fix: update eth-sig-util to 9.0.0 - #626
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
OGPoyraz
changed the title
eth-sig-util to latesteth-sig-util to 9.0.0
This was referenced Aug 28, 2026
OGPoyraz
changed the title
eth-sig-util to 9.0.0eth-sig-util to 9.0.0
4 tasks
OGPoyraz
changed the title
eth-sig-util to 9.0.0eth-sig-util to 9.0.0
OGPoyraz
marked this pull request as ready for review
August 28, 2026 10:40
montelaidev
approved these changes
Aug 28, 2026
pull Bot
pushed a commit
to Reality2byte/metamask-mobile
that referenced
this pull request
Aug 28, 2026
## **Description** `@metamask/eth-sig-util` v9.0.0 introduces strict `bool` validation in `signTypedData`: ambiguous values like `0`, `1`, `'0'`, `'1'`, `''`, and `'False'` are now rejected instead of being silently coerced via `Boolean()`. This was a signing integrity footgun — a dApp could supply `flag: 'false'` (which `Boolean()` coerces to `true`) and get a user to sign the opposite of what was displayed in the confirmation UI. This PR adds a Yarn resolution to force `@metamask/eth-sig-util@^9.0.0` across all transitive dependencies while the upstream cascade lands. The immediate blocker is `@metamask/eth-simple-keyring` (and other keyrings in [MetaMask/accounts#626](MetaMask/accounts#626)) which still declare `^8.2.0` — without the resolution, `eth-simple-keyring` installs its own nested copy of v8.2.0 and `normalizeBool()` is never reached during signing. **Dependency update cascade:** - `eth-sig-util@9.0.0` update: [MetaMask/eth-sig-util CHANGELOG](https://github.com/MetaMask/eth-sig-util/blob/main/CHANGELOG.md#900) - Core controllers: [MetaMask/core#9999](MetaMask/core#9999) - Keyring updates: [MetaMask/accounts#626](MetaMask/accounts#626) - Mobile resolution: this PR - Extension resolution: [MetaMask/metamask-extension#45854](MetaMask/metamask-extension#45854) The resolution will be removed in a follow-up PR once the upstream packages ship and are consumed here. ## **Changelog** CHANGELOG entry: null ## **Test results** <img width="1086" height="1731" alt="1" src="https://github.com/user-attachments/assets/98163300-b13f-451d-9dd8-0329ce0a914c" /> <img width="1080" height="1742" alt="2" src="https://github.com/user-attachments/assets/555c2b5f-b73f-4149-9837-70745349fcf1" /> <img width="1089" height="684" alt="3" src="https://github.com/user-attachments/assets/39caa174-a686-43ba-9ed2-b30ae5475063" /> ## **Related issues** Fixes: CONF-1807 ## **Manual testing steps** 1. Install the app from this branch 2. Navigate to any dApp that uses `eth_signTypedData_v4` with a `bool` field 3. Attempt to sign a typed message where a `bool` field is set to an ambiguous value such as `0`, `1`, `'0'`, or `'1'` 4. Verify the signing request is rejected with an error — MetaMask should not present a confirmation dialog for invalid bool values 5. Attempt to sign with valid values (`true`, `false`, `'true'`, `'false'`) and verify the signing confirmation appears and completes successfully ## **Pre-merge author checklist** - [ ] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and MetaMask Mobile Coding Standards. - [ ] I've completed the PR template to the best of my ability - [ ] I've included tests if applicable - [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Touches signing and typed-data validation across the dependency tree; stricter bool rejection may break dApps that relied on old coercion, but that is the intended security fix. > > **Overview** > Bumps **`@metamask/eth-sig-util`** from **^8.0.0** to **^9.0.0** in direct dependencies and adds a **`resolutions`** entry so every transitive consumer (e.g. keyrings still on **^8.2.0**) resolves to a single **9.0.0** install. **`yarn.lock`** is updated accordingly. > > This lands **v9**’s stricter **`signTypedData`** handling for **`bool`** fields: ambiguous values like **`0`**, **`1`**, or string variants are rejected instead of being coerced with **`Boolean()`**, closing a signing/UI mismatch risk. No application source changes—behavior changes only where the app already pulls in **`eth-sig-util`** (typed-data signing, personal-signature recovery, confirmation flows). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit d136a92. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
pull Bot
pushed a commit
to firas9941/metamask-extension
that referenced
this pull request
Aug 31, 2026
## **Description** `@metamask/eth-sig-util` v9.0.0 introduces strict `bool` validation in `signTypedData`: ambiguous values like `0`, `1`, `'0'`, `'1'`, `''`, and `'False'` are now rejected instead of being silently coerced via `Boolean()`. This was a signing integrity footgun — a dApp could supply `flag: 'false'` (which `Boolean()` coerces to `true`) and get a user to sign the opposite of what was displayed in the confirmation UI. This PR adds a Yarn resolution to force `@metamask/eth-sig-util@^9.0.0` across all transitive dependencies while the upstream cascade lands. The immediate blocker is `@metamask/eth-simple-keyring` (and other keyrings in [MetaMask/accounts#626](MetaMask/accounts#626)) which still declare `^8.2.0` — without the resolution, `eth-simple-keyring` installs its own nested copy of v8.2.0 and `normalizeBool()` is never reached during signing. **Dependency update cascade:** - `eth-sig-util@9.0.0` update: [MetaMask/eth-sig-util CHANGELOG](https://github.com/MetaMask/eth-sig-util/blob/main/CHANGELOG.md#900) - Core controllers: [MetaMask/core#9999](MetaMask/core#9999) - Keyring updates: [MetaMask/accounts#626](MetaMask/accounts#626) - Mobile resolution: [MetaMask/metamask-mobile#35410](MetaMask/metamask-mobile#35410) - Extension resolution: this PR The resolution will be removed in a follow-up PR once the upstream packages ship and are consumed here. ## **Changelog** CHANGELOG entry: null ## **Test results** <img width="1086" height="1731" alt="1" src="https://github.com/user-attachments/assets/98163300-b13f-451d-9dd8-0329ce0a914c" /> <img width="1080" height="1742" alt="2" src="https://github.com/user-attachments/assets/555c2b5f-b73f-4149-9837-70745349fcf1" /> <img width="1089" height="684" alt="3" src="https://github.com/user-attachments/assets/39caa174-a686-43ba-9ed2-b30ae5475063" /> ## **Related issues** Fixes: CONF-1807 ## **Manual testing steps** 1. Install the extension from this branch 2. Navigate to any dApp that uses `eth_signTypedData_v4` with a `bool` field (e.g. a local test page served over `localhost`) 3. Attempt to sign a typed message where a `bool` field is set to an ambiguous value such as `0`, `1`, `'0'`, or `'1'` 4. Verify the signing request is rejected with an error — MetaMask should not present a confirmation dialog for invalid bool values 5. Attempt to sign with valid values (`true`, `false`, `'true'`, `'false'`) and verify the signing confirmation appears and completes successfully <!-- ## **Screenshots/Recordings** ### **Before** ### **After** --> ## **Pre-merge author checklist** - [ ] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [ ] I've completed the PR template to the best of my ability - [ ] I've included tests if applicable - [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > Touches the signing and keyring dependency graph with preview packages; behavior changes for invalid EIP-712 bool fields and could affect dApps that relied on loose coercion. > > **Overview** > Forces **`@metamask/eth-sig-util@^9.0.0`** everywhere (direct dependency plus a new Yarn **resolution**) so typed-data signing uses v9’s stricter **`bool`** handling in `signTypedData`—ambiguous values like `0`, `1`, and `'false'` are rejected instead of being coerced with `Boolean()`. > > Because several controllers still pull **v8.2.0** transitively (e.g. via keyrings), the lockfile also wires **non-breaking preview builds** for `@metamask/eth-json-rpc-middleware`, `@metamask/keyring-controller`, `@metamask/signature-controller`, and `@metamask/message-manager` so the signing/RPC stack resolves against **`eth-sig-util` v9** until upstream releases land. No extension application source changes—**`package.json`** and **`yarn.lock`** only. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0997ff6. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Bumps
@metamask/eth-sig-utilfrom^8.2.0to^9.0.0across the eight packages that depend on it (keyring-eth-simple,keyring-eth-hd,keyring-eth-trezor,keyring-eth-qr,keyring-eth-ledger-bridge,keyring-snap-bridge,keyring-eth-money,keyring-sdk).v9.0.0contains two breaking changes:signTypedDatanow rejects ambiguousboolvalues (e.g.0,1,'0','') instead of coercing them viaBoolean(). None of the affected packages pass non-boolean values toboolfields, so no code changes were required.Dependency update cascade:
eth-sig-util@9.0.0update: MetaMask/eth-sig-util CHANGELOGReferences
@metamask/eth-sig-utilv9.0.0 changelogeth-sig-utilto latest core#9999Checklist
Note
Medium Risk
Touches signing-related dependency used across all Ethereum keyrings; v9’s stricter typed-data validation could surface new errors for ambiguous bool payloads even though this PR does not change local code.
Overview
This PR upgrades
@metamask/eth-sig-utilfrom^8.2.0to^9.0.0in eight workspace packages (keyring-sdk,keyring-eth-hd,keyring-eth-simple,keyring-eth-trezor,keyring-eth-qr,keyring-eth-ledger-bridge,keyring-snap-bridge, andkeyring-eth-moneyas a devDependency), updates each package’s Unreleased changelog entry, and refreshesyarn.lockto resolve9.0.0.There are no TypeScript or runtime code changes—only dependency and documentation updates. Consumers of these packages will transitively pick up
eth-sig-utilv9, including stricter EIP-712boolhandling insignTypedDataand the library’s Node 22+ requirement (already aligned with this monorepo’sengines).Reviewed by Cursor Bugbot for commit ddc5f5c. Bugbot is set up for automated code reviews on this repo. Configure here.