{ "prNumber": 44797, "prTitle": "release: 13.42.0", "generatedAt": "2026-07-30T05:27:02.808Z", "modelUsed": "gpt-5", "summary": { "totalFilesChanged": 1284, "totalCommitsInRelease": 140, "releaseRiskScore": "62/100", "highRiskScenarios": 8, "mediumRiskScenarios": 7 }, "testScenarios": { "cherryPickScenarios": [ { "area": "Deep-links - interstitial protection before sensitive actions", "riskLevel": "high", "testSteps": [ "1. Open a MetaMask deep link that triggers a sensitive action (e.g., add network or connect) from the browser.", "2. Verify an interstitial screen appears explaining the action and requiring explicit confirmation.", "3. Select Cancel and confirm no action is taken; re-open the link, Continue, and verify you reach the appropriate confirmation flow." ], "whyThisMatters": "Cherry-pick 44830 fixes restoration of interstitial protection for deep links, preventing unmediated navigation to sensitive flows." }, { "area": "Swaps - destination exchange rate refresh and accuracy", "riskLevel": "high", "testSteps": [ "1. Open Swaps, choose a source token and destination token/network, and get a quote.", "2. Change the destination token or network; verify the destination exchange rate refreshes immediately on the quote and review screens.", "3. Wait at least 60 seconds and navigate back/forward to ensure rates continue updating and no stale values persist before submit." ], "whyThisMatters": "Cherry-pick 45011 fixes stale destination exchange rates that can misprice swaps, risking user loss." }, { "area": "Deep-links - cross-chain asset deeplinks without a matching account", "riskLevel": "medium", "testSteps": [ "1. Use a cross-chain asset deep link referencing an account that is not currently available (e.g., removed/locked secondary account).", "2. Open the link and verify the wallet prompts to select an available account or to add/import instead of failing.", "3. After selection, ensure the asset view or intended destination loads correctly with the chosen account context." ], "whyThisMatters": "Cherry-pick 44913 fixes crashes or dead-ends when a deep link targets a missing account, ensuring a safe fallback and user choice." } ], "initialScenarios": [ { "area": "State Migration (Migration 219) - upgrade with populated vault", "riskLevel": "high", "testSteps": [ "1. Install a previous production build (e.g., 13.41.x), create a wallet with 2 accounts, add a custom network (e.g., Polygon), add 1 ERC-20 token and 1 NFT, and add 2 address book entries.", "2. Upgrade the extension to 13.42.0 without resetting state, then unlock.", "3. Verify both accounts, balances, custom network, tokens, NFTs, and address book entries are preserved.", "4. Export state logs (Settings > Advanced > Download State Logs) and verify migration version indicates 219 and no migration error banners appear." ], "whyThisMatters": "State migrations can corrupt or drop user data; verifying accounts, networks, and assets survive the upgrade guards against data loss." }, { "area": "State Migration (Migration 219) - upgrade while locked", "riskLevel": "high", "testSteps": [ "1. On 13.41.x, lock the wallet with a populated state (multiple accounts, custom network, tokens/NFTs).", "2. Upgrade to 13.42.0 while the wallet is locked.", "3. Unlock and confirm successful decryption, correct account order, and intact seed phrase restore options.", "4. Verify no unexpected reset to onboarding and no missing assets/networks." ], "whyThisMatters": "Upgrading while locked stresses keyring/state initialization paths; failures here can strand users or reset wallets." }, { "area": "Token Management - Assets Controller upgrade (auto detection on/off across networks)", "riskLevel": "high", "testSteps": [ "1. On Mainnet, enable token detection (Settings > Security & privacy or relevant setting) and ensure detection is active.", "2. Add a network like Polygon and switch to it; verify commonly held tokens on that network auto-appear without duplicates.", "3. Disable token detection, remove an auto-detected token, and confirm it is not re-added after refresh or account switch.", "4. Spot-check decimals/symbols for a token with unusual decimals to ensure correct formatting." ], "whyThisMatters": "A major Assets Controller update can affect auto-detection, token metadata accuracy, and duplication across networks." }, { "area": "Token Management - EIP-747 wallet_watchAsset confirmations", "riskLevel": "high", "testSteps": [ "1. From a test dapp, call wallet_watchAsset for an ERC-20 with custom decimals and a long symbol.", "2. Approve the add-token confirmation; verify the token appears with correct symbol, decimals, and logo.", "3. Attempt to add the same token again and reject; verify no duplicate entry is created.", "4. Switch accounts and networks to ensure the token scoping remains correct per account/network." ], "whyThisMatters": "watchAsset flows rely on asset metadata and controller logic; regressions can misrepresent balances or spam users with duplicates." }, { "area": "NFTs - detection/import and metadata media rendering", "riskLevel": "high", "testSteps": [ "1. Import a known ERC-721 or ERC-1155 NFT via contract address and token ID on a supported test network.", "2. Verify image/media loads, attributes display, and collection name is correct on the NFT details screen.", "3. Switch to a different network and confirm the NFT view reflects the network context (no cross-network bleed).", "4. Refresh metadata (if available) and confirm nothing breaks and updated fields render." ], "whyThisMatters": "Assets Controller changes can impact NFT metadata resolution and display; broken media or cross-network bleed confuses users." }, { "area": "Bridge - quote retrieval and transaction creation", "riskLevel": "high", "testSteps": [ "1. Open the Bridge tab and select a source (e.g., Sepolia) and destination network (e.g., Arbitrum Sepolia).", "2. Enter a small amount, fetch quotes, and select a recommended route.", "3. Approve any allowance if prompted, then submit the bridge transaction.", "4. Verify the Activity tab records the bridge, status updates are shown, and destination chain/amounts match the quote." ], "whyThisMatters": "Bridge-controller patch changes can break quoting or transaction building, risking failed or incorrect cross-chain transfers." }, { "area": "Send Flow and Errors - alert system and API error handling", "riskLevel": "medium", "testSteps": [ "1. Attempt a send with insufficient funds; verify a clear error alert/modal appears and can be dismissed.", "2. Temporarily use an invalid RPC URL for the active network and attempt a send; verify the API error surfaces with actionable messaging.", "3. Restore a valid RPC, retry the send, and confirm normal success path and absence of stale error banners." ], "whyThisMatters": "Alert system and error handler updates can hide or misstate failures, leading to mistaken resubmits or user confusion." }, { "area": "Dapp Connections - permissions modal and multi-account selection", "riskLevel": "medium", "testSteps": [ "1. From a dapp, request connection; on the permissions modal, select multiple accounts using the account checkboxes.", "2. Approve and verify the dapp receives all selected accounts and only those accounts.", "3. Open Connected sites in the wallet, add/remove an account for that site, and verify the dapp reflects the updated permissions." ], "whyThisMatters": "UI refactors around permissions can cause mis-selection or incorrect account exposure to sites." }, { "area": "Message Signing - personal_sign and EIP-712 (v4)", "riskLevel": "medium", "testSteps": [ "1. From a test dapp, trigger personal_sign and review the confirmation text for accuracy and domain.", "2. Trigger eth_signTypedData_v4 for structured data; verify all fields and domain separator details are visible.", "3. Approve and verify the dapp can validate both signatures; repeat once with Reject to confirm proper error flow." ], "whyThisMatters": "Controller and confirmation UI changes can affect data rendering or validation, leading to unsafe or incorrect approvals." }, { "area": "Encryption - eth_getEncryptionPublicKey and eth_decrypt", "riskLevel": "medium", "testSteps": [ "1. From a test dapp, request eth_getEncryptionPublicKey for the selected account and approve.", "2. Dapp encrypts a message with the returned key; request eth_decrypt from the wallet and approve.", "3. Confirm the decrypted plaintext matches the original; repeat once with Reject to ensure the correct error message is returned." ], "whyThisMatters": "Even small controller changes can break public key retrieval or decryption confirmations, impacting secure messaging flows." }, { "area": "Activity - list and detail views across themes and sizes", "riskLevel": "medium", "testSteps": [ "1. Generate a mix of activities (send, swap, bridge) and open the Activity tab.", "2. Open details for each activity and verify hash, amounts, network, gas, and status are accurate.", "3. Toggle light/dark theme and resize the window to narrow widths; verify content remains readable and unclipped." ], "whyThisMatters": "Large UI refactors can cause truncation or misaligned details, leading to misinterpretation of transaction outcomes." }, { "area": "Network Management - add and switch via dapp requests", "riskLevel": "medium", "testSteps": [ "1. From a dapp, call wallet_addEthereumChain for a test network; verify the add network confirmation shows accurate details and approve.", "2. Confirm automatic switch to the new network and verify RPC and chain ID are correct in settings.", "3. From the same dapp, call wallet_switchEthereumChain back to the original network and verify the switch and correct asset list context." ], "whyThisMatters": "Controller and UI changes can regress add/switch flows, leading to misconfigured networks or failed dapp connections." } ] } }