fix(deps): update dependency @ethersproject/providers to ^5.8.0 by metamask-ci[bot] · Pull Request #10482 · MetaMask/core

metamask-ci · 2026-09-25T15:04:25Z

This PR contains the following updates:

Package	Change	Age	Confidence
@ethersproject/providers (source)	`^5.7.0` → `^5.8.0`

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

Note

Low Risk
Patch-level dependency alignment within ethers v5 with no logic changes; residual risk is limited to upstream provider behavior differences in RPC-heavy paths.

Overview
Bumps @ethersproject/providers from ^5.7.0 to ^5.8.0 across seven workspace packages: assets-controller, assets-controllers, bridge-controller, earn-controller, money-account-balance-service, transaction-pay-controller, and eth-json-rpc-provider (devDependency). Each package’s Unreleased changelog gets a matching entry, and yarn.lock resolves the workspace to @ethersproject/providers@5.8.0.

There are no source changes—only manifest, changelog, and lockfile updates. Consumers still depend on the same ethers v5 provider APIs (e.g. Web3Provider) used for EVM RPC and balance flows.

^{Reviewed by Cursor Bugbot for commit 7a29773. Bugbot is set up for automated code reviews on this repo. Configure here.}

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@ethersproject/providers](https://redirect.github.com/ethers-io/ethers.js) ([source](https://redirect.github.com/ethers-io/ethers.js/tree/HEAD/packages/providers)) | [`^5.7.0` → `^5.8.0`](https://renovatebot.com/diffs/npm/@ethersproject%2fproviders/5.8.0/5.8.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@ethersproject%2fproviders/5.8.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@ethersproject%2fproviders/5.8.0/5.8.0?slim=true) | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate).   --- > [!NOTE] > **Low Risk** > Patch-level dependency alignment within ethers v5 with no logic changes; residual risk is limited to upstream provider behavior differences in RPC-heavy paths. > > **Overview** > Bumps **`@ethersproject/providers`** from **`^5.7.0`** to **`^5.8.0`** across seven workspace packages: `assets-controller`, `assets-controllers`, `bridge-controller`, `earn-controller`, `money-account-balance-service`, `transaction-pay-controller`, and `eth-json-rpc-provider` (devDependency). Each package’s **Unreleased** changelog gets a matching entry, and **`yarn.lock`** resolves the workspace to **`@ethersproject/providers@5.8.0`**. > > There are **no source changes**—only manifest, changelog, and lockfile updates. Consumers still depend on the same ethers v5 provider APIs (e.g. `Web3Provider`) used for EVM RPC and balance flows. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 7a29773. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: metamask-ci[bot] <271559518+metamask-ci[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Explanation `@ethersproject` has 11 packages here and they all ship from one repository at one version, so the 5.8.0 release produced #10478, #10481, #10482, #10483 and #10484, each bumping the same manifests and writing into the same changelogs. They cannot be merged independently without conflicting. `config:recommended` already pulls in `group:monorepos`, but that works off Renovate's own monorepo data, which has no `ethers` entry, nor most of ours. So instead of listing scopes, this groups by the repository a package is published from, which is the thing that actually decides whether releases move together. `groupName` supports templating and `sourceRepoSlug` is available, so it is one rule for every dependency. That is also more accurate than grouping by npm scope. `@noble` would have been wrong as a scope group, since `noble-hashes`, `noble-curves` and `noble-ciphers` are three separate repositories, and this splits them correctly without being told. Two exclusions: - `@types`, because DefinitelyTyped is a single repository holding 21 unrelated libraries. The two that do belong with something else, `@types/jest` and `@types/react`, are already paired with their runtime packages by `group:jestPlusTypes` and `group:react`. - `@metamask`, because grouping it would touch most of the monorepo in one pull request. The `{{#if}}` fallback is load bearing rather than decoration. A package with no `sourceUrl` gets an empty `groupName`, and `hasGroupName` only tests for `null`, so without it every such package would collapse into one nameless group. Validated with `renovate-config-validator --strict`. Renovate will supersede the five open `@ethersproject` pull requests with a single grouped one on the next run. ## References Follows #10451. Part of WPC-1161. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

## @metamask/base-data-service ## [2.1.0] ### Added - Add `executeMutation` protected method to `BaseDataService` to allow for making server-state-mutating requests ([#9324](#9324)) - These kinds of requests are never retried, unlike queries. - To use this, create a method in your data service class which takes whatever arguments you need, plus a optional final argument called `globalId`; then call `executeMutation` with a `mutationKey`, `globalId`, and `mutationFn`. See `ExampleDataService` in this package for an example. - A `MutationKey` type is also available. - Add protected `cancelQueries` so subclasses can abort in-flight reads before a forced refresh ([#10454](#10454)) ### Changed - The payload for `:cacheUpdated` and `:cacheUpdated:${hash}` events now includes an `objectType` property, which is either "query" or "mutation" ([#9324](#9324)) - Bump `@metamask/utils` from `^11.12.0` to `^12.0.0` ([#10192](#10192)) - Add `uuid` `^11.1.1` as a dependency ([#9324](#9324)) - Bump `@tanstack/query-core` from `^5.62.16` to `^5.89.0` ([#9324](#9324)) - Bump `cockatiel` from `^3.1.2` to `^3.2.1` ([#10436](#10436)) - Bump `lodash-es` from `^4.17.21` to `^4.18.1` ([#10447](#10447)) ## @metamask/money-account-api-data-service ## [2.0.0] ### Added - Add optional `fresh` option to `fetchPositions` that cancels in-flight reads, fetches with a zero stale time, invalidates the result for subsequent reads, and sends `Cache-Control: no-cache` so the Money API skips its Nest response cache when supported ([#10455](#10455)) - Accept optional additive `musd_balance_updated_at` on the positions `balance` summary ([#10455](#10455)) - Accept vault metadata on each position returned by `fetchPositions`: `chain_id`, `vault_key`, `name`, `asset_symbol`, and `asset_decimals` ([#10500](#10500)) - Accept multi-asset balance fields `by_asset` and `total_balance_usd` on the positions `balance` summary, and export `AssetBalance` ([#10500](#10500)) ### Changed - **BREAKING:** `effective_apy` on a vault position is now `string | null`. `null` means the position has been invested for fewer than 28 days, and is distinct from a rate of zero ([#10500](#10500)) - Bump `@metamask/base-data-service` from `^2.0.0` to `^2.1.0` - Bump `@metamask/utils` from `^11.12.0` to `^12.0.0` ([#10192](#10192)) - Bump `@tanstack/query-core` from `^5.62.16` to `^5.89.0` ([#9324](#9324)) ## @metamask/money-account-balance-service ## [3.1.0] ### Added - Surface Money API freshness on `fetchBalanceWithFallback` results (`asOfBlock`, `asOfTimestamp`, `dataFreshness`, `indexerLagSeconds`, `musdBalanceUpdatedAt`) when `source` is `api` ([#10455](#10455)) - Add optional `FetchBalanceWithFallbackOptions` (`minBlock`, `fresh`): when the API `as_of_block` is behind `minBlock`, throw `MoneyAccountBalanceStaleError` and fall back to RPC without reporting a defect; `minBlock` implies a fresh positions read, and explicit `fresh` is also forwarded to `fetchPositions` ([#10455](#10455)) - Export `MoneyAccountBalanceStaleError` ([#10455](#10455)) ### Changed - Bump `@metamask/money-account-api-data-service` from `^1.0.0` to `^2.0.0` - Bump `@metamask/base-data-service` from `^2.0.0` to `^2.1.0` - Bump `@metamask/utils` from `^11.12.0` to `^12.0.0` ([#10192](#10192)) - Bump `@ethersproject/providers` from `^5.7.0` to `^5.8.0` ([#10482](#10482))  --- > [!NOTE] > **Medium Risk** > The release bundles Money balance/positions API behavior changes including a breaking type change and post-tx staleness fallback logic, even though this PR only cuts versions and dependency ranges. > > **Overview** > **Monorepo release 1294.0.0** that cuts new package versions and aligns dependents—there are no application source edits in this diff, only `package.json`, changelog, and lockfile updates. > > **Version cuts:** `@metamask/base-data-service` **2.1.0**, `@metamask/money-account-api-data-service` **2.0.0**, and `@metamask/money-account-balance-service` **3.1.0**, with `[Unreleased]` notes moved into those release sections. The root monorepo version moves **1293.0.0 → 1294.0.0**. > > **Dependency propagation:** Every listed consumer bumps `@metamask/base-data-service` from `^2.0.0` to `^2.1.0`. `@metamask/money-account-balance-service` picks up `@metamask/money-account-api-data-service` **^2.0.0**; `@metamask/subscription-controller` also bumps `@metamask/money-account-balance-service` to **^3.1.0**. > > **What ships in those releases (via changelog, not new code here):** `BaseDataService` gains mutation/query-cancel plumbing and richer cache events; Money API positions support forced refresh, richer balance/position shapes, and a **breaking** `effective_apy: string | null`; balance fallback exposes API freshness metadata and optional `minBlock` / `fresh` behavior with `MoneyAccountBalanceStaleError`. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ee833b1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Explanation `@ethersproject` has 11 packages here and they all ship from one repository at one version, so the 5.8.0 release produced MetaMask#10478, MetaMask#10481, MetaMask#10482, MetaMask#10483 and MetaMask#10484, each bumping the same manifests and writing into the same changelogs. They cannot be merged independently without conflicting. `config:recommended` already pulls in `group:monorepos`, but that works off Renovate's own monorepo data, which has no `ethers` entry, nor most of ours. So instead of listing scopes, this groups by the repository a package is published from, which is the thing that actually decides whether releases move together. `groupName` supports templating and `sourceRepoSlug` is available, so it is one rule for every dependency. That is also more accurate than grouping by npm scope. `@noble` would have been wrong as a scope group, since `noble-hashes`, `noble-curves` and `noble-ciphers` are three separate repositories, and this splits them correctly without being told. Two exclusions: - `@types`, because DefinitelyTyped is a single repository holding 21 unrelated libraries. The two that do belong with something else, `@types/jest` and `@types/react`, are already paired with their runtime packages by `group:jestPlusTypes` and `group:react`. - `@metamask`, because grouping it would touch most of the monorepo in one pull request. The `{{#if}}` fallback is load bearing rather than decoration. A package with no `sourceUrl` gets an empty `groupName`, and `hasGroupName` only tests for `null`, so without it every such package would collapse into one nameless group. Validated with `renovate-config-validator --strict`. Renovate will supersede the five open `@ethersproject` pull requests with a single grouped one on the next run. ## References Follows MetaMask#10451. Part of WPC-1161. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

## @metamask/base-data-service ## [2.1.0] ### Added - Add `executeMutation` protected method to `BaseDataService` to allow for making server-state-mutating requests ([MetaMask#9324](MetaMask#9324)) - These kinds of requests are never retried, unlike queries. - To use this, create a method in your data service class which takes whatever arguments you need, plus a optional final argument called `globalId`; then call `executeMutation` with a `mutationKey`, `globalId`, and `mutationFn`. See `ExampleDataService` in this package for an example. - A `MutationKey` type is also available. - Add protected `cancelQueries` so subclasses can abort in-flight reads before a forced refresh ([MetaMask#10454](MetaMask#10454)) ### Changed - The payload for `:cacheUpdated` and `:cacheUpdated:${hash}` events now includes an `objectType` property, which is either "query" or "mutation" ([MetaMask#9324](MetaMask#9324)) - Bump `@metamask/utils` from `^11.12.0` to `^12.0.0` ([MetaMask#10192](MetaMask#10192)) - Add `uuid` `^11.1.1` as a dependency ([MetaMask#9324](MetaMask#9324)) - Bump `@tanstack/query-core` from `^5.62.16` to `^5.89.0` ([MetaMask#9324](MetaMask#9324)) - Bump `cockatiel` from `^3.1.2` to `^3.2.1` ([MetaMask#10436](MetaMask#10436)) - Bump `lodash-es` from `^4.17.21` to `^4.18.1` ([MetaMask#10447](MetaMask#10447)) ## @metamask/money-account-api-data-service ## [2.0.0] ### Added - Add optional `fresh` option to `fetchPositions` that cancels in-flight reads, fetches with a zero stale time, invalidates the result for subsequent reads, and sends `Cache-Control: no-cache` so the Money API skips its Nest response cache when supported ([MetaMask#10455](MetaMask#10455)) - Accept optional additive `musd_balance_updated_at` on the positions `balance` summary ([MetaMask#10455](MetaMask#10455)) - Accept vault metadata on each position returned by `fetchPositions`: `chain_id`, `vault_key`, `name`, `asset_symbol`, and `asset_decimals` ([MetaMask#10500](MetaMask#10500)) - Accept multi-asset balance fields `by_asset` and `total_balance_usd` on the positions `balance` summary, and export `AssetBalance` ([MetaMask#10500](MetaMask#10500)) ### Changed - **BREAKING:** `effective_apy` on a vault position is now `string | null`. `null` means the position has been invested for fewer than 28 days, and is distinct from a rate of zero ([MetaMask#10500](MetaMask#10500)) - Bump `@metamask/base-data-service` from `^2.0.0` to `^2.1.0` - Bump `@metamask/utils` from `^11.12.0` to `^12.0.0` ([MetaMask#10192](MetaMask#10192)) - Bump `@tanstack/query-core` from `^5.62.16` to `^5.89.0` ([MetaMask#9324](MetaMask#9324)) ## @metamask/money-account-balance-service ## [3.1.0] ### Added - Surface Money API freshness on `fetchBalanceWithFallback` results (`asOfBlock`, `asOfTimestamp`, `dataFreshness`, `indexerLagSeconds`, `musdBalanceUpdatedAt`) when `source` is `api` ([MetaMask#10455](MetaMask#10455)) - Add optional `FetchBalanceWithFallbackOptions` (`minBlock`, `fresh`): when the API `as_of_block` is behind `minBlock`, throw `MoneyAccountBalanceStaleError` and fall back to RPC without reporting a defect; `minBlock` implies a fresh positions read, and explicit `fresh` is also forwarded to `fetchPositions` ([MetaMask#10455](MetaMask#10455)) - Export `MoneyAccountBalanceStaleError` ([MetaMask#10455](MetaMask#10455)) ### Changed - Bump `@metamask/money-account-api-data-service` from `^1.0.0` to `^2.0.0` - Bump `@metamask/base-data-service` from `^2.0.0` to `^2.1.0` - Bump `@metamask/utils` from `^11.12.0` to `^12.0.0` ([MetaMask#10192](MetaMask#10192)) - Bump `@ethersproject/providers` from `^5.7.0` to `^5.8.0` ([MetaMask#10482](MetaMask#10482))  --- > [!NOTE] > **Medium Risk** > The release bundles Money balance/positions API behavior changes including a breaking type change and post-tx staleness fallback logic, even though this PR only cuts versions and dependency ranges. > > **Overview** > **Monorepo release 1294.0.0** that cuts new package versions and aligns dependents—there are no application source edits in this diff, only `package.json`, changelog, and lockfile updates. > > **Version cuts:** `@metamask/base-data-service` **2.1.0**, `@metamask/money-account-api-data-service` **2.0.0**, and `@metamask/money-account-balance-service` **3.1.0**, with `[Unreleased]` notes moved into those release sections. The root monorepo version moves **1293.0.0 → 1294.0.0**. > > **Dependency propagation:** Every listed consumer bumps `@metamask/base-data-service` from `^2.0.0` to `^2.1.0`. `@metamask/money-account-balance-service` picks up `@metamask/money-account-api-data-service` **^2.0.0**; `@metamask/subscription-controller` also bumps `@metamask/money-account-balance-service` to **^3.1.0**. > > **What ships in those releases (via changelog, not new code here):** `BaseDataService` gains mutation/query-cancel plumbing and richer cache events; Money API positions support forced refresh, richer balance/position shapes, and a **breaking** `effective_apy: string | null`; balance fallback exposes API freshness metadata and optional `minBlock` / `fresh` behavior with `MoneyAccountBalanceStaleError`. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ee833b1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

metamask-ci Bot requested review from a team as code owners September 25, 2026 15:04

metamask-ci Bot deployed to dependabot September 25, 2026 15:04 Active

metamask-ci Bot deployed to default-branch September 25, 2026 15:04 Active

cryptodev-2s previously approved these changes Sep 25, 2026

View reviewed changes

cryptodev-2s enabled auto-merge September 25, 2026 15:12

cryptodev-2s added this pull request to the merge queue Sep 25, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Sep 25, 2026

metamask-ci Bot dismissed cryptodev-2s’s stale review via 983f19b September 25, 2026 19:04

metamask-ci Bot force-pushed the renovate/ethersproject-providers-5.x branch from 89434a0 to 983f19b Compare September 25, 2026 19:04

metamask-ci Bot deployed to dependabot September 25, 2026 19:04 Active

cryptodev-2s previously approved these changes Sep 26, 2026

View reviewed changes

cryptodev-2s added this pull request to the merge queue Sep 26, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Sep 26, 2026

cryptodev-2s mentioned this pull request Sep 26, 2026

feat: group dependency upgrades by upstream repository #10495

Merged

1 of 4 tasks

fix(deps): update dependency @ethersproject/providers to ^5.8.0

6f6b265

metamask-ci Bot dismissed cryptodev-2s’s stale review via 6f6b265 September 27, 2026 06:16

metamask-ci Bot force-pushed the renovate/ethersproject-providers-5.x branch from 7a69136 to 6f6b265 Compare September 27, 2026 06:16

metamask-ci Bot deployed to dependabot September 27, 2026 06:16 Active

[dependabot skip] chore: add changelog entries for bumped dependencies

7a29773

cryptodev-2s approved these changes Sep 27, 2026

View reviewed changes

cryptodev-2s added this pull request to the merge queue Sep 27, 2026

Merged via the queue into main with commit bd9991a Sep 27, 2026
249 checks passed

cryptodev-2s deleted the renovate/ethersproject-providers-5.x branch September 27, 2026 07:56

ffmcgee725 mentioned this pull request Sep 28, 2026

Release 1294.0.0 #10502

Merged

Navigation Menu

Uh oh!

fix(deps): update dependency @ethersproject/providers to ^5.8.0 - #10482

fix(deps): update dependency @ethersproject/providers to ^5.8.0#10482
cryptodev-2s merged 2 commits into
mainfrom
renovate/ethersproject-providers-5.x

metamask-ci Bot commented Sep 25, 2026 •

edited by cursor Bot

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

metamask-ci Bot commented Sep 25, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

metamask-ci Bot commented Sep 25, 2026 •

edited by cursor Bot

Loading