fix: Downgrade multiformats to ^9.9.0 to avoid ESM-only dependency

[Mrtenz]

Explanation

assets-controllers currently uses an ESM-only version of multiformats, which is not supported in the Browserify pipeline used by the extension. I suggest downgrading to ^9.9.0` (the latest CJS version), and updating to a newer version once we drop Browserify in the extension instead.

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
• I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

---

Note

Downgrades multiformats to ^9.9.0 and updates IPFS CID handling to a CJS-compatible import with added type stubs.

• Dependencies:
  • Downgrade multiformats from ^13.1.0 to ^9.9.0 in packages/assets-controllers/package.json.
• Code:
  • In src/assetsUtil.ts, replace dynamic import('multiformats') with import { CID } from 'multiformats/cid' for getIpfsCIDv1AndPath.
• Types:
  • Add partial typings for multiformats/cid at src/types/vendor/multiformats.d.ts.
• Changelog:
  • Add Unreleased "Fixed" entry noting the multiformats downgrade.

^{Written by Cursor Bugbot for commit 8be7611. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	multiformats@​13.2.2 ⏵ 9.9.0				-3

View full report

[Mrtenz]

multiformats has type definitions but they're not included in the package.json's exports fields, so they are not picked up by TypeScript. We only use a very limited subset of the package's functionality anyway, so I added a minimal definition to cover it.

[Gudahtt]

LGTM!