a result.
> 
> There is no new application logic beyond what the dependency bump
implies (Immer 11 includes performance and iteration/finalization
behavior changes documented upstream).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
47540b2. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamask-ci[bot] <271559518+metamask-ci[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: cryptodev-2s <109512101+cryptodev-2s@users.noreply.github.com>
Co-authored-by: Salah-Eddine Saakoun <salah-eddine.saakoun@consensys.net>

This branch was successfully deployed

2 active (1 outdated) deployments
dependabot — 47540b25 Deployed Sep 25, 2026 by cryptodev-2s via Repair constraints, lockfile and changelogs #298
default-branch — 7304fd25 Deployed Sep 24, 2026 by cryptodev-2s via Determine whether this PR is a release PR #4621
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants