From 25a4794ecbe248182aa6b53a57fddfa3368f4d0f Mon Sep 17 00:00:00 2001
From: "metamask-ci[bot]" <271559518+metamask-ci[bot]@users.noreply.github.com>
Date: Thu, 24 Sep 2026 14:09:48 +0000
Subject: [PATCH 1/2] fix(deps): update dependency punycode to ^2.3.1

---
 packages/phishing-controller/package.json | 4 ++--
 yarn.lock                                 | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/phishing-controller/package.json b/packages/phishing-controller/package.json
index ecfc77177f0..06206c25118 100644
--- a/packages/phishing-controller/package.json
+++ b/packages/phishing-controller/package.json
@@ -56,10 +56,10 @@
     "@metamask/messenger": "^3.0.0",
     "@metamask/transaction-controller": "^72.0.0",
     "@noble/hashes": "^1.8.0",
-    "@types/punycode": "^2.1.0",
+    "@types/punycode": "^2.1.4",
     "ethereum-cryptography": "^2.1.2",
     "fastest-levenshtein": "^1.0.16",
-    "punycode": "^2.1.1"
+    "punycode": "^2.3.1"
   },
   "devDependencies": {
     "@metamask/auto-changelog": "^6.2.1",
diff --git a/yarn.lock b/yarn.lock
index edb1e3ed422..3c399c18dbc 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8429,14 +8429,14 @@ __metadata:
     "@metamask/transaction-controller": "npm:^72.0.0"
     "@noble/hashes": "npm:^1.8.0"
     "@types/jest": "npm:^30.0.0"
-    "@types/punycode": "npm:^2.1.0"
+    "@types/punycode": "npm:^2.1.4"
     "@typescript/native": "npm:typescript@^7.0.2"
     deepmerge: "npm:^4.2.2"
     ethereum-cryptography: "npm:^2.1.2"
     fastest-levenshtein: "npm:^1.0.16"
     jest: "npm:^30.4.2"
     nock: "npm:^13.5.6"
-    punycode: "npm:^2.1.1"
+    punycode: "npm:^2.3.1"
     rimraf: "npm:^6.1.3"
     ts-jest: "npm:^29.4.12"
     tsx: "npm:^4.23.13"
@@ -12117,7 +12117,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/punycode@npm:^2.1.0":
+"@types/punycode@npm:^2.1.4":
   version: 2.1.4
   resolution: "@types/punycode@npm:2.1.4"
   checksum: 10/16637bdd8e4f830243072668125f83b93b728085a05140ccc3e7801528d78c62cce5426b07d5cdc75e4f797e1644807c762777f651d1cd071ad0128835cdce5e
@@ -24737,7 +24737,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"punycode@npm:^2.1.0, punycode@npm:^2.1.1, punycode@npm:^2.3.1":
+"punycode@npm:^2.1.0, punycode@npm:^2.3.1":
   version: 2.3.1
   resolution: "punycode@npm:2.3.1"
   checksum: 10/febdc4362bead22f9e2608ff0171713230b57aff9dddc1c273aa2a651fbd366f94b7d6a71d78342a7c0819906750351ca7f2edd26ea41b626d87d6a13d1bd059

From 0790dfe9329c672b3f6f672ecf4b9f407da8bd13 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 24 Sep 2026 14:14:07 +0000
Subject: [PATCH 2/2] [dependabot skip] chore: add changelog entries for bumped
 dependencies

---
 packages/phishing-controller/CHANGELOG.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/phishing-controller/CHANGELOG.md b/packages/phishing-controller/CHANGELOG.md
index b5a2f0cae2c..1ecf8a073af 100644
--- a/packages/phishing-controller/CHANGELOG.md
+++ b/packages/phishing-controller/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Bump `@types/punycode` from `^2.1.0` to `^2.1.4` ([#10441](https://github.com/MetaMask/core/pull/10441))
+- Bump `punycode` from `^2.1.1` to `^2.3.1` ([#10441](https://github.com/MetaMask/core/pull/10441))
+
 ## [18.1.1]
 
 ### Changed