{ "prNumber": 44797, "prTitle": "release: 13.42.0", "generatedAt": "2026-07-25T01:38:05.291Z", "modelUsed": "gpt-5", "summary": { "totalFilesChanged": 1689, "totalCommitsInRelease": 130, "releaseRiskScore": "61/100", "highRiskScenarios": 8, "mediumRiskScenarios": 5 }, "testScenarios": { "cherryPickScenarios": [ { "area": "Deep Links Interstitial Protection", "riskLevel": "high", "testSteps": [ "1. From the OS or a test app, open a metamask:// deep link that would initiate a connect/sign flow; verify an interstitial appears showing the origin and action summary.", "2. Select Do not proceed and confirm that no permissions are granted, no signing modal opens, and no new connected site is added.", "3. Repeat and choose Proceed; verify the app then shows the standard connect/sign confirmation requiring explicit user approval." ], "whyThisMatters": "Cherry-pick 44830 fixes restoration of deep link interstitial protections; without it, external links could bypass expected user warnings and increase phishing risk." }, { "area": "App Link (https) Deep Links Interstitial", "riskLevel": "high", "testSteps": [ "1. Open an https metamask.app.link deep link that routes to an Add Network or Connect flow inside the extension.", "2. Verify the interstitial appears first, showing the linking origin and intended action, with clear Cancel/Proceed options.", "3. Cancel and confirm no downstream flow is triggered; then retry and Proceed to ensure the normal Add Network/Connect confirmation still appears." ], "whyThisMatters": "Cherry-pick 44830 fixes interstitial gating for web-based deep links; it ensures users cannot be silently funneled into privileged flows without an explicit checkpoint." } ], "initialScenarios": [ { "area": "State Migrations (versions 217–219)", "riskLevel": "high", "testSteps": [ "1. Install the previous stable extension (e.g., 13.41.x), create a wallet with 2 standard accounts and import 1 account via private key; add a custom network via wallet_addEthereumChain; enable token and NFT autodetection.", "2. Manually add a custom ERC-20 with non-18 decimals, import an NFT by contract/tokenId, and connect two different sites (each to a different account). Execute at least one transaction per account on different networks.", "3. Upgrade to 13.42.0, unlock, and allow the extension to complete migrations.", "4. Verify accounts, connected sites, custom network, tokens (including decimals, logos), NFTs (images/metadata), and settings (autodetection) are preserved and functional.", "5. Perform a quick regression: switch networks, send a small test transaction, and open Activity details to ensure no errors/regressions post-migration." ], "whyThisMatters": "State migrations can corrupt or drop user data (accounts, connections, custom networks, token/NFT lists). Verifying upgrade integrity prevents data loss and post-upgrade breakages." }, { "area": "Token Management and Balances (Assets Controller v11)", "riskLevel": "high", "testSteps": [ "1. On Ethereum and a sidechain (e.g., Polygon), enable token autodetection and verify common tokens appear with correct symbols, logos, and balances.", "2. Manually add a custom token with non-18 decimals; confirm balance math and fiat rounding are correct on Home and Activity details.", "3. Hide the token, lock/unlock the wallet, then unhide or re-add it; verify state persistence and no duplicate entries.", "4. Switch to an account with zero balance and confirm balances render as zero without errors or placeholders." ], "whyThisMatters": "A major Assets Controller update can alter token discovery, metadata, and balance calculations. Errors here directly impact asset visibility and user trust in balances." }, { "area": "NFTs (Detection, Metadata, Transfer)", "riskLevel": "high", "testSteps": [ "1. Enable NFT autodetection, then import an NFT by contract address and tokenId; confirm image and metadata load correctly.", "2. Switch to a network where the NFT does not exist and verify it is not shown; return to the original network and ensure it reappears.", "3. Transfer the NFT to another address; verify the transfer flow, Activity entry, and that the NFT leaves the collection after confirmation." ], "whyThisMatters": "NFT handling relies on the same asset plumbing; regressions can break detection, metadata display, or transfers, degrading core wallet functionality for NFT users." }, { "area": "Network Management (Add/Switch via dapp and UI)", "riskLevel": "high", "testSteps": [ "1. From a dapp, request wallet_addEthereumChain for a known test chain; accept and confirm the new network appears and is selected.", "2. From the same dapp, request wallet_switchEthereumChain; verify the prompt, successful switch, and that the site retains permissions and correct account context.", "3. Attempt to add a network with an existing chainId but different RPC; verify the UI informs about the existing network and does not duplicate it." ], "whyThisMatters": "Changes in network enablement can break EIP-3085/EIP-3326 flows, preventing users from onboarding to new chains or causing permission inconsistencies." }, { "area": "Message Encryption/Decryption (eth_getEncryptionPublicKey, eth_decrypt)", "riskLevel": "high", "testSteps": [ "1. Using a test dapp, request eth_getEncryptionPublicKey for the active account; approve and verify the key is returned.", "2. From the dapp, request eth_decrypt for a payload encrypted to the active account; approve and verify the plaintext is returned.", "3. Switch to another account and attempt to decrypt the same payload; verify the UI blocks or errors appropriately and does not leak plaintext." ], "whyThisMatters": "Changes in decrypt/encryption key controllers can break dapp workflows or introduce cross-account data exposure, a significant security risk." }, { "area": "Transaction Signing and Activity Details", "riskLevel": "high", "testSteps": [ "1. Send a native token transaction and open its Activity details; verify status, nonce, EIP-1559 fields, explorer link, and fiat value.", "2. Sign Typed Data v4 from a dapp; verify the confirmation details (domain, message fields) are accurate and the signature returns to the dapp correctly.", "3. Speed up or cancel a pending transaction and confirm the Activity view merges/replaces entries correctly without duplicates." ], "whyThisMatters": "Core transaction flows are sensitive to UI and controller refactors; regressions can lead to incorrect confirmations or broken activity history." }, { "area": "Fiat Conversion and Display Consistency", "riskLevel": "medium", "testSteps": [ "1. Set primary currency to fiat (e.g., USD) and verify token fiat values across Home, Activity list, and transaction detail views.", "2. Switch primary currency to Native and verify all locations update without stale fiat values.", "3. Change conversion currency (e.g., USD to EUR) and confirm values update accurately and consistently throughout the UI." ], "whyThisMatters": "Incorrect fiat conversion or inconsistent rendering undermines decision-making and trust in displayed portfolio values." }, { "area": "Bridge Flow (Quotes, Approvals, Cancellations)", "riskLevel": "medium", "testSteps": [ "1. Open Bridge, select a source/destination network and token (e.g., ETH → USDC), and fetch quotes; verify providers, estimated time, and fees render.", "2. Proceed to approval, then cancel before final submission; confirm no stuck pending approvals or ghost Activity entries.", "3. Try an unsupported token/network pair and verify clear error messaging without crashes." ], "whyThisMatters": "Bridge controller updates can affect quoting, approvals, and cleanup; issues here can strand approvals or mislead users about transfer status." }, { "area": "Connected Sites and Unconnected Account Alert", "riskLevel": "medium", "testSteps": [ "1. Connect a test dapp to Account 1.", "2. Switch the active account to Account 2 and reload the dapp; verify the Unconnected Account alert appears with a Connect action.", "3. Use the Connect action to authorize Account 2; verify the banner disappears and the dapp reflects the new account context." ], "whyThisMatters": "Recent alert and related UI changes can affect safety prompts; missing or incorrect alerts may cause users to transact with unintended accounts." }, { "area": "Alert Modals and Stacking Behavior", "riskLevel": "medium", "testSteps": [ "1. Trigger a confirmation modal (e.g., disconnect a connected site) and keep it open.", "2. While the modal is open, cause a general inline alert (e.g., switch to an invalid RPC network to surface an error banner).", "3. Verify the confirmation modal maintains focus and is actionable, the inline alert does not overlap or block actions, and both can be dismissed independently." ], "whyThisMatters": "Changes in the alert system utilities can break modality and focus management, causing users to get stuck or miss important warnings." }, { "area": "API Error Handling and Recovery (RPC failures)", "riskLevel": "medium", "testSteps": [ "1. Configure a custom network with an invalid RPC URL and switch to it.", "2. Verify that a clear, non-blocking error message appears instead of a crash or infinite loading.", "3. Switch back to a working network and confirm the error state fully clears." ], "whyThisMatters": "Resilience to RPC failures ensures the wallet remains usable and clearly communicates connectivity issues without compromising functionality." } ] } }