[DO NOT MERGE] by cmd-ob · Pull Request #19844 · MetaMask/metamask-mobile

cmd-ob · 2025-09-16T16:12:34Z

Description

This PR introduces an E2E test selection system that uses AI to analyse files changed and automatically run only the most relevant smoke tests, reducing CI time.

How It Works

Label your PR with ai-e2e, ai-e2e-ios, or ai-e2e-android
AI analyses your code changes and selects appropriate test tags
Tests run automatically on the selected platforms with optimal job splitting
Results posted back to the PR with detailed analysis

Key Features

🤖 AI-powered selection - Claude AI analyses diffs and recommends test tags
🎯 Risk assessment - Categorises changes as low/medium/high risk
⚡ Faster CI - Only runs relevant tests instead of full smoke suite
📊 Smart splitting - Automatically distributes tests across parallel jobs
📱 Platform support - Runs on iOS, Android, or both

Usage

For PRs:

Label: ai-e2e          # Both platforms
Label: ai-e2e-ios      # iOS only
Label: ai-e2e-android  # Android only
Label: ai-e2e-analysis # Analysis only - no builds or test

For local testing:

yarn ai-e2e --verbose  # See AI reasoning
yarn ai-e2e --output json  # Machine-readable

See ai-e2e-testing.md for complete details.

Changelog

CHANGELOG entry:

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
I've completed the PR template to the best of my ability
I’ve included tests if applicable
I’ve documented my code using JSDoc format if applicable
I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

github-actions · 2025-09-16T16:12:48Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

socket-security · 2025-09-16T16:20:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality	Maintenance
	npm/@types/react-native@0.70.13 ⏵ 0.73.0		^-40
	npm/@types/easy-table@1.2.0 ⏵ 1.2.3	⁺¹
	npm/@esbuild/aix-ppc64@0.25.10
	npm/@esbuild/openbsd-arm64@0.25.10
	npm/@esbuild/netbsd-arm64@0.25.10
	npm/@unrs/resolver-binding-android-arm-eabi@1.11.1
	npm/@unrs/resolver-binding-android-arm64@1.11.1
	npm/@unrs/resolver-binding-darwin-arm64@1.11.1
	npm/@unrs/resolver-binding-darwin-x64@1.11.1
	npm/@unrs/resolver-binding-freebsd-x64@1.11.1
	npm/@unrs/resolver-binding-linux-arm-gnueabihf@1.11.1
	npm/@unrs/resolver-binding-linux-arm-musleabihf@1.11.1
	npm/@unrs/resolver-binding-linux-arm64-gnu@1.11.1
	npm/@unrs/resolver-binding-linux-arm64-musl@1.11.1
	npm/@unrs/resolver-binding-linux-ppc64-gnu@1.11.1
	npm/@unrs/resolver-binding-linux-riscv64-gnu@1.11.1
	npm/@unrs/resolver-binding-linux-riscv64-musl@1.11.1
	npm/@unrs/resolver-binding-linux-s390x-gnu@1.11.1
	npm/@unrs/resolver-binding-linux-x64-gnu@1.11.1
	npm/@unrs/resolver-binding-linux-x64-musl@1.11.1
	npm/@unrs/resolver-binding-win32-arm64-msvc@1.11.1
	npm/@unrs/resolver-binding-win32-ia32-msvc@1.11.1
	npm/@unrs/resolver-binding-win32-x64-msvc@1.11.1
	npm/@swc/core-darwin-x64@1.3.95 ⏵ 1.13.5	⁺¹	⁺⁴	⁺²
	npm/@swc/core-win32-x64-msvc@1.3.95 ⏵ 1.13.5	⁺¹	⁺⁴	⁺²
	npm/@swc/core-linux-x64-gnu@1.3.95 ⏵ 1.13.5	⁺¹	⁺⁴	⁺²
	npm/@swc/core-linux-x64-musl@1.3.95 ⏵ 1.13.5	⁺¹	⁺⁴	⁺²
	npm/@swc/core-win32-ia32-msvc@1.3.95 ⏵ 1.13.5	⁺¹	⁺⁴	⁺²
	npm/@swc/core-linux-arm-gnueabihf@1.3.95 ⏵ 1.13.5	⁺¹	⁺⁴	⁺²
	npm/@swc/core-darwin-arm64@1.3.95 ⏵ 1.13.5	⁺¹	⁺⁴	⁺²
	npm/@swc/core-linux-arm64-gnu@1.3.95 ⏵ 1.13.5	⁺¹	⁺⁴	⁺²
	npm/@swc/core-linux-arm64-musl@1.3.95 ⏵ 1.13.5	⁺¹	⁺⁴	⁺²
See 968 more rows in the dashboard

View full report

socket-security · 2025-09-16T16:20:23Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`npm/@browserstack/ai-sdk-node@1.5.9` has Obfuscated code. Confidence: 1.00 Location: Package overview From: yarn.lock → `npm/@browserstack/ai-sdk-node@1.5.9` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@browserstack/ai-sdk-node@1.5.9`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/ripemd160@2.0.3` has Unstable ownership. Author: ljharb From: yarn.lock → `npm/ripemd160@2.0.3` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ripemd160@2.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@browserstack/ai-sdk-node@1.5.9` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/@browserstack/ai-sdk-node@1.5.9` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@browserstack/ai-sdk-node@1.5.9`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@emnapi/core@1.5.0` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/@emnapi/core@1.5.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.5.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@expo/sudo-prompt@9.3.2` has Shell access. Module: child_process Location: Package overview From: yarn.lock → `npm/@expo/sudo-prompt@9.3.2` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@expo/sudo-prompt@9.3.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@firebase/ai@1.4.1` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/@firebase/ai@1.4.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@firebase/ai@1.4.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@firebase/util@1.12.1` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/@firebase/util@1.12.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@firebase/util@1.12.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@percy/sdk-utils@1.31.2` has Network access. Module: https Location: Package overview From: yarn.lock → `npm/@percy/sdk-utils@1.31.2` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@percy/sdk-utils@1.31.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@percy/sdk-utils@1.31.2` has Network access. Module: http Location: Package overview From: yarn.lock → `npm/@percy/sdk-utils@1.31.2` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@percy/sdk-utils@1.31.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@tybys/wasm-util@0.10.1` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/@tybys/wasm-util@0.10.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tybys/wasm-util@0.10.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@unrs/resolver-binding-wasm32-wasi@1.11.1` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/@unrs/resolver-binding-wasm32-wasi@1.11.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@unrs/resolver-binding-wasm32-wasi@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/crossws@0.3.5` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/crossws@0.3.5` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/crossws@0.3.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/napi-postinstall@0.3.3` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/napi-postinstall@0.3.3` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/napi-postinstall@0.3.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/on-headers@1.1.0` has Network access. Module: http Location: Package overview From: yarn.lock → `npm/on-headers@1.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/on-headers@1.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/secp256k1@4.0.4` has Native code. Location: Package overview From: yarn.lock → `npm/eciesjs@0.3.21` → `npm/secp256k1@4.0.4` ℹ Read more on: This package \| This alert \| Why is native code a concern? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/secp256k1@4.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/unrs-resolver@1.11.1` has Shell access. Module: child_process Location: Package overview From: yarn.lock → `npm/unrs-resolver@1.11.1` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/unrs-resolver@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@lavamoat/git-safe-dependencies@0.2.2` has a New author. New Author: naugtur Previous Author: lmbot From: package.json → `npm/@lavamoat/git-safe-dependencies@0.2.2` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@lavamoat/git-safe-dependencies@0.2.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@storybook/addon-controls@7.6.20` has a New author. New Author: valentinpalkovic Previous Author: shilman From: package.json → `npm/@storybook/addon-controls@7.6.20` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@storybook/addon-controls@7.6.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@storybook/blocks@7.6.20` has a New author. New Author: valentinpalkovic Previous Author: shilman From: yarn.lock → `npm/@storybook/blocks@7.6.20` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@storybook/blocks@7.6.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@storybook/builder-webpack5@7.6.20` has a New author. New Author: valentinpalkovic Previous Author: shilman From: package.json → `npm/@storybook/builder-webpack5@7.6.20` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@storybook/builder-webpack5@7.6.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@storybook/channels@7.6.20` has a New author. New Author: valentinpalkovic Previous Author: shilman From: yarn.lock → `npm/@storybook/channels@7.6.20` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@storybook/channels@7.6.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@storybook/client-logger@7.6.20` has a New author. New Author: valentinpalkovic Previous Author: shilman From: yarn.lock → `npm/@storybook/client-logger@7.6.20` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@storybook/client-logger@7.6.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@storybook/components@7.6.20` has a New author. New Author: valentinpalkovic Previous Author: shilman From: yarn.lock → `npm/@storybook/components@7.6.20` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@storybook/components@7.6.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@storybook/core-common@7.6.20` has a New author. New Author: valentinpalkovic Previous Author: shilman From: yarn.lock → `npm/@storybook/core-common@7.6.20` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@storybook/core-common@7.6.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@storybook/core-events@7.6.20` has a New author. New Author: valentinpalkovic Previous Author: shilman From: yarn.lock → `npm/@storybook/core-events@7.6.20` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@storybook/core-events@7.6.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`npm/@storybook/core-webpack@7.6.20` has a New author. New Author: valentinpalkovic Previous Author: shilman From: yarn.lock → `npm/@storybook/core-webpack@7.6.20` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@storybook/core-webpack@7.6.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 42 more rows in the dashboard

Ignoring alerts on:

npm/@anthropic-ai/sdk@0.62.0

View full report

github-actions · 2025-09-18T15:19:34Z

Bitrise

❌❌❌ pr_smoke_e2e_pipeline failed on Bitrise! ❌❌❌

Commit hash: 6d1a021
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/6c275afb-4c7a-46e8-8965-07af1811b286

Note

You can rerun any failed steps by opening the Bitrise build, tapping Rebuild on the upper right then Rebuild unsuccessful Workflows
You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the run-ios-e2e-smoke label on the pull request

Tip

Check the documentation if you have any doubts on how to understand the failure on bitrise

- E2E test selector using Claude API - GitHub Actions workflow with platform controls - Manual trigger support with iOS/Android toggles

… Smart E2E test workflow

…breakdown in PR comments

…gration

github-actions · 2025-09-24T15:51:24Z

🤖 Smart E2E Test Analysis ⏸️

Risk Level: high | Selected Tags: SmokeAccounts, SmokeConfirmations, SmokeConfirmationsRedesigned, SmokeIdentity, SmokeNetworkAbstractions, SmokeNetworkExpansion, SmokeTrade, SmokeWalletPlatform

Final Results:

iOS Jobs: 0 (Result: skipped)
Android Jobs: 20 (Result: cancelled)
Total CI Jobs: 20
Overall Status: Cancelled

Platform Configuration:

iOS enabled: false
Android enabled: true

⏸️ View complete workflow run • Smart E2E AI Selection

…to MMQA-991" This reverts commit edc6e48, reversing changes made to a520fe8.

…orting

…y mode

github-actions · 2025-09-25T08:07:19Z

🔍 AI E2E Analysis Report

Risk Level: high | Selected Tags: SmokeAccounts, SmokeConfirmations, SmokeConfirmationsRedesigned, SmokeIdentity, SmokeNetworkAbstractions, SmokeNetworkExpansion, SmokeTrade, SmokeWalletPlatform

🤖 AI Analysis:

Dependency changes (yarn.lock/package.json) detected with 314 total files changed including critical core infrastructure (app/core/, app/store/, app/reducers/), confirmation flows, account management, network handling, and extensive UI components. The scale and breadth of changes across multiple functional areas warrants running all smoke test tags to ensure system stability.

📊 Analysis Results:

Mode: Analysis-Only ✅ (no builds or tests)
Confidence: 95%

🔍 View complete analysis • Analysis completed successfully

cursor · 2025-09-25T08:08:41Z

app/components/UI/Bridge/hooks/useInitialDestToken/index.ts

+    initialSourceToken?.address !== defaultDestToken.address
+  ) {
+    dispatch(setDestToken(defaultDestToken));
+  }


Bug: Hook Placement Causes Infinite Re-renders

Moving the setDestToken dispatch calls from useEffect directly into the useInitialDestToken hook body causes them to execute on every render. This can lead to infinite re-renders and performance issues.

metamaskbot added the team-qa QA team label Sep 16, 2025

github-actions bot added the size-XL label Sep 16, 2025

cmd-ob added smart-e2e and removed size-XL labels Sep 16, 2025

github-actions bot added the size-XL label Sep 16, 2025

cmd-ob added smart-e2e and removed smart-e2e labels Sep 16, 2025

jvbriones added DO-NOT-MERGE Pull requests that should not be merged no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed run-ios-e2e-smoke Trigger iOS E2E tests on BitRise labels Sep 18, 2025

jvbriones removed the run-ios-e2e-smoke Trigger iOS E2E tests on BitRise label Sep 18, 2025

cmd-ob added smart-e2e-android and removed smart-e2e labels Sep 19, 2025

feat: add AI-powered Smart E2E test selection system for CI

6f8407c

- E2E test selector using Claude API - GitHub Actions workflow with platform controls - Manual trigger support with iOS/Android toggles

cmd-ob force-pushed the MMQA-991 branch from d57b769 to 6f8407c Compare September 19, 2025 12:22

cmd-ob changed the title ~~[DO NOT MERGE] - WIP~~ chore(e2e): script and CI job to use AI for e2e test selection Sep 19, 2025

cmd-ob removed DO-NOT-MERGE Pull requests that should not be merged smart-e2e-android labels Sep 19, 2025

cmd-ob marked this pull request as ready for review September 19, 2025 12:25

cmd-ob added the smart-e2e-ios label Sep 19, 2025

refactor: streamline output handling and improve report formatting in…

461ba8c

… Smart E2E test workflow

This comment was marked as outdated.

Sign in to view

cmd-ob added 4 commits September 19, 2025 13:30

feat: update split counts for accurate step summary

06c6961

feat: AI analysis with detailed PR comments and improve CI job reporting

693e820

feat: AI analysis reporting with PR comments and final results summary

be49576

feat: AI analysis output with risk level, reasoning, confidence, and …

e18ec4a

…breakdown in PR comments

cmd-ob added 2 commits September 24, 2025 16:27

yarn dedupe

e99df0c

feat: implement AI E2E testing system with test selection and CI inte…

dfe48fe

…gration

Merge branch 'main' of github.com:MetaMask/metamask-mobile into MMQA-991

24b96b2

This comment was marked as outdated.

Sign in to view

cmd-ob changed the title ~~chore(e2e): script and CI job to use AI for e2e test selection~~ feat(e2e): script and CI job to use AI for e2e test selection Sep 24, 2025

cmd-ob added 2 commits September 25, 2025 07:55

feat(ai-e2e): add analysis-only mode to skip builds and tests

a520fe8

Merge branch 'main' of github.com:MetaMask/metamask-mobile into MMQA-991

edc6e48

cmd-ob added ai-e2e-analysis and removed ai-e2e-android labels Sep 25, 2025

cmd-ob added 2 commits September 25, 2025 08:50

Revert "Merge branch 'main' of github.com:MetaMask/metamask-mobile in…

d035c23

…to MMQA-991" This reverts commit edc6e48, reversing changes made to a520fe8.

feat(ai-e2e): analysis-only mode to skip builds and tests, update rep…

d4de794

…orting

cmd-ob requested review from a team as code owners September 25, 2025 07:54

This comment was marked as outdated.

Sign in to view

feat(ai-e2e): enhance comment deletion and reporting for analysis-onl…

ab41648

…y mode

cursor bot reviewed Sep 25, 2025

View reviewed changes

cmd-ob closed this Sep 25, 2025

github-actions bot locked and limited conversation to collaborators Sep 25, 2025

cmd-ob changed the title ~~feat(e2e): script and CI job to use AI for e2e test selection~~ [DO NOT MERGE] Sep 25, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[DO NOT MERGE]#19844

[DO NOT MERGE]#19844
cmd-ob wants to merge 58 commits intomainfrom
MMQA-991

cmd-ob commented Sep 16, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Sep 16, 2025

Uh oh!

socket-security bot commented Sep 16, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Sep 16, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Sep 18, 2025 •

edited by metamaskbot

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Sep 24, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Sep 25, 2025

Uh oh!

cursor bot Sep 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

cmd-ob commented Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How It Works

Key Features

Usage

Changelog

Related issues

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

Uh oh!

github-actions bot commented Sep 16, 2025

Uh oh!

socket-security bot commented Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Sep 18, 2025 • edited by metamaskbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bitrise

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Sep 24, 2025

🤖 Smart E2E Test Analysis ⏸️

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Sep 25, 2025

🔍 AI E2E Analysis Report

Uh oh!

cursor bot Sep 25, 2025

Choose a reason for hiding this comment

Bug: Hook Placement Causes Infinite Re-renders

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cmd-ob commented Sep 16, 2025 •

edited

Loading

socket-security bot commented Sep 16, 2025 •

edited

Loading

socket-security bot commented Sep 16, 2025 •

edited

Loading

github-actions bot commented Sep 18, 2025 •

edited by metamaskbot

Loading