bump: `snap-sdk` to `12.0.1` + `snap-utils` to `12.6.0 ` + `keyring-api` to `24.1.0` + `snaps-execution-environments` to `11.3.0` + `metamask/snaps-jest` to `10.2.1` + `metamask/keyring-snap-sdk` to `10.0.0` by stanleyyconsensys · Pull Request #214 · MetaMask/internal-snaps

stanleyyconsensys · 2026-08-27T01:38:32Z

Explanation

This PR bumps

snap-sdk from 11.2.0 to 12.0.1
- it is a breaking change from snap-sdk, as it requires kerying api 24.1.0+
- it will start to pass the Origin metadata to keyring api submit request, but none of our validation is blocking it, so it is safe to bump
snap-utils from 12.4.0 to 12.6.0
kerying api from 23.7.0 to 24.1.0
- it is a breaking change from kerying api, as it drop node version support 20 and 18
- Client already support that version, safe to bump
snaps-execution-environments from 11.2.0 to 11.3.0
metamask/snaps-jest 10.2.0 to 10.2.1
metamask/keyring-snap-sdk 9.2.1 to 10.0.0

With those bumps, they add

support PrivateKeyEncoding with base32 (It will be used for Stellar Private Key Export)
support for the optional originMetadata property to all handlers that also support origin

Test bump PR on client

MetaMask/metamask-extension#45822

References

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

socket-security · 2026-08-27T01:39:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@metamask/keyring-api@24.1.0
@metamask/keyring-snap-sdk@10.0.0
@metamask/snaps-jest@10.2.0 ⏵ 10.2.1	⁺¹
@metamask/snaps-sdk@11.2.0 ⏵ 12.0.1		⁺¹	^-1

View full report

stanleyyconsensys · 2026-08-27T02:47:51Z

@metamaskbot publish-preview

github-actions · 2026-08-27T02:50:54Z

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.

@metamask-previews/bitcoin-wallet-snap@2.0.1-preview-2f88e92
@metamask-previews/snap-networks-utils@1.0.0-preview-2f88e92
@metamask-previews/solana-wallet-snap@6.0.0-preview-2f88e92
@metamask-previews/stellar-wallet-snap@0.1.0-preview-2f88e92
@metamask-previews/tron-wallet-snap@3.1.0-preview-2f88e92

stanleyyconsensys · 2026-08-27T03:02:27Z

+    "@metamask/snaps-sdk": "12.0.1",
+    "@metamask/snaps-utils": "12.6.0",


resolve snaps-utils to 12.6.0 to enable PK export with base32

resolve snaps-sdk to 12.0.1 to enable PK export with base32

resolve metamask/snaps-execution-environments to 11.3.0 to align the snap sdk

stanleyyconsensys · 2026-08-27T03:03:43Z

    "snap_getPreferences": {}
  },
-  "platformVersion": "11.2.0",
+  "platformVersion": "12.0.1",


when we build the snap,
it may appear a warning ,
but soon will be resolved, as Snap team will update the client

The specified platform version "12.0.1" is not supported in the production version of MetaMask. The current maximum supported version is "12.0.0". To resolve this, downgrade `@metamask/snaps-sdk` to a compatible version.

Copilot

Pull request overview

This PR updates the monorepo’s Snap dependencies to newer @metamask/snaps-sdk / @metamask/snaps-utils versions and bumps the Snap manifest platformVersion/shasum for the affected wallet snaps to align with the new SDK release.

Changes:

Bump @metamask/snaps-sdk to 12.0.1 and @metamask/snaps-utils to 12.6.0 (via root resolutions + yarn.lock).
Update platformVersion to 12.0.1 and refresh shasum in multiple Snap manifests.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`package.json`	Pins `@metamask/snaps-sdk` / `@metamask/snaps-utils` via Yarn `resolutions`.
`yarn.lock`	Updates lock entries to resolve `@metamask/snaps-sdk@12.0.1` and `@metamask/snaps-utils@12.6.0`.
`packages/bitcoin-wallet-snap/snap.manifest.json`	Updates bundle `shasum` and `platformVersion` to `12.0.1`.
`packages/solana-wallet-snap/snap.manifest.json`	Updates bundle `shasum` and `platformVersion` to `12.0.1`.
`packages/stellar-wallet-snap/snap.manifest.json`	Updates bundle `shasum` and `platformVersion` to `12.0.1`.
`packages/tron-wallet-snap/snap.manifest.json`	Updates bundle `shasum` and `platformVersion` to `12.0.1`.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

package.json:88

resolutions pins @metamask/snaps-sdk to 12.0.1, but the lockfile still shows multiple transitive packages declaring @metamask/snaps-sdk dependencies as ^11.x (e.g. @metamask/snaps-jest depends on npm:^11.2.0 at yarn.lock:3517, and @metamask/snaps-controllers depends on npm:^11.1.1 at yarn.lock:3464). Forcing a major version outside dependents’ semver ranges via resolutions can mask real incompatibilities; it’s usually safer to bump those dependent @metamask/* packages to versions that explicitly support snaps-sdk 12 (or drop the resolution if it’s no longer needed).

    "@metamask/snaps-execution-environments": "11.2.0",
    "@metamask/snaps-sdk": "12.0.1",
    "@metamask/snaps-utils": "12.6.0",

stanleyyconsensys · 2026-08-27T04:15:31Z

    "@metamask/snaps-cli": "^8.4.1",
-    "@metamask/snaps-jest": "^10.2.0",
-    "@metamask/snaps-sdk": "^11.2.0",
+    "@metamask/snaps-jest": "^10.2.1",


update metamask/snaps-jest to 10.2.1 is to align the snap sdk

stanleyyconsensys · 2026-08-27T04:16:11Z

@metamaskbot publish-preview

socket-security · 2026-08-27T04:18:42Z

Warning

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm `@metamask/snaps-simulation` is 62.0% likely to have a medium risk anomaly Notes: The fragment is primarily an orchestration layer for installing/executing MetaMask Snaps and registering internal RPC/action handlers. The main high-impact risk signals are (1) direct execution of snap source code obtained from fetchSnap(), and (2) sensitive key material derivation (mnemonic/seed) from options.secretRecoveryPhrase in a clearly labeled 'withKeyringV2Unsafe' handler that passes mnemonic+seed into an externally provided operation callback. Additionally, SnapController:getSnapFile forwards caller-controlled path/encoding to getSnapFile(auxiliaryFiles, ...)—which could enable unintended file access depending on that helper’s validation. No clear malicious exfiltration or obfuscation is visible in this snippet alone. Confidence: 0.62 Severity: 0.58 From: packages/bitcoin-wallet-snap/package.json → `npm/@metamask/snaps-jest@10.2.1` → `npm/@metamask/snaps-simulation@4.3.1` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@metamask/snaps-simulation@4.3.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-08-27T04:19:21Z

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.

@metamask-previews/bitcoin-wallet-snap@2.0.1-preview-44c9de6
@metamask-previews/snap-networks-utils@1.0.0-preview-44c9de6
@metamask-previews/solana-wallet-snap@6.0.0-preview-44c9de6
@metamask-previews/stellar-wallet-snap@0.1.0-preview-44c9de6
@metamask-previews/tron-wallet-snap@3.1.0-preview-44c9de6

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

package.json:88

resolutions pins @metamask/snaps-sdk to 12.0.1, but the lockfile still includes dependencies that declare @metamask/snaps-sdk: npm:^11.x (e.g. @metamask/account-tree-controller). This forces those packages to run against a major version outside their declared compatibility range, which is a high risk for runtime/type breakage; consider upgrading those transitive packages to versions compatible with Snaps SDK v12 (or avoid forcing a global resolution if they cannot be upgraded yet).

  "resolutions": {
    "@metamask/snaps-execution-environments": "11.3.0",
    "@metamask/snaps-sdk": "12.0.1",
    "@metamask/snaps-utils": "12.6.0",

FrederikBolding · 2026-08-27T08:35:49Z

-    "@metamask/snaps-execution-environments": "11.2.0",
-    "@metamask/snaps-sdk": "11.2.0",
+    "@metamask/snaps-execution-environments": "11.3.0",
+    "@metamask/snaps-sdk": "12.0.1",


Why is a resolution needed?

good catch, i think we dont need to resolve the metamask/snaps-sdk

for metamask/snaps-execution-environments may still need?

I don't understand why you would need it for any of the packages

oh actually it need
snap cli 8.4.1 is using metamask/snaps-sdk 10.4.0

Hmm, I would bump the CLI eventually, but you can do a resolution for now I guess

snaps-execution-environments is becoz

asset controller -> account tree controlller -> snaps-execution-environments

FrederikBolding · 2026-08-27T08:36:58Z

    "snap_getPreferences": {}
  },
-  "platformVersion": "11.2.0",
+  "platformVersion": "12.0.1",


Updating this will now pass originMetadata to the keyring Snaps, we should double check that there is no validation preventing this. If we are using only keyring-api for validation, then we should be good.

verified Safe for all snap

Julink-eth · 2026-08-28T09:01:52Z

Is there a reason we are not bumping @metamask/keyring-snap-sdk also ? (Since it depends on the @metamask/keyring-api 24 that is bumped in this PR)

stanleyyconsensys · 2026-08-28T09:17:50Z

@Julink-eth keyring API is peer dependency of keyring-snap-sdk

so keyring-snap-sdk doesnt need to bump

…snaps into bump/snap-sdk

chore: bump snap sdk

2580da2

stanleyyconsensys requested review from a team as code owners August 27, 2026 01:38

stanleyyconsensys deployed to default-branch August 27, 2026 01:38 — with GitHub Actions Active

chore: update shasum

2f88e92

stanleyyconsensys added the no-changelog label Aug 27, 2026

stanleyyconsensys requested a lite review from Copilot August 27, 2026 03:01

Copilot started reviewing on behalf of stanleyyconsensys August 27, 2026 03:01 View session

stanleyyconsensys commented Aug 27, 2026

View reviewed changes

Copilot AI reviewed Aug 27, 2026

View reviewed changes

Comment thread package.json

Comment thread package.json

Comment thread packages/bitcoin-wallet-snap/snap.manifest.json

stanleyyconsensys added 3 commits August 27, 2026 11:10

chore: update version

9eb1740

chore: update platformVersion

5097eaf

chore: update keyring version

5402d9b

stanleyyconsensys changed the title ~~chore: bump snap-sdk to 12.0.1 + bump snap-utils to 12.6.0~~ chore: bump snap-sdk to 12.0.1 + bump snap-utils to 12.6.0 + bump keyring-api to 24.1.0 Aug 27, 2026

stanleyyconsensys changed the title ~~chore: bump snap-sdk to 12.0.1 + bump snap-utils to 12.6.0 + bump keyring-api to 24.1.0~~ bump: snap-sdk to 12.0.1 + snap-utils to 12.6.0 + keyring-api to 24.1.0 Aug 27, 2026

chore: update shasum

b36fa8f

stanleyyconsensys requested a lite review from Copilot August 27, 2026 03:21

Copilot started reviewing on behalf of stanleyyconsensys August 27, 2026 03:22 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

chore: bump more package

44c9de6

stanleyyconsensys commented Aug 27, 2026

View reviewed changes

stanleyyconsensys requested a lite review from Copilot August 27, 2026 04:15

Copilot started reviewing on behalf of stanleyyconsensys August 27, 2026 04:16 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

Comment thread package.json

jeremytsng previously approved these changes Aug 27, 2026

View reviewed changes

FrederikBolding reviewed Aug 27, 2026

View reviewed changes

Merge branch 'main' into bump/snap-sdk

f70542e

stanleyyconsensys dismissed jeremytsng’s stale review via f70542e August 28, 2026 02:37

stanleyyconsensys added 3 commits August 28, 2026 10:42

chore: update shasum

fa54740

chore: add change log

060d142

chore: update change log

9273c63

stanleyyconsensys removed the no-changelog label Aug 28, 2026

chore: update change log

7e5dd77

stanleyyconsensys added 2 commits August 28, 2026 17:17

Merge branch 'main' into bump/snap-sdk

ac06bc2

chore: update snap sdk

8af3d98

Merge branch 'bump/snap-sdk' of https://github.com/MetaMask/internal-…

07fb687

…snaps into bump/snap-sdk

		"@metamask/snaps-sdk": "12.0.1",
		"@metamask/snaps-utils": "12.6.0",

Uh oh!

Conversation

stanleyyconsensys commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

This PR bumps

With those bumps, they add

Test bump PR on client

References

Checklist

Uh oh!

socket-security Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stanleyyconsensys commented Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

stanleyyconsensys Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stanleyyconsensys Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stanleyyconsensys commented Aug 27, 2026

Uh oh!

socket-security Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Julink-eth commented Aug 28, 2026

Uh oh!

stanleyyconsensys commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

stanleyyconsensys commented Aug 27, 2026 •

edited

Loading

socket-security Bot commented Aug 27, 2026 •

edited

Loading

stanleyyconsensys Aug 27, 2026 •

edited

Loading

stanleyyconsensys Aug 27, 2026 •

edited

Loading

socket-security Bot commented Aug 27, 2026 •

edited

Loading

stanleyyconsensys commented Aug 28, 2026 •

edited

Loading