{ "prNumber": 44797, "prTitle": "release: 13.42.0", "generatedAt": "2026-07-24T20:34:46.264Z", "modelUsed": "gpt-5", "summary": { "totalFilesChanged": 1689, "totalCommitsInRelease": 129, "releaseRiskScore": "66/100", "highRiskScenarios": 10, "mediumRiskScenarios": 3 }, "testScenarios": { "cherryPickScenarios": [ { "area": "Security – Deep-link interstitial protection", "riskLevel": "high", "testSteps": [ "1. From a web page, click a MetaMask deep link that initiates a sensitive action (e.g., add network or signature request).", "2. Verify an interstitial/warning screen appears before the action, showing origin/context and options to Cancel/Continue.", "3. Choose Cancel and confirm the extension does not proceed to any permission or signing prompt.", "4. Retry and choose Continue; verify the expected MetaMask confirmation screen opens and functions normally." ], "whyThisMatters": "Cherry-pick 44830 fixes a regression that removed interstitial protection for deep links; without it, malicious links could trigger wallet prompts without user awareness." }, { "area": "Activity – transaction details width/overflow", "riskLevel": "medium", "testSteps": [ "1. Open a transaction in Activity with long addresses and method data on a small viewport.", "2. Verify fields wrap correctly with no horizontal scrolling or clipped buttons (e.g., Copy, View on Explorer).", "3. Resize the window and confirm the layout remains readable and interactive." ], "whyThisMatters": "Cherry-pick 44856 fixes transaction details width issues; without it, users may miss critical info or misclick actions in the Activity panel." } ], "initialScenarios": [ { "area": "State Migration (217–219) – vault, accounts, permissions", "riskLevel": "high", "testSteps": [ "1. Start on 13.40.x or 13.41.x profile with: 2 HD accounts, 1 imported private key account, 1 hardware account; at least 2 connected sites (on Mainnet and a custom network).", "2. Upgrade to 13.42.0 and unlock the wallet.", "3. Verify all accounts are present (names, ordering), ensure each previously connected site remains connected to the same accounts.", "4. Open a previously added custom network and confirm RPC/Chain ID are intact and switching succeeds.", "5. Confirm no repeated seed phrase prompts or unexpected logout; extension idle/opening has no crash or blank screen." ], "whyThisMatters": "Multiple new migrations (217–219) can corrupt or drop critical state (accounts, permissions, networks) if ordering or shape assumptions changed." }, { "area": "State Migration (217–219) – tokens, NFTs, activity history", "riskLevel": "high", "testSteps": [ "1. Before upgrade, ensure profile has: auto token detection ON, at least 2 imported ERC-20s (e.g., USDC/DAI), and 1–2 NFTs (ERC-721 and ERC-1155).", "2. Upgrade to 13.42.0 and open the Assets and NFTs tabs for multiple accounts.", "3. Verify custom tokens still appear with correct symbols/decimals and balances; fiat conversion shows for detected tokens.", "4. Verify NFTs render images/metadata, collection names, and item counts; activity history still lists past transactions.", "5. Open a past transaction detail and confirm data fields are readable and not truncated." ], "whyThisMatters": "Migrations touching asset state can orphan tokens/NFTs or break activity history, directly impacting user trust and balances visibility." }, { "area": "Token Management – Assets Controller v11 upgrade (watchAsset, detection, fiat pricing)", "riskLevel": "high", "testSteps": [ "1. On Mainnet, toggle Token Detection OFF; import a known ERC-20 by contract address and verify symbol/decimals populate correctly.", "2. Toggle Token Detection ON; confirm popular tokens auto-appear without duplicates.", "3. From a dapp, request wallet_watchAsset for a token; approve and verify the token appears exactly once with fiat price.", "4. Switch fiat currency in settings; check token fiat values update accordingly.", "5. Remove the watched token and confirm balances/fiat recompute without residual entries." ], "whyThisMatters": "A major Assets Controller change can break watchAsset flows, auto-detection, and pricing—core to portfolio accuracy." }, { "area": "Transaction Confirmation – EIP-1559 gas editing and submission", "riskLevel": "high", "testSteps": [ "1. Send a small ETH transfer on Mainnet to a fresh address and open the confirmation screen.", "2. Open gas edit (Advanced), change Max Fee/Max Priority, save.", "3. Submit the transaction; monitor Activity until confirmation.", "4. Verify the transaction receipt reflects edited gas values.", "5. Repeat once using the basic gas presets to ensure both editors work." ], "whyThisMatters": "Widespread UI updates can regress confirmation flows and gas editing, risking failed or overpaid transactions." }, { "area": "Swaps – quotes, approval, execution", "riskLevel": "high", "testSteps": [ "1. Initiate a token-to-token swap (e.g., ETH -> DAI) with a modest amount and request quotes.", "2. Select a quote; if approval is required, complete the allowance approval and proceed.", "3. Submit the swap and wait for completion.", "4. Verify post-swap balances, allowance changes, and Activity entries.", "5. Trigger a low-liquidity/small slippage case to confirm proper validation and errors." ], "whyThisMatters": "Token metadata and UI refactors can disrupt the Swaps funnel (approvals/quotes), risking failed trades or wrong balance updates." }, { "area": "Message Signing – personal_sign and eth_signTypedData_v4", "riskLevel": "high", "testSteps": [ "1. From a test dapp, request personal_sign and review the confirmation; verify domain/origin and message text.", "2. Sign the message and verify the dapp validates the signature.", "3. Request eth_signTypedData_v4 with EIP-712 content; review structured data display and domain separator.", "4. Cancel a subsequent request and ensure the dapp receives a proper rejection error.", "5. Confirm no unexpected warnings or blank screens during either flow." ], "whyThisMatters": "UI changes can break or misrepresent signing prompts, exposing users to phishing or incorrect consent." }, { "area": "Encryption APIs – getEncryptionPublicKey and eth_decrypt", "riskLevel": "high", "testSteps": [ "1. From a test dapp, request eth_getEncryptionPublicKey; confirm and expose the key.", "2. Have the dapp encrypt a message with the returned key and request eth_decrypt.", "3. Approve the decryption and verify the plaintext matches the original.", "4. Repeat once with Cancel to ensure proper rejection handling and no stale prompts." ], "whyThisMatters": "Small controller changes to decrypt-message/encryption key paths can silently break privacy-preserving flows dapps rely on." }, { "area": "Network Management – add/switch chain via dapp", "riskLevel": "high", "testSteps": [ "1. From a dapp, trigger wallet_addEthereumChain for a new custom network; review and approve.", "2. Verify the new network appears with correct name/RPC/Chain ID and becomes active.", "3. From the same dapp, trigger wallet_switchEthereumChain to another known chain; approve and ensure active network updates.", "4. Retry both flows with Cancel and confirm the network list remains unchanged." ], "whyThisMatters": "Network controller and UI changes risk incorrect chain setup/switching, leading to failed dapp interactions." }, { "area": "Alert System – unconnected account banner and multi-alert handling", "riskLevel": "high", "testSteps": [ "1. Open a site connected to Account A, then switch the active account in the extension to Account B.", "2. Verify an 'unconnected account' alert appears and provides a clear Connect action.", "3. Trigger an additional alert (e.g., low balance or RPC error) and confirm alerts stack without overlapping critical actions.", "4. Dismiss alerts individually and ensure the correct one closes without UI shift breakage." ], "whyThisMatters": "Alert system refactors can hide or misprioritize critical warnings, leading to accidental actions with the wrong account." }, { "area": "Activity View – details readability and copy controls", "riskLevel": "medium", "testSteps": [ "1. Open Activity for an account with multiple transactions and select one with long addresses/data.", "2. Inspect the details panel for truncation/overflow; validate all key fields are readable.", "3. Use copy buttons for hash and address; confirm clipboard contents are accurate.", "4. Resize the window to a smaller viewport and re-check layout." ], "whyThisMatters": "Numerous UI updates can degrade transaction detail readability, hurting user ability to audit past actions." }, { "area": "API Error Handling – Send and Swap failures", "riskLevel": "medium", "testSteps": [ "1. Attempt to Send more ETH than the account balance and observe inline validation and disabled submit.", "2. On Swaps, simulate an invalid quote (e.g., extreme slippage) and confirm descriptive error messages are shown.", "3. Ensure closing/retrying clears errors and the UI recovers without stale states." ], "whyThisMatters": "The API error handler changed; poor surfacing of RPC/validation errors can lead to user confusion and repeated failures." } ] } }