chore: bump assets-controller

[bergarces]

Description

Bump assets-controller and resolve multiple breaking changes.

Changelog

CHANGELOG entry: null

Related issues

Fixes:

Manual testing steps

1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Touches balance/send flows and core AssetsController integration; messenger changes could affect real-time balances if miswired, but scope is mostly dependency alignment and test hardening.

Overview
Bumps @metamask/assets-controller to ^13.1.1 and @metamask/config-registry-controller to ^2.0.1, with matching LavaMoat policy updates for nested assets-controller dependencies (e.g. scoped keyring-snap-client / keyring-api).

AssetsController messenger delegation is updated for the new package: BackendWebSocketService actions and connectionStateChanged are removed; ConfigRegistryController:getNetworkConfigByCaip2ChainId and AccountActivityService:statusChanged are added. Messenger tests are consolidated with it.each over the delegated action/event lists.

Send E2E adds checkAvailableBalance on the send page and uses it before Max in the ERC-20 max-balance test so the amount screen does not race async balance updates.

^{Reviewed by Cursor Bugbot for commit fbee8cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[metamask-ci]

✨ Files requiring CODEOWNER review ✨

💎 @MetaMask/metamask-assets (2 files, +63 -151)

• 📁 app/
  • 📁 scripts/
    • 📁 messenger-client-init/
      • 📁 messengers/
        • 📁 assets/
          • 📄 assets-controller-messenger.test.ts +59 -143
          • 📄 assets-controller-messenger.ts +4 -8

---

📜 @MetaMask/policy-reviewers (8 files, +256 -96)

• 📁 lavamoat/
  • 📁 webpack/
    • 📁 mv2/
      • 📁 beta/
        • 📄 policy.json +32 -12
      • 📁 experimental/
        • 📄 policy.json +32 -12
      • 📁 flask/
        • 📄 policy.json +32 -12
      • 📁 main/
        • 📄 policy.json +32 -12
    • 📁 mv3/
      • 📁 beta/
        • 📄 policy.json +32 -12
      • 📁 experimental/
        • 📄 policy.json +32 -12
      • 📁 flask/
        • 📄 policy.json +32 -12
      • 📁 main/
        • 📄 policy.json +32 -12

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.

---

🧪 @MetaMask/qa (1 files, +19 -0)

• 📁 test/
  • 📁 e2e/
    • 📁 page-objects/
      • 📁 pages/
        • 📁 send/
          • 📄 send-page.ts +19 -0

[MajorLift]

Trial run of the lavamoat-policy-diligence skill (MetaMask/skills#83) —
feedback welcome there, on the finding or on whether this format is useful to a reviewer.
Not a review verdict; nothing here blocks the PR. Read-level triage of the policy diff only.

LavaMoat grants — @metamask/assets-controller 11.3.0 → 13.1.1, @metamask/config-registry-controller 1.0.0 → 2.0.1. Nothing to raise.

Range 39a29da..9434ff0, across the policy files this PR touches.

Four new resources, all first-party, all under @metamask/assets-controller: keyring-api, keyring-api>keyring-utils, keyring-snap-client, and keyring-snap-client>uuid. Their grants are crypto on uuid, URL on keyring-utils, and package edges to superstruct and utils. Each one has a package on the resource to account for it. One resource is dropped, assets-controller>assets-controllers, taking its URL grant with it.

The remainder of the diff is canonical-path relocations, where the generator renamed a resource because its shortest dependency path changed. No capability moved.

Not covered by this run: whether each grant has a live call site at the upgraded versions. This reads the policy delta, not the packages' source, so it establishes that no capability arrived without a package to explain it — not that every capability is exercised.

[bergarces]

@metamaskbot update-policies

[metamask-ci]

Policies updated.
👀 Please review the diff for suspicious new powers.

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.
🧠 Learn how to read policy diffs: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

👀 lavamoat/webpack/mv2/beta/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/experimental/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/flask/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv3/beta/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes
👀 lavamoat/webpack/mv3/experimental/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes
👀 lavamoat/webpack/mv3/flask/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes

[sonarqubecloud]

Quality Gate failed

Failed conditions
10.5% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[metamask-ci]

Builds ready [fbee8cb]

• ⚠️ Make sure the build is safe before downloading and running this build.
  • Please do not use these builds with accounts that contain significant real money.
  • Beware the security risks of cache poisoning.
• Webpack builds: chrome, firefox
• Webpack builds (beta): chrome, firefox
• Webpack builds (flask): chrome, firefox
• Webpack builds (test): chrome, firefox
• Webpack builds (test-flask): chrome, firefox
• bundle size: Bundle Size Stats
• bundle analyzer: Bundle Analyzer
• interaction-benchmark: Interaction Stats
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts

⚡ Performance Benchmarks (Total: 🟢 6 pass · 🟡 17 warn · 🔴 1 fail)

Baseline (latest main): 171ed20 | Date: 7/28/2026 | Pipeline: 31172459681 | Baseline logs

Metrics	chrome-webpack	firefox-webpack
onboardingNewWallet [Sentry log · main/release]	🔴 skipBackupToMetricsScreen(p95) [CI log]	🟢 [CI log]

Regressions (🔴 1 failure)

• onboardingNewWallet [Sentry log · main/release] · chrome-webpack — total(p75) [CI log]

Interaction Benchmarks · Samples: 5

Benchmark	chrome-webpack	firefox-webpack
loadNewAccount [Sentry log · main/release]	🟡 [CI log] 🟡 load_new_account	🟡 [CI log] 🟡 load_new_account
confirmTx [Sentry log · main/release]	🟡 [CI log]	🟡 [CI log]
bridgeUserActions [Sentry log · main/release]	🟡 [CI log]	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↑ loadNewAccount/load_new_account: +18%
• ↑ loadNewAccount/total: +18%
• ↑ loadNewAccount/lcp: +16%
• ↓ confirmTx/longTaskTotalDuration: -16%
• ↑ confirmTx/longTaskMaxDuration: +41%
• ↓ confirmTx/tbt: -28%
• ↑ confirmTx/lcp: +13%
• ↑ bridgeUserActions/bridge_load_page: +23%
• ↑ bridgeUserActions/bridge_load_asset_picker: +60%
• ↓ bridgeUserActions/longTaskCount: -44%
• ↓ bridgeUserActions/longTaskTotalDuration: -53%
• ↓ bridgeUserActions/longTaskMaxDuration: -28%
• ↓ bridgeUserActions/tbt: -70%
• ↑ bridgeUserActions/inp: +15%
• ↑ loadNewAccount/load_new_account: +23%
• ↑ loadNewAccount/total: +23%
• ↑ loadNewAccount/fcp: +12%
• ↑ loadNewAccount/lcp: +1764%
• ↓ confirmTx/longTaskCount: -100%
• ↓ confirmTx/longTaskTotalDuration: -100%
• ↓ confirmTx/longTaskMaxDuration: -100%
• ↓ confirmTx/tbt: -100%
• ↓ confirmTx/fcp: -59%
• ↑ confirmTx/lcp: +1383%
• ↑ bridgeUserActions/bridge_load_page: +242%
• ↑ bridgeUserActions/bridge_load_asset_picker: +97%
• ↓ bridgeUserActions/longTaskCount: -100%
• ↓ bridgeUserActions/longTaskTotalDuration: -100%
• ↓ bridgeUserActions/longTaskMaxDuration: -100%
• ↓ bridgeUserActions/tbt: -100%
• ↑ bridgeUserActions/total: +23%
• ↓ bridgeUserActions/inp: -23%
• ↑ bridgeUserActions/lcp: +1289%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 loadNewAccount/FCP: p75 1.8s
• 🟡 confirmTx/FCP: p75 1.8s
• 🟡 bridgeUserActions/FCP: p75 1.8s
• 🟡 loadNewAccount/FCP: p75 1.9s
• 🟡 loadNewAccount/LCP: p75 3.3s
• 🟡 confirmTx/LCP: p75 2.5s
• 🟡 bridgeUserActions/FCP: p75 1.9s

Startup Benchmarks · Samples: 100

Benchmark	chrome-webpack	firefox-webpack
startupStandardHome [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
startupPowerUserHome [Sentry log · main/release]	–	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ startupStandardHome/firstReactRender: -99%
• ↑ startupStandardHome/setupStore: +14%
• ↓ startupStandardHome/numNetworkReqs: -17%
• ↓ startupStandardHome/uiStartup: -11%
• ↓ startupStandardHome/domInteractive: -24%
• ↓ startupStandardHome/firstReactRender: -98%
• ↓ startupStandardHome/initialActions: -50%
• ↓ startupStandardHome/numNetworkReqs: -13%
• ↑ startupPowerUserHome/load: +15%
• ↑ startupPowerUserHome/domContentLoaded: +15%
• ↑ startupPowerUserHome/domInteractive: +17%
• ↑ startupPowerUserHome/backgroundConnect: +33%
• ↓ startupPowerUserHome/firstReactRender: -99%
• ↑ startupPowerUserHome/initialActions: +11%
• ↑ startupPowerUserHome/loadScripts: +15%
• ↑ startupPowerUserHome/setupStore: +287%
• ↑ startupPowerUserHome/inp: +14%
• ↑ startupPowerUserHome/fcp: +17%
• ↑ startupPowerUserHome/lcp: +19%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 startupPowerUserHome/INP: p75 216ms
• 🟡 startupPowerUserHome/LCP: p75 3.4s

User Journey Benchmarks · Samples: 5 · mock API 🔴 1

Benchmark	chrome-webpack	firefox-webpack
onboardingImportWallet [Sentry log · main/release]	🟡 [CI log] 🟡 total	🟢 [CI log]
onboardingNewWallet [Sentry log · main/release]	🔴 [CI log] 🔴 total	🟢 [CI log]
assetDetails [Sentry log · main/release]	🟡 [CI log]	🟡 [CI log]
solanaAssetDetails [Sentry log · main/release]	🟡 [CI log]	🟡 [CI log]
importSrpHome [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log]
sendTransactions [Sentry log · main/release]	🟡 [CI log]	🟡 [CI log]
swap [Sentry log · main/release]	🟡 [CI log]	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↑ onboardingImportWallet/srpButtonToSrpForm: +12%
• ↓ onboardingImportWallet/metricsToWalletReadyScreen: -13%
• ↓ onboardingImportWallet/doneButtonToHomeScreen: -92%
• ↓ onboardingImportWallet/openAccountMenuToAccountListLoaded: -57%
• ↓ onboardingImportWallet/longTaskCount: -86%
• ↓ onboardingImportWallet/longTaskTotalDuration: -96%
• ↓ onboardingImportWallet/longTaskMaxDuration: -92%
• ↓ onboardingImportWallet/tbt: -99%
• ↓ onboardingImportWallet/total: -83%
• ↓ onboardingNewWallet/agreeButtonToOnboardingSuccess: -34%
• ↓ onboardingNewWallet/longTaskCount: -38%
• ↓ onboardingNewWallet/longTaskTotalDuration: -57%
• ↓ onboardingNewWallet/longTaskMaxDuration: -31%
• ↓ onboardingNewWallet/tbt: -72%
• ↑ solanaAssetDetails/assetClickToPriceChart: +257%
• ↓ solanaAssetDetails/longTaskCount: -100%
• ↓ solanaAssetDetails/longTaskTotalDuration: -100%
• ↓ solanaAssetDetails/longTaskMaxDuration: -100%
• ↓ solanaAssetDetails/tbt: -100%
• ↑ solanaAssetDetails/total: +257%
• ↑ solanaAssetDetails/inp: +19%
• ↑ solanaAssetDetails/fcp: +21%
• ↑ solanaAssetDetails/lcp: +10%
• ↓ importSrpHome/loginToHomeScreen: -32%
• ↓ importSrpHome/homeAfterImportWithNewWallet: -65%
• ↓ importSrpHome/longTaskCount: -58%
• ↓ importSrpHome/longTaskTotalDuration: -60%
• ↓ importSrpHome/longTaskMaxDuration: -42%
• ↓ importSrpHome/tbt: -64%
• ↓ importSrpHome/total: -59%
• ↓ importSrpHome/inp: -61%
• ↓ importSrpHome/fcp: -26%
• ↓ importSrpHome/lcp: -18%
• ↑ importSrpHome/cls: +443%
• ↓ sendTransactions/openSendPageFromHome: -11%
• ↑ sendTransactions/selectTokenToSendFormLoaded: +284%
• ↓ sendTransactions/reviewTransactionToConfirmationPage: -97%
• ↓ sendTransactions/longTaskCount: -100%
• ↓ sendTransactions/longTaskTotalDuration: -100%
• ↓ sendTransactions/longTaskMaxDuration: -100%
• ↓ sendTransactions/tbt: -100%
• ↓ sendTransactions/total: -91%
• ↓ sendTransactions/inp: -37%
• ↑ sendTransactions/fcp: +11%
• ↓ sendTransactions/lcp: -61%
• ↑ sendTransactions/cls: +171%
• ↑ swap/openSwapPageFromHome: +187%
• ↑ swap/fetchAndDisplaySwapQuotes: +122%
• ↑ swap/longTaskCount: +33%
• ↑ swap/longTaskTotalDuration: +42%
• ↓ swap/tbt: -74%
• ↑ swap/total: +130%
• ↓ swap/lcp: -70%
• ↓ swap/cls: -92%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 assetDetails/FCP: p75 1.9s
• 🟡 solanaAssetDetails/FCP: p75 1.9s
• 🟡 sendTransactions/FCP: p75 1.8s
• 🟡 swap/FCP: p75 1.8s
• 🟡 assetDetails/FCP: p75 2.0s
• 🟡 solanaAssetDetails/FCP: p75 1.9s
• 🟡 importSrpHome/FCP: p75 2.0s
• 🔴 sendTransactions/INP: p75 720ms
• 🟡 sendTransactions/FCP: p75 2.0s
• 🟡 swap/FCP: p75 2.0s

Dapp Page Load Benchmarks · Samples: 100

Benchmark	chrome-webpack
dappPageLoad [Sentry log · main/release]	🟢 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ dappPageLoad/pageLoadTime: -58%
• ↓ dappPageLoad/firstPaint: -46%
• ↓ dappPageLoad/firstContentfulPaint: -46%

Bundle size diffs [🚨 Warning! Bundle size has increased!]

• background: 13.95 KiB (0.09%)
• ui: 15.67 KiB (0.08%)
• common: 0 Bytes (0%)
• other: 0 Bytes (0%)
• contentScripts: 1.93 KiB (0.1%)
• zip: 6.16 KiB (0.03%)