chore: bump @metamask/smart-transactions-controller to ^24.0.0

[rarquevaux]

Description

Bumps @metamask/smart-transactions-controller from ^23.0.0 to ^24.0.0 and handles the v24 breaking change.

Breaking change in v24: The getBearerToken constructor parameter was removed. The controller now calls AuthenticationController:getBearerToken directly through its own runtime messenger.

Changes made:

• AuthenticationController:getBearerToken moved from the init messenger to the controller's runtime messenger (getSmartTransactionsControllerMessenger)
• Removed the getBearerToken wrapper closure from smart-transactions-controller-init.ts
• Mobile-specific: setSentinelApiAuth still needs the bearer token and now calls controllerMessenger.call('AuthenticationController:getBearerToken') directly
• Updated unit tests to match the new constructor signature

No behavior change — the bearer token is still fetched and sent with authenticated requests.

Changelog

CHANGELOG entry: null

Related issues

Fixes: STX-503

Manual testing steps

Feature: smart transactions controller bump

  Scenario: no behavior change
    Given the app is open
    When smart transactions are used
    Then they behave identically to before the bump

Screenshots/Recordings

Before

N/A

After

N/A

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

N/A — no runtime behavior change.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Touches auth token plumbing and messenger delegation for Smart Transactions/Sentinel requests; incorrect wiring could silently drop authenticated headers or break controller calls, though the change is narrowly scoped and covered by updated tests.

Overview
Updates @metamask/smart-transactions-controller to ^24.0.0 and adjusts the engine integration for the v24 breaking change that removes the controller constructor’s getBearerToken option.

AuthenticationController:getBearerToken delegation is moved to the Smart Transactions runtime messenger, and init-time delegation is removed; smart-transactions-controller-init now configures Sentinel auth via setSentinelApiAuth using a token getter that calls controllerMessenger.call('AuthenticationController:getBearerToken'). Unit tests are updated to assert the new constructor signature and to validate Sentinel auth setup/token retrieval behavior.

^{Reviewed by Cursor Bugbot for commit e0e1eb3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​metamask/​smart-transactions-controller@​23.0.0 ⏵ 24.0.0	+1		+1

View full report

[github-actions]

🔍 Smart E2E Test Selection

⏭️ Smart E2E selection skipped - draft PR

All E2E tests pre-selected.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

✅ E2E Fixture Validation — Schema is up to date
11 value mismatches detected (expected — fixture represents an existing user).
View details

[Cal-L]

LGTM