feat: bump @metamask/eip-5792-middleware to ^3.0.4

[jiexi]

Description

Bump @metamask/eip-5792-middleware to ^3.0.4

Changelog

CHANGELOG entry: null

Please ping with any questions

Related issues

Fixes:

Manual testing steps

1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Updates EIP-5792 request handling to use origin-scoped permitted accounts, which can affect which accounts dapps see/use for wallet_sendCalls/capabilities. Dependency bump pulls in newer transaction/controller utils versions, so behavior changes are possible even though the surface-area diff is small.

Overview
Bumps @metamask/eip-5792-middleware from ^2.0.0 to ^3.0.4 (with updated lockfile).

Updates the EIP-5792 RPC wiring so wallet_getCapabilities and wallet_sendCalls derive accounts via getPermittedAccounts(origin) rather than listing all accounts, aligning these methods with the permissions system; the unit test is adjusted accordingly.

Cleans up INTERNAL_ORIGINS by filtering out falsy entries to avoid leaking undefined origins into internal-origin checks.

^{Reviewed by Cursor Bugbot for commit c1b28e2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​metamask/​eip-5792-middleware@​2.0.0 ⏵ 3.0.4			+1	+1

View full report

[adonesky1]

🤔 ok sure

[jiexi]

Cursor bot complaining that process.env.MM_FOX_CODE could be undefined which would result in INTERNAL_ORIGINS.includes(value) to return true if value === undefined. I think it complained about it in the other PR as well. I guess i listened to it here. Doesn't really matter. Can undo it as well

[adonesky1]

LGTM

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e30641. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeConfirmations, SmokeMultiChainAPI, SmokeNetworkExpansion, SmokeNetworkAbstractions, SmokeWalletPlatform, SmokeBrowser
• Selected Performance tags: None (no tests recommended)
• Risk Level: high
• AI Confidence: 82%

click to see 🤖 AI reasoning details

E2E Test Selection:

The changes in this PR affect several critical areas:

1. EIP-5792 Middleware refactor (createEip5792Middleware.ts, BackgroundBridge.js): The middleware now uses getPermittedAccounts(origin) instead of returning all accounts. This is a behavioral change for wallet_sendCalls and wallet_getCapabilities - they now correctly scope to origin-permitted accounts. The batch-transaction.spec.ts test (tagged SmokeConfirmations) directly uses tapSendCallsButton() which invokes wallet_sendCalls. This warrants SmokeConfirmations.

2. Major version bump of @metamask/eip-5792-middleware (v2→v3): A major version bump could introduce breaking API changes in walletGetCapabilities, walletSendCalls, walletGetCallsStatus hooks. This affects all EIP-5792 flows.

3. BackgroundBridge.js changes: BackgroundBridge is used by BrowserTab, WalletConnect2Session, SDKConnect, and DeeplinkProtocolService. Changes here can affect all dApp connection flows - SmokeBrowser (BrowserTab), SmokeMultiChainAPI (CAIP-25 sessions), SmokeNetworkExpansion (Solana/multi-chain), SmokeNetworkAbstractions (chain permissions).

4. INTERNAL_ORIGINS.filter(Boolean): This affects WalletConnect, SDKConnect, and DeeplinkProtocol origin checks. The .filter(Boolean) removes undefined values (e.g., when process.env.MM_FOX_CODE is not set), which could change behavior for internal origin detection in WalletConnect and SDK connections. This affects SmokeWalletPlatform (EVM provider events, dApp communication) and SmokeNetworkExpansion.

5. SmokeMultiChainAPI: The wallet_invokeMethod.failing.ts test covers EIP-5792 methods in the multichain context. The permission change (getPermittedAccounts) directly affects how accounts are exposed to dApps in multi-chain sessions.

Tags selected:

• SmokeConfirmations: batch-transaction.spec.ts uses wallet_sendCalls; EIP-5792 confirmations flow
• SmokeMultiChainAPI: CAIP-25 sessions affected by BackgroundBridge and permission changes
• SmokeNetworkExpansion: Multi-chain provider affected by BackgroundBridge changes; Solana flows
• SmokeNetworkAbstractions: Chain permissions affected by getPermittedAccounts change
• SmokeWalletPlatform: EVM provider events, dApp communication, BackgroundBridge used by BrowserTab
• SmokeBrowser: BrowserTab directly imports BackgroundBridge; browser dApp interactions affected

Performance Test Selection:
The changes are focused on RPC middleware logic (EIP-5792), permission checks, and a dependency version bump. These are not UI rendering, data loading, or app startup changes that would impact measurable performance metrics. No performance tests are warranted.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud