chore: integrate `@metamask/utils` into `packages/` by cryptodev-2s · Pull Request #10185 · MetaMask/core

cryptodev-2s · 2026-09-10T20:37:23Z

Explanation

Phase C of migrating @metamask/utils, following the package migration process guide. This moves the package from merged-packages/ into packages/ and wires it into the monorepo.

merged-packages/utils → packages/utils, registered as a workspace
Reference paths added to the root tsconfig.json, tsconfig.build.json and tsconfig.lint.json
The version bump for dependents is split into a follow up (chore: bump dependents to @metamask/utils@^12.0.0 #10192) to keep this diff reviewable. This PR adds a temporary @metamask/utils entry to ALLOWED_INCONSISTENT_DEPENDENCIES in yarn.config.cjs so constraints pass while dependents are still on the published version; chore: bump dependents to @metamask/utils@^12.0.0 #10192 removes it. The two are meant to land together.
Downstream tsconfig references added via yarn lint:tsconfigs:fix:all (174 files). Without them yarn lint:tsc reported 536 errors; it is now clean
yarn constraints --fix applied, which split the test scripts into test:unit and test:types
CODEOWNERS entry added through codeowners.ts and teams.json, assigning the package to @MetaMask/core-platform as with the other foundational packages
README package list and dependency graph regenerated with yarn readme-content:update

Type tests moved from `tsd` to `tstyche`

The package's type tests import from source (./index.js, ./misc.js), so they never needed built declarations. tsd requires a typings file as a structural precondition regardless, which forced a build purely to satisfy the tool. tstyche type checks source directly and is already used by @metamask/messenger, so the four *.test-d.ts files are now *.tst.ts, with all 120 assertions preserved.

That removed three workarounds: a composite: false override for tsd, a --typings flag, and the *.test-d.ts exclusion in tsconfig.lint.json. That last one existed because tsd's own types pull in lib="esnext", widening built in types like ReadonlySet past this package's target. With that gone the type tests are covered by lint:tsc rather than excluded from it, and tsd leaves the lockfile entirely.

Root tooling now resolves the package from source

Nine files at the repository root import @metamask/utils, which previously arrived prebuilt from npm. As a workspace its dist does not exist until something builds it, and the lint jobs do not build, so constraints, lint:teams and lint:tsconfigs:all all failed on a fresh checkout.

Adding a paths entry to the root tsconfig.json fixes the scripts. yarn.config.cjs is the exception, since Yarn loads it as plain CommonJS where paths do not apply and a .ts file cannot be required. It only used hasProperty, whose runtime body is a single expression, so it now calls Object.hasOwn directly. That is available on every supported Node version.

All of the following pass with no build artifacts present: constraints, lint:teams, lint:tsconfigs:all, readme-content:check, codeowners:check, lint:tsc, lint:misc:check, and the package's own tests.

Inherited lint findings

86 pre-existing findings in the package, mostly no-explicit-any in tests, are recorded in eslint-suppressions.json rather than fixed here, matching how this repo tracks that debt. They came from rules the package's own ESLint config had disabled before the migration.

References

Follows chore: migrate @metamask/utils git history into merged-packages/ #10175, chore: reset the migrated @metamask/utils changelog #10178, chore: remove @metamask/utils files owned by the monorepo root #10179, chore: extend @metamask/utils configs from the monorepo root #10180, chore: align @metamask/utils deps and scripts with the monorepo #10181 and chore: update the @metamask/utils README for the monorepo #10182
Migration process guide: docs/processes/package-migration-process-guide.md

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
Wide monorepo integration touches build graphs and resolution for a foundational dependency; temporary dual resolution (workspace v12 vs published v11) must land with the follow-up bump to avoid inconsistent runtime/types.

Overview
@metamask/utils is now a workspace package at packages/utils (v12.0.0) instead of living under merged-packages/ or npm-only. Repo metadata, CODEOWNERS/teams.json, README list/graph, and root tsconfig project references are updated so the package builds and lints with the rest of core.

Monorepo wiring: Jest and root/script tsconfig paths resolve @metamask/utils (and /node) to TypeScript source so tests and lint work without a prior build. Package tsconfig references to ../utils were added across dependents. tsconfig.packages.json still maps @metamask/utils to published v11 in node_modules until a follow-up bumps dependents; yarn.config.cjs temporarily allows that version skew and drops the @metamask/utils import in favor of Object.hasOwn.

Package tooling: Type tests move from tsd (*.test-d.ts) to tstyche (*.tst.ts); build excludes *.tst.ts. Unused @metamask/utils dependencies are removed from a few packages (e.g. messenger, ai-controllers). Pre-existing ESLint issues in packages/utils are recorded in eslint-suppressions.json. Stale merged-packages/utils type-test and lint config files are removed.

^{Reviewed by Cursor Bugbot for commit dd04556. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-09-10T20:39:08Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/web3@4.16.0
npm/stdio-mock@1.2.0
npm/@metamask/utils@11.12.0 ⏵ 11.12.1	⁺¹	⁺¹	⁺²

View full report

socket-security · 2026-09-10T20:39:10Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Publisher changed: npm `web3-net` is now published by luu-alex instead of mpetrunic New Author: luu-alex Previous Author: mpetrunic From: packages/utils/package.json → `npm/web3@4.16.0` → `npm/web3-net@4.1.0` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-net@4.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Publisher changed: npm `web3-providers-ws` is now published by luu-alex instead of mpetrunic New Author: luu-alex Previous Author: mpetrunic From: packages/utils/package.json → `npm/web3@4.16.0` → `npm/web3-providers-ws@4.0.8` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-providers-ws@4.0.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm `cross-fetch` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/utils/package.json → `npm/web3@4.16.0` → `npm/cross-fetch@4.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/cross-fetch@4.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm `web3-providers-http` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/utils/package.json → `npm/web3@4.16.0` → `npm/web3-providers-http@4.2.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-providers-http@4.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm `web3-providers-ipc` in module net Module: net Location: Package overview From: packages/utils/package.json → `npm/web3@4.16.0` → `npm/web3-providers-ipc@4.0.7` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-providers-ipc@4.0.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `util` reads NODE_DEBUG Env Vars: NODE_DEBUG Location: Package overview From: packages/utils/package.json → `npm/web3@4.16.0` → `npm/util@0.12.5` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/util@0.12.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `web3-rpc-providers` is 72.0% likely to have a medium risk anomaly Notes: No clear indicators of malware/backdoor behavior are present in this module. The main risk is supply-chain secret exposure: multiple hardcoded RPC access tokens are embedded as defaults and are inserted directly into constructed RPC URLs, which can increase accidental credential leakage via logs/telemetry. The request wrapper’s rate-limit mapping is standard and not inherently suspicious. Confidence: 0.72 Severity: 0.64 From: packages/utils/package.json → `npm/web3@4.16.0` → `npm/web3-rpc-providers@1.0.0-rc.4` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-rpc-providers@1.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `web3-rpc-providers` is 70.0% likely to have a medium risk anomaly Notes: No direct malware/backdoor behavior is evident in this fragment; it primarily performs standard JSON-RPC forwarding and rate-limit error translation. The key risk is the presence of hardcoded fallback RPC tokens embedded in getRPCURL for multiple networks, which will be used for outbound authenticated RPC calls when the caller does not provide valid token/host—creating a credible credential exposure/supply-chain risk. Confidence: 0.70 Severity: 0.50 From: packages/utils/package.json → `npm/web3@4.16.0` → `npm/web3-rpc-providers@1.0.0-rc.4` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-rpc-providers@1.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ws` is 75.0% likely to have a medium risk anomaly Notes: The code implements a standard EventTarget-like mixin for wrapping event listeners and dispatching events to user callbacks. There are no suspicious patterns such as dynamic code execution, hardcoded secrets, or network activity. The risk is contingent on what the consumer does inside their handlers; the snippet itself does not introduce malware or data leakage mechanisms beyond normal event dispatch. Overall security risk is low in isolation. Confidence: 0.75 Severity: 0.50 From: packages/assets-controllers/package.json → `npm/@docusaurus/core@3.10.1` → `npm/@docusaurus/preset-classic@3.10.1` → `npm/jest-environment-jsdom@30.4.1` → `npm/web3@4.16.0` → `npm/ws@8.21.3` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ws@8.21.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `zod` is 90.0% likely to have a medium risk anomaly Notes: No explicit network exfiltration, reverse shell, or credential theft is present in this fragment. However, the code assembles and compiles arbitrary code via the Function constructor and invokes passed-in functions immediately (twice). That behavior constitutes a strong dangerous primitive (arbitrary code execution) which can be abused if any inputs (strings or args) are attacker-controlled. Treat this module as risky in threat models where inputs are not fully trusted; review call sites and sanitize/validate inputs or avoid dynamic evaluation. Confidence: 0.90 Severity: 0.60 From: packages/utils/package.json → `npm/web3@4.16.0` → `npm/zod@3.25.76` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/zod@3.25.76`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

mcmire · 2026-09-10T22:09:58Z

    "@metamask/network-controller": "^37.0.0",
    "@metamask/superstruct": "^3.4.1",
-    "@metamask/utils": "^11.12.0",
+    "@metamask/utils": "^12.0.0",


Hmm, this bumps to 12.0.0 at the same time. Should we do that in a separate PR?

Yes because the local version is 12 now

I am investigating the split... as it looks like the scope did grow up

@mcmire this has now been splited into two PRs stacked

mcmire · 2026-09-10T22:10:28Z

-    "test:verbose": "NODE_OPTIONS=--experimental-vm-modules jest --verbose",
+    "test": "yarn test:unit && yarn test:types",
+    "test:clean": "yarn test:unit:clean && yarn test:types",
+    "test:types": "tstyche",


This bumps to tstyche at the same time. Should we do that in a separate PR?

Normally yes, but tsd can't work here. The package test job runs yarn workspace <pkg> run test with no build step, and tsd requires a built typings file even though these tests import from source, so CI would fail.

It worked in the utils repo because test:types ran inside the build job right after yarn build, while the test job only ran test:source. Here both halves run in one job that never builds, and constraints mandate test = test:unit && test:types, so splitting them across jobs isn't an option either.

Doing the swap separately would also mean landing three tsd workarounds and reverting them right after: composite: false, --typings ./dist/index.d.ts, and excluding *.test-d.ts from tsconfig.lint.json.

I should have done this in the old utils repo, but I have missed this one

Yeah in the future I think we should basically do everything we can in the source repo to match core before moving it over to core. I believe that's the intended goal of the package migration guide.

mcmire · 2026-09-10T22:12:08Z

    "@typescript-eslint/naming-convention": {
      "count": 1
    }
+  },


Oof 😬 Maybe we should have another PR that fixes these type errors? Ideally we shouldn't introduce the package with a bunch of suppressions.

Yes definitely I was planning to follow up on these, without growing the scope here

Again, it might have been better to address these in the utils repo before moving over to core.

mcmire · 2026-09-10T22:13:24Z

@@ -5,7 +5,11 @@
   */
  "extends": "./tsconfig.base.json",
  "compilerOptions": {
-    "noEmit": true
+    "noEmit": true,
+    "paths": {


Hmm, why is this necessary? TypeScript should be able to find the exports we've defined in utils's package.json.

Because they are used by scripts, and otherwise lint:teams was failing, it looks like tsconfig.scripts.json is there but not used after all.
This configuration is intended for the scripts/ directory... It's currently not actually used for that purpose, but it will be in a future PR.

Ah, strange, okay. It's okay for now. I wonder if a good way to fix this would be to make create-package a private package, then move all scripts that aren't create-package into a second private package. Then we "shouldn't" need a separate tsconfig.scripts.json. Maybe we can worry about that later though.

mcmire · 2026-09-11T13:33:44Z

      "path": "../profile-sync-controller/tsconfig.build.json"
+    },
+    {
+      "path": "../utils/tsconfig.build.json"


We don't need to modify the tsconfig.json and tsconfig.build.json across packages until we upgrade packages to 12.0.0, right?

Oh, hmm, it seems that lint:tsconfigs doesn't realize that we aren't depending on the workspace version of utils. Okay. This is alright I guess, there's no harm in including these.

The docs are explicit on doing this in one PR https://github.com/MetaMask/core/blob/main/docs/processes/package-migration-process-guide.md#1-move-the-migration-target-directory-from-merged-packages-into-packages
The split though was done here because they would both be merged at once but the review will be a bit easier

Oh I see, I forgot about that, thank you.

mcmire · 2026-09-11T13:34:09Z

-  "references": []
+  "references": [
+    {
+      "path": "../utils/tsconfig.lint.json"


Same goes for tsconfig.lint.json files — we shouldn't need to modify these yet right?

Never mind, I guess this is necessary :)

mcmire

LGTM.

Step D-3 of the [package migration process](https://github.com/MetaMask/core/blob/main/docs/processes/package-migration-process-guide.md). `@metamask/utils` now lives in the core monorepo ([MetaMask/core#10185](MetaMask/core#10185) moved it, [MetaMask/core#10192](MetaMask/core#10192) bumped the dependents), so this swaps the "migration in progress" notice for the archived one from the guide. Open issues have been transferred to core and the remaining open PRs are commented and locked. Archiving the repo is the next step.  --- > [!NOTE] > **Low Risk** > Documentation-only README change with no runtime or dependency impact. > > **Overview** > Updates the **README** migration banner for package migration step D-3: it no longer warns that migration is in progress or asks contributors to reopen PRs in **core**, and instead states that **`@metamask/utils`** has moved to the [**MetaMask/core**](https://github.com/MetaMask/core) monorepo, **this repo is archived**, and all future work should happen in **core**. > > The notice is also reformatted from a single-line HTML table into a multi-line layout; installation and API content are unchanged. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 13e0cdd. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

## Explanation Follow up to MetaMask#10185, which moved `@metamask/utils` into `packages/`. This bumps its dependents to the local version. - `@metamask/utils` bumped from `^11.12.0` to `^12.0.0` in 79 packages and the root - Removes the temporary `@metamask/utils` entry from `ALLOWED_INCONSISTENT_DEPENDENCIES` in `yarn.config.cjs`, which MetaMask#10185 added so that constraints would pass while the dependents were still on the published version - Changelog entries recorded for the bump, plus the lockfile dedupe and README dependency graph that follow from it These two PRs are meant to land together, so the intermediate state where dependents still resolve the published copy never reaches `main`. Splitting it this way keeps MetaMask#10185 reviewable: the move, the config rewiring and the type test change are separate from 79 mechanical version bumps. ## References - Follows MetaMask#10185 ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  --- > [!NOTE] > **Medium Risk** > A major-version bump of a shared utility touches most packages; runtime risk is low if v12 is compatible, but consumers and lingering v11 transitive deps (keyring) can cause type or duplicate-package issues until fully aligned. > > **Overview** > This PR aligns the monorepo with the in-repo **`@metamask/utils` v12** after it was moved into `packages/` (follow-up to MetaMask#10185). **79 packages** plus the root bump the dependency from **`^11.12.0` to `^12.0.0`**, with matching **Unreleased changelog** entries and an updated **README dependency graph**. > > Tooling is cleaned up so builds use the workspace package instead of the published copy: **`tsconfig.packages.json`** now maps `@metamask/utils` to local source (the temporary `node_modules` override is removed), and **`yarn.config.cjs`** drops the **`ALLOWED_INCONSISTENT_DEPENDENCIES`** exception for `@metamask/utils`. > > There are small TypeScript follow-ups from the version split: **`network-controller`** removes a stale `@ts-expect-error` on Infura middleware now that types match v12, while **`keyring-controller`** adds a documented `@ts-expect-error` when casting legacy keyrings until **`@metamask/keyring-utils`** also depends on v12. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 8bd8970. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

cryptodev-2s added this pull request to stack #10183 September 10, 2026 20:37

cryptodev-2s changed the title ~~chore/utils integrate~~ chore: integrate @metamask/utils into packages/ Sep 10, 2026

cryptodev-2s marked this pull request as ready for review September 10, 2026 21:35

cryptodev-2s requested review from a team as code owners September 10, 2026 21:35

cryptodev-2s deployed to default-branch September 10, 2026 21:36 — with GitHub Actions Active

cryptodev-2s force-pushed the chore/utils-integrate branch from 949785c to 0a5e81f Compare September 10, 2026 21:40

cryptodev-2s self-assigned this Sep 10, 2026

mcmire reviewed Sep 10, 2026

View reviewed changes

Base automatically changed from chore/utils-readme to main September 11, 2026 09:58

cryptodev-2s force-pushed the chore/utils-integrate branch 2 times, most recently from 53f7cf3 to e93a2b8 Compare September 11, 2026 10:47

cryptodev-2s mentioned this pull request Sep 11, 2026

chore: bump dependents to @metamask/utils@^12.0.0 #10192

Merged

4 tasks

cryptodev-2s removed this pull request from stack #10183 September 11, 2026 10:54

cryptodev-2s added this pull request to stack #10193 September 11, 2026 10:55

cryptodev-2s force-pushed the chore/utils-integrate branch 4 times, most recently from 3718029 to 03b72a3 Compare September 11, 2026 12:50

cryptodev-2s requested a review from mcmire September 11, 2026 13:10

mcmire reviewed Sep 11, 2026

View reviewed changes

mcmire approved these changes Sep 11, 2026

View reviewed changes

cryptodev-2s added this pull request to the merge queue Sep 11, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Sep 11, 2026

cryptodev-2s added 6 commits September 11, 2026 15:53

chore: integrate @metamask/utils into packages

4a0cbf3

chore: replace tsd with tstyche for @metamask/utils type tests

b907644

chore: resolve @metamask/utils from source in root tooling

b89ce2b

fix: resolve downstream errors from the utils integration

6ddab76

chore: defer the dependent version bumps to a follow up

1bc3923

chore: document the removed @metamask/utils dependencies

dd04556

cryptodev-2s force-pushed the chore/utils-integrate branch from 7698097 to dd04556 Compare September 11, 2026 13:53

cryptodev-2s added this pull request to the merge queue Sep 11, 2026

Merged via the queue into main with commit efc97e8 Sep 11, 2026
336 of 338 checks passed

cryptodev-2s deleted the chore/utils-integrate branch September 11, 2026 14:15

This was referenced Sep 11, 2026

docs: announce the migration to core and the archival MetaMask/utils#340

Merged

[utils] Drop the web3 devDependency and replace the differential unit conversion test #10212

Open

Uh oh!

Uh oh!

Conversation

cryptodev-2s commented Sep 10, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Type tests moved from tsd to tstyche

Root tooling now resolves the package from source

Inherited lint findings

References

Checklist

Uh oh!

socket-security Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mcmire Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mcmire Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cryptodev-2s commented Sep 10, 2026 •

edited by cursor Bot

Loading

Type tests moved from `tsd` to `tstyche`

socket-security Bot commented Sep 10, 2026 •

edited

Loading

socket-security Bot commented Sep 10, 2026 •

edited

Loading

cryptodev-2s Sep 11, 2026 •

edited

Loading

mcmire Sep 11, 2026 •

edited

Loading

cryptodev-2s Sep 11, 2026 •

edited

Loading

mcmire Sep 11, 2026 •

edited

Loading