chore: Bumps @metamask/eth-json-rpc-middleware from ^23.1.2 to ^23.1.3 cp-13.29.0

[jeffsmale90]

Description

MetaMask/core#8526 introduces tighter validation of typeddata_v4 requests, breaking advanced permissions, which passes metadata in the top level typed data payload.

This change was introduced in @metamask/eth-json-rpc-middleware@23.1.2.

This PR bumps @metamask/eth-json-rpc-middleware from ^23.1.2 to ^23.1.3 which explicitly allows the metadata field used in Advanced Permissions.

Changelog

CHANGELOG entry: null

Related issues

Fixes: #42180

Manual testing steps

1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Changes a core JSON-RPC middleware dependency version, which can affect request validation/signing flows and dapp compatibility. Scope is small (dependency pin/revert) but behavior impact could be broad at runtime.

Overview
Reverts @metamask/eth-json-rpc-middleware from 23.1.2 back to 23.1.1 and adds a top-level resolutions pin to force that version across the dependency tree.

Updates yarn.lock accordingly so installs consistently resolve 23.1.1.

^{Reviewed by Cursor Bugbot for commit 930f08f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​eth-json-rpc-middleware@​23.1.2 ⏵ 23.1.3	+1		+1	+1

View full report

[metamaskbotv2]

Builds ready [930f08f]

• ⚠️ Make sure the build is safe before downloading and running this build.
  • Please do not use these builds with accounts that contain significant real money.
  • Beware the security risks of cache poisoning.
• builds: chrome, firefox
• builds (beta): chrome, firefox
• builds (flask): chrome, firefox
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• webpack builds: chrome, firefox
• webpack builds (beta): chrome, firefox
• webpack builds (flask): chrome, firefox
• webpack builds (test): chrome, firefox
• webpack builds (test-flask): chrome, firefox
• bundle size: Bundle Size Stats
• bundle analyzer: Bundle Analyzer
• interaction-benchmark: Interaction Stats
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts

⚡ Performance Benchmarks (Total: 🟢 6 pass · 🟡 8 warn · 🔴 0 fail)

Baseline (latest main): 71bd826 | Date: 10/14/58243 | Pipeline: 25020614612 | Baseline logs

Interaction Benchmarks · Samples: 5

Benchmark	chrome-browserify
loadNewAccount [Sentry log · main/release]	🟡 [CI log]
confirmTx [Sentry log · main/release]	🟡 [CI log]
bridgeUserActions [Sentry log · main/release]	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ loadNewAccount/load_new_account: -76%
• ↓ loadNewAccount/total: -76%
• ↓ bridgeUserActions/bridge_load_page: -20%
• ↓ bridgeUserActions/bridge_load_asset_picker: -23%
• ↓ bridgeUserActions/bridge_search_token: -28%
• ↓ bridgeUserActions/total: -28%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 loadNewAccount/FCP: p75 2.5s
• 🟡 confirmTx/FCP: p75 2.6s
• 🟡 bridgeUserActions/FCP: p75 2.6s

Startup Benchmarks · Samples: 100

Benchmark	chrome-browserify	chrome-webpack	firefox-webpack
startupStandardHome [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]	🟢 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ startupStandardHome/uiStartup: -22%
• ↓ startupStandardHome/load: -11%
• ↓ startupStandardHome/domContentLoaded: -13%
• ↑ startupStandardHome/backgroundConnect: +14%
• ↓ startupStandardHome/firstReactRender: -10%
• ↓ startupStandardHome/initialActions: -33%
• ↓ startupStandardHome/loadScripts: -16%
• ↓ startupStandardHome/numNetworkReqs: -37%
• ↓ startupStandardHome/uiStartup: -26%
• ↓ startupStandardHome/load: -21%
• ↓ startupStandardHome/domContentLoaded: -20%
• ↓ startupStandardHome/domInteractive: -11%
• ↓ startupStandardHome/firstPaint: -33%
• ↓ startupStandardHome/backgroundConnect: -43%
• ↓ startupStandardHome/firstReactRender: -27%
• ↓ startupStandardHome/loadScripts: -21%
• ↓ startupStandardHome/setupStore: -20%
• ↓ startupStandardHome/numNetworkReqs: -44%
• ↓ startupStandardHome/uiStartup: -14%
• ↓ startupStandardHome/domInteractive: -44%
• ↑ startupStandardHome/initialActions: +14%
• ↓ startupStandardHome/setupStore: -64%
• ↓ startupStandardHome/numNetworkReqs: -37%

User Journey Benchmarks · Samples: 5 · mock API

Benchmark	chrome-browserify
onboardingImportWallet [Sentry log · main/release]	🟢 [CI log]
onboardingNewWallet [Sentry log · main/release]	🟢 [CI log]
assetDetails [Sentry log · main/release]	🟡 [CI log]
solanaAssetDetails [Sentry log · main/release]	🟡 [CI log]
importSrpHome [Sentry log · main/release]	🟡 [CI log]
sendTransactions [Sentry log · main/release]	🟡 [CI log]
swap [Sentry log · main/release]	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ onboardingImportWallet/srpButtonToSrpForm: -84%
• ↓ onboardingImportWallet/metricsToWalletReadyScreen: -34%
• ↓ onboardingImportWallet/doneButtonToHomeScreen: -78%
• ↑ onboardingImportWallet/openAccountMenuToAccountListLoaded: +26%
• ↓ onboardingImportWallet/total: -44%
• ↓ onboardingNewWallet/srpButtonToPwForm: -79%
• ↓ onboardingNewWallet/skipBackupToMetricsScreen: -66%
• ↑ onboardingNewWallet/agreeButtonToOnboardingSuccess: +13%
• ↓ onboardingNewWallet/doneButtonToAssetList: -31%
• ↓ onboardingNewWallet/total: -31%
• ↓ assetDetails/assetClickToPriceChart: -37%
• ↓ assetDetails/total: -37%
• ↓ solanaAssetDetails/assetClickToPriceChart: -66%
• ↓ solanaAssetDetails/total: -66%
• ↓ importSrpHome/loginToHomeScreen: -14%
• ↓ importSrpHome/openAccountMenuAfterLogin: -69%
• ↓ importSrpHome/homeAfterImportWithNewWallet: -68%
• ↓ importSrpHome/total: -61%
• ↓ sendTransactions/openSendPageFromHome: -25%
• ↓ sendTransactions/selectTokenToSendFormLoaded: -26%
• ↑ sendTransactions/reviewTransactionToConfirmationPage: +35%
• ↑ sendTransactions/total: +33%
• ↓ swap/openSwapPageFromHome: -96%
• ↑ swap/fetchAndDisplaySwapQuotes: +31%
• ↑ swap/total: +11%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 assetDetails/FCP: p75 2.5s
• 🟡 solanaAssetDetails/FCP: p75 2.5s
• 🟡 importSrpHome/FCP: p75 2.5s
• 🟡 sendTransactions/FCP: p75 2.5s
• 🟡 swap/FCP: p75 2.5s

Dapp Page Load Benchmarks · Samples: 100

Benchmark	chrome-browserify
dappPageLoad [Sentry log · main/release]	🟢 [CI log]

Bundle size diffs

• background: 58 Bytes (0%)
• ui: 5 Bytes (0%)
• common: -259 Bytes (0%)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[metamaskbotv2]

Builds ready [a332b1e]

• ⚠️ Make sure the build is safe before downloading and running this build.
  • Please do not use these builds with accounts that contain significant real money.
  • Beware the security risks of cache poisoning.
• builds: chrome, firefox
• builds (beta): chrome, firefox
• builds (flask): chrome, firefox
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• webpack builds: chrome, firefox
• webpack builds (beta): chrome, firefox
• webpack builds (flask): chrome, firefox
• webpack builds (test): chrome, firefox
• webpack builds (test-flask): chrome, firefox
• bundle size: Bundle Size Stats
• bundle analyzer: Bundle Analyzer
• interaction-benchmark: Interaction Stats
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts

⚡ Performance Benchmarks (Total: 🟢 0 pass · 🟡 0 warn · 🔴 0 fail)

Baseline (latest main): 71bd826 | Date: 10/14/58243 | Pipeline: 25072515299 | Baseline logs

Interaction Benchmarks · Samples: 5

⚠️ Missing data: chrome/webpack/interactionUserActions, firefox/webpack/interactionUserActions

✅ No regressions detected

Startup Benchmarks · Samples: 100

⚠️ Missing data: chrome/webpack/startupStandardHome, chrome/webpack/startupPowerUserHome, firefox/webpack/startupStandardHome, firefox/webpack/startupPowerUserHome

✅ No regressions detected

User Journey Benchmarks · Samples: 5 · mock API

⚠️ Missing data: chrome/webpack/userJourneyOnboardingImport, chrome/webpack/userJourneyOnboardingNew, chrome/webpack/userJourneyAssets, chrome/webpack/userJourneyAccountManagement, chrome/webpack/userJourneyTransactions, firefox/webpack/userJourneyOnboardingImport, firefox/webpack/userJourneyOnboardingNew, firefox/webpack/userJourneyAssets, firefox/webpack/userJourneyAccountManagement, firefox/webpack/userJourneyTransactions

✅ No regressions detected

Dapp Page Load Benchmarks · Samples: 100

⚠️ Missing data: chrome/webpack/pageLoadBenchmark

✅ No regressions detected

Bundle size diffs [🚨 Warning! Bundle size has increased!]

• background: 760 Bytes (0.01%)
• ui: 33.55 KiB (0.39%)
• common: 14.47 KiB (0.11%)