Release/974.0.0

[cryptodev-2s]

Explanation

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Primarily dependency/version bumps, but it pulls in breaking major releases of @metamask/controller-utils@12 and @metamask/network-controller@31, which can break downstream typed event listeners and service policy handlers.

Overview
Bumps the monorepo release version to 974.0.0 and rolls forward many internal package versions/changelogs.

Most packages are updated to depend on @metamask/controller-utils@12.0.0 and @metamask/network-controller@31.0.0 (plus related patch bumps like @metamask/message-manager@14.1.2, @metamask/polling-controller@16.0.5, etc.), propagating the new breaking event payload/type changes through the dependency graph.

^{Reviewed by Cursor Bugbot for commit 898f4a8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Network access: npm @metamask/controller-utils in module globalThis["fetch"] Module: globalThis["fetch"] Location:Package overview From:? → npm/@metamask/snaps-controllers@19.0.1 → npm/@metamask/snaps-utils@12.2.0 → npm/@metamask/controller-utils@11.20.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/controller-utils@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Mrtenz]

Looks good to me other than sample-controllers needing a major bump.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 898f4a8. Configure here.}

[cursor]

Minor/patch bumps for major dependency upgrades violate semver

High Severity

@metamask/accounts-controller is bumped from 38.0.0 to 38.1.0 (minor), but its dependency on @metamask/network-controller is bumped from ^30.1.0 to ^31.0.0 (major). Consumers who also depend on @metamask/network-controller@^30.x will face unresolvable version conflicts when upgrading to accounts-controller@38.1.0, since ^30.x and ^31.0.0 are incompatible ranges. The same pattern applies broadly: many packages (gas-fee-controller, polling-controller, ens-controller, earn-controller, multichain-network-controller, etc.) receive only patch/minor bumps while bumping major dependencies on network-controller (^30.x → ^31.0.0) and/or controller-utils (^11.x → ^12.0.0). Per the reviewer's comment, these need to be major bumps.

Additional Locations (1)

• packages/accounts-controller/package.json#L64-L65

^{Reviewed by Cursor Bugbot for commit 898f4a8. Configure here.}