[FrederikBolding]

Bump Vitest to latest which resolves a ton of advisories.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​coverage-istanbul@​3.1.1 ⏵ 5.0.5			+12	+2
	@​vitest/​coverage-v8@​3.1.1 ⏵ 5.0.5			+8	+2
	vitest@​3.1.1 ⏵ 5.0.5	+11	+75	+1	+2
	nanoid@​3.3.18 ⏵ 3.3.20			+1
	vite@​6.4.3 ⏵ 6.4.5		+21	+1
	@​vitest/​browser-playwright@​5.0.5

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Priority	Alert  (click "▶" to expand/collapse)	Action
	Network access: npm @vitest/browser-playwright in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/snaps-controllers/package.json → npm/@vitest/browser-playwright@5.0.5 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/browser-playwright@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm vitest in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/snaps-controllers/package.json → npm/vitest@5.0.5 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vitest@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @vitest/browser-playwright Env Vars: PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS Location: Package overview From: packages/snaps-controllers/package.json → npm/@vitest/browser-playwright@5.0.5 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/browser-playwright@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @vitest/browser-playwright reads VITEST_PW_DEBUG Env Vars: VITEST_PW_DEBUG Location: Package overview From: packages/snaps-controllers/package.json → npm/@vitest/browser-playwright@5.0.5 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/browser-playwright@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @vitest/coverage-v8 reads NODE_V8_COVERAGE Env Vars: NODE_V8_COVERAGE Location: Package overview From: packages/snaps-execution-environments/package.json → npm/@vitest/coverage-v8@5.0.5 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/coverage-v8@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm es-module-lexer is 74.0% likely to have a medium risk anomaly Notes: A WebAssembly-backed parser wrapper (package/dist/lexer.js) executes substrings extracted from untrusted input using (0, eval) during parsing, enabling arbitrary JavaScript execution if attacker-controlled data reaches the eval path. The threat also includes potential sensitive data leakage through error messages. Disable parse() on untrusted input or sandbox/replace builds to mitigate this risk. Confidence: 0.74 Severity: 0.78 From: packages/snaps-controllers/package.json → npm/vitest@5.0.5 → npm/es-module-lexer@2.3.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm es-module-lexer is 70.0% likely to have a medium risk anomaly Notes: A WASM-backed parser wrapper copies caller input into WASM memory and conditionally executes eval() on substrings that resemble quoted literals, creating a potential code-execution risk in the calling process. Error messages may include slices of input, increasing the chance of sensitive data exposure; the embedded WASM payload is opaque and could contain additional, unseen behaviors. Confidence: 0.70 Severity: 0.70 From: packages/snaps-controllers/package.json → npm/vitest@5.0.5 → npm/es-module-lexer@2.3.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm obug reads DEBUG Env Vars: DEBUG Location: Package overview From: packages/snaps-controllers/package.json → npm/@vitest/coverage-istanbul@5.0.5 → npm/obug@2.2.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/obug@2.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm obug Location: Package overview From: packages/snaps-controllers/package.json → npm/@vitest/coverage-istanbul@5.0.5 → npm/obug@2.2.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/obug@2.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm vite is 75.0% likely to have a medium risk anomaly Notes: This fragment performs a high-impact global namespace injection driven by a build-time DEFINES object. While not inherently malicious, it creates a significant risk surface: it can override or create global properties, potentially altering security-sensitive behavior. Strong validation, strict namespace scoping, or replacing with a controlled sandbox/namespace approach is recommended to mitigate supply-chain risk. Confidence: 0.75 Severity: 0.60 From: package.json → npm/vite@6.4.5 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@6.4.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm ws is 75.0% likely to have a medium risk anomaly Notes: The code implements a standard EventTarget-like mixin for wrapping event listeners and dispatching events to user callbacks. There are no suspicious patterns such as dynamic code execution, hardcoded secrets, or network activity. The risk is contingent on what the consumer does inside their handlers; the snippet itself does not introduce malware or data leakage mechanisms beyond normal event dispatch. Overall security risk is low in isolation. Confidence: 0.75 Severity: 0.50 From: packages/snaps-controllers/package.json → npm/@vitest/coverage-v8@5.0.5 → npm/@vitest/browser-playwright@5.0.5 → npm/webpack-dev-server@5.2.2 → npm/ws@8.22.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ws@8.22.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm fflate is 70.0% likely to have a medium risk anomaly Notes: This snippet is best characterized as a dynamic Worker code loader/executor. The central risk is that it executes attacker-influenced JavaScript when c is not strictly controlled or validated. While there are no explicit signs of malicious behavior (e.g., network exfiltration endpoints, persistence, credential theft) in the shown fragment, the design inherently enables arbitrary code execution in a Worker context and can leak stack traces via structured error propagation. Treat c as highly sensitive input: enforce strict provenance/allowlisting at the call site and ensure id/c are not attacker-controlled. Recommend also minimizing error detail returned to cb if not needed. Confidence: 0.70 Severity: 0.62 From: packages/snaps-controllers/package.json → npm/vitest@5.0.5 → npm/@vitest/coverage-v8@5.0.5 → npm/@vitest/browser-playwright@5.0.5 → npm/fflate@0.8.3 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fflate@0.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.78%. Comparing base (6fa202a) to head (cdb7bc1).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4168      +/-   ##
==========================================
+ Coverage   98.69%   98.78%   +0.09%     
==========================================
  Files         429      427       -2     
  Lines       12533    11117    -1416     
  Branches     1986     1848     -138     
==========================================
- Hits        12369    10982    -1387     
+ Misses        164      135      -29     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.