chore: migrate Jest from v27 to v28 by cryptodev-2s · Pull Request #7812 · MetaMask/core

cryptodev-2s · 2026-02-02T15:39:29Z

Explanation

References

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
Large-scale test tooling upgrade that changes timer behavior and environment setup across many packages; main risk is flaky or behaviorally-different tests rather than production logic.

Overview
Upgrades the monorepo’s Jest stack from v27 to v28 (including ts-jest, @types/jest, and package-level jest-environment-* deps) across many workspaces.

Adjusts Jest configuration and module resolution: adds explicit uuid mapping, enables fakeTimers.doNotFake: ['performance'] for Node v24 compatibility, and updates .depcheckrc.yml ignores for Jest environments.

Updates custom Jest environments to the v28 API ({ TestEnvironment }) and refactors numerous tests to be compatible with Jest 28/fake-timers changes (more explicit sinon.useFakeTimers targets, mocking performance.now, and a few added advanceTimersByTime(0)/timeout tweaks). Also updates tests/setup.ts to force isomorphic-fetch/node-fetch so nock can intercept requests on Node 18+.

^{Written by Cursor Bugbot for commit 40f282f. This will update automatically on new commits. Configure here.}

Update Jest related packages to ^28. This resolves a peer dependency warning from `ts-jest` about the version of `typescript` we're using being too high. Here are the relevant changelogs: * `ts-jest`: https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md#2800-2022-05-02 * None of the breaking changes impacted us here * `jest`: https://github.com/jestjs/jest/releases/tag/v28.0.0 * Blog post: https://jestjs.io/blog/2022/04/25/jest-28 * Migration guide: https://jest-archive-august-2023.netlify.app/docs/28.x/upgrading-to-jest28/

… a mistake)

- Clear native fetch in Node.js 18+ before importing isomorphic-fetch - This ensures isomorphic-fetch uses node-fetch (which nock can intercept) instead of native fetch (which uses undici and nock cannot intercept) - Simplify nock cleanup by removing redundant afterAll hook - Fixes 'TypeError: fetch failed' errors in tests with nock mocks

- Add 'export {};' at top of file to satisfy import-x/unambiguous lint rule - Fixes 'This module could be parsed as a valid script' error

- Remove eslint suppressions for nock.ts (no longer needed) - Adjust coverage thresholds in bridge-status-controller (lines/statements: 100 -> 99) - Format jest.useFakeTimers({}) calls consistently - Reorder imports in TestStrategy.test.ts

- Add resolution override to force ^5.0.0 to use ^5.0.1 - Fixes invalid resolution error when @metamask/eth-json-rpc-infura depends on ^5.0.0 while root package.json specifies ^5.0.1 - Update yarn.lock to reflect the resolution change

…tibility # Conflicts: # eslint-suppressions.json # package.json # packages/account-tree-controller/package.json # packages/accounts-controller/package.json # packages/address-book-controller/package.json # packages/analytics-controller/package.json # packages/announcement-controller/package.json # packages/app-metadata-controller/package.json # packages/approval-controller/package.json # packages/assets-controllers/package.json # packages/base-controller/package.json # packages/bridge-controller/package.json # packages/bridge-status-controller/jest.config.js # packages/bridge-status-controller/package.json # packages/build-utils/package.json # packages/chain-agnostic-permission/package.json # packages/claims-controller/package.json # packages/composable-controller/package.json # packages/controller-utils/package.json # packages/core-backend/package.json # packages/delegation-controller/package.json # packages/earn-controller/package.json # packages/eip-5792-middleware/package.json # packages/eip-7702-internal-rpc-middleware/package.json # packages/eip1193-permission-middleware/package.json # packages/ens-controller/package.json # packages/error-reporting-service/package.json # packages/eth-block-tracker/package.json # packages/eth-json-rpc-middleware/package.json # packages/eth-json-rpc-provider/package.json # packages/foundryup/package.json # packages/gas-fee-controller/package.json # packages/gator-permissions-controller/package.json # packages/json-rpc-engine/package.json # packages/json-rpc-middleware-stream/package.json # packages/keyring-controller/package.json # packages/logging-controller/package.json # packages/message-manager/package.json # packages/messenger/package.json # packages/multichain-account-service/package.json # packages/multichain-api-middleware/package.json # packages/multichain-network-controller/package.json # packages/multichain-transactions-controller/package.json # packages/name-controller/package.json # packages/network-controller/package.json # packages/network-enablement-controller/package.json # packages/notification-services-controller/package.json # packages/permission-controller/package.json # packages/permission-log-controller/package.json # packages/permission-log-controller/tests/PermissionLogController.test.ts # packages/phishing-controller/package.json # packages/polling-controller/package.json # packages/preferences-controller/package.json # packages/profile-sync-controller/package.json # packages/ramps-controller/package.json # packages/rate-limit-controller/package.json # packages/remote-feature-flag-controller/package.json # packages/sample-controllers/package.json # packages/seedless-onboarding-controller/package.json # packages/selected-network-controller/package.json # packages/shield-controller/package.json # packages/signature-controller/package.json # packages/subscription-controller/package.json # packages/transaction-controller/package.json # packages/transaction-pay-controller/package.json # packages/user-operation-controller/package.json # tests/setup.ts # tests/setupAfterEnv/nock.ts # yarn.lock

socket-security · 2026-02-02T15:54:28Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance	License
jest-environment-jsdom@27.5.1 ⏵ 29.7.0		⁺¹
jest-environment-node@27.5.1 ⏵ 29.7.0	⁺¹	⁺¹
jest@27.5.1 ⏵ 28.1.3		⁺¹
@typescript-eslint/parser@8.48.0 ⏵ 8.54.0
typescript-eslint@8.48.0 ⏵ 8.54.0
@tanstack/query-core@5.90.18 ⏵ 5.90.20	⁺¹	⁺¹
@metamask/snaps-utils@11.7.0 ⏵ 11.7.1			⁺³
@metamask/snaps-controllers@17.2.0 ⏵ 17.2.1	^-6	^-24	^-4	^-50
@types/jest@30.0.0 ⏵ 28.1.8		⁺¹
@typescript-eslint/eslint-plugin@8.48.0 ⏵ 8.54.0		⁺¹
ts-jest@27.1.5 ⏵ 28.0.8	⁺¹
@metamask/slip44@4.3.0 ⏵ 4.4.0	⁺¹	⁺¹	⁺⁶

View full report

socket-security · 2026-02-02T15:54:30Z

Warning

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm `http-proxy-agent` is 100.0% likely to have a medium risk anomaly Notes: The code fragment is a conventional HTTP proxy agent component handling optional proxy authentication and dynamic header adjustments. There is no evidence of malicious activity, data exfiltration, or supply-chain abuse within this fragment. The main concerns relate to reliance on internal Node.js fields (version fragility) and potential in-memory exposure of credentials, but these are standard operational caveats for proxy clients and do not indicate malice. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/jest-environment-jsdom@29.7.0` → `npm/http-proxy-agent@5.0.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/http-proxy-agent@5.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `source-map-support` is 100.0% likely to have a medium risk anomaly Notes: This file contains obfuscated logic, unusual error handling mechanisms, and dynamic code evaluation (e.g., eval usage) that deviate from typical coding practices. There is no confirmed indication of malicious intent, but these anomalies could pose a risk if leveraged by a malicious actor. Further review is advised to fully assess security implications. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/jest@28.1.3` → `npm/source-map-support@0.5.13` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/source-map-support@0.5.13`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

@types/jsdom@20.0.1
@typescript-eslint/eslint-plugin@8.54.0
tr46@3.0.0
@metamask/snaps-controllers@17.2.1

View full report

- Update jest-environment-jsdom to ^29.0.0 for Jest 28 compatibility - Update jest.environment.js files to use correct import syntax for v29: - JSDOMEnvironment = require('jest-environment-jsdom').default - NodeEnvironment = require('jest-environment-node').default - Add jest-environment-jsdom to packages using testEnvironment: 'jsdom' - Configure ts-jest with isolatedModules and diagnostics:false to skip type checking during tests (should be done separately via build:types) Affected packages: - assets-controllers - bridge-controller - bridge-status-controller - controller-utils - core-backend - keyring-controller - network-controller - notification-services-controller - profile-sync-controller - seedless-onboarding-controller - selected-network-controller - transaction-controller

- Add uuid to root devDependencies to fix n/no-extraneous-require error - Add import-x/no-unassigned-import disable comment for isomorphic-fetch require

Update packages that were missed during merge conflict resolution: - ai-controllers - analytics-data-regulation-controller - assets-controller - connectivity-controller - perps-controller - profile-metrics-controller - storage-service All packages now use: - @types/jest: ^28.0.0 - jest: ^28.0.0 - ts-jest: ^28.0.0

Update fake timers syntax from jest.useFakeTimers('modern') to jest.useFakeTimers() for Jest 28 compatibility.

…lity Fix fake timers usage in threshold cache cleanup test. The test was calling jest.useFakeTimers() mid-test after async operations completed with real timers, causing inconsistent Date.now() behavior. Updated to use fake timers from the start of the test and jest.setSystemTime() to control time advancement.

…-v28-2

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

packages/keyring-controller/package.json

cryptodev-2s · 2026-02-10T16:12:03Z

@SocketSecurity ignore npm/@types/jsdom@16.2.15

Gudahtt and others added 18 commits November 19, 2025 17:04

Add workaround for uuid incompatibility

6c035dd

WIP

608af12

WIP

b1fe19d

Explicitly specify environments and update them

b753669

Update to fix bug with fake timers

91d8b82

Fix depcheck lint error

c7ce6b1

Update test enviornment imports

fa93c24

Use modern timers everywhere (we already do on main, using legacy was…

6f4bdf0

… a mistake)

Fix lint error

9b947d4

fix: add export statement to make setup.ts unambiguous module

989ed2b

- Add 'export {};' at top of file to satisfy import-x/unambiguous lint rule - Fixes 'This module could be parsed as a valid script' error

fix tests

12dc701

Fix Jest 28 compatibility and formatting

b498c3b

- Remove eslint suppressions for nock.ts (no longer needed) - Adjust coverage thresholds in bridge-status-controller (lines/statements: 100 -> 99) - Format jest.useFakeTimers({}) calls consistently - Reorder imports in TestStrategy.test.ts

chore: update yarn.lock for Jest 28 compatibility

6e9bd12

fix: dedupe deps

8fc024b

cryptodev-2s changed the title ~~Chore/migrate jest to v28 2~~ chore: migrate Jest from v27 to v28 (2) Feb 2, 2026

cryptodev-2s added the no-changelog label Feb 2, 2026

cryptodev-2s force-pushed the chore/migrate-jest-to-v28-2 branch from 21baf16 to 90150e5 Compare February 2, 2026 16:37

cryptodev-2s added 5 commits February 2, 2026 17:43

fix: resolve ESLint errors for uuid and import-x/no-unassigned-import

e194052

- Add uuid to root devDependencies to fix n/no-extraneous-require error - Add import-x/no-unassigned-import disable comment for isomorphic-fetch require

fix: update permission-log-controller tests for Jest 28 compatibility

4545646

Update fake timers syntax from jest.useFakeTimers('modern') to jest.useFakeTimers() for Jest 28 compatibility.

cryptodev-2s force-pushed the chore/migrate-jest-to-v28-2 branch from 90150e5 to 83a183d Compare February 2, 2026 16:43

Merge branch 'main' into chore/migrate-jest-to-v28-2

279f00a

Merge remote-tracking branch 'origin/main' into chore/migrate-jest-to…

fe08988

…-v28-2

cryptodev-2s marked this pull request as ready for review February 10, 2026 12:59

cryptodev-2s requested review from a team as code owners February 10, 2026 12:59

fix: restore lint-build-test.yml

7ac76e3

cursor bot reviewed Feb 10, 2026

View reviewed changes

packages/keyring-controller/package.json Show resolved Hide resolved

cryptodev-2s force-pushed the chore/migrate-jest-to-v28-2 branch 2 times, most recently from a381b1f to 7ac76e3 Compare February 10, 2026 14:10

cryptodev-2s force-pushed the chore/migrate-jest-to-v28-2 branch 3 times, most recently from 40f282f to 7ac76e3 Compare February 10, 2026 16:40

Merge branch 'main' into chore/migrate-jest-to-v28-2

34bb6f4

cryptodev-2s closed this Feb 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: migrate Jest from v27 to v28#7812

chore: migrate Jest from v27 to v28#7812
cryptodev-2s wants to merge 52 commits intomainfrom
chore/migrate-jest-to-v28-2

cryptodev-2s commented Feb 2, 2026 •

edited by cursor bot

Loading

Uh oh!

socket-security bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

cryptodev-2s commented Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Uh oh!

Conversation

cryptodev-2s commented Feb 2, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

References

Checklist

Uh oh!

socket-security bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cryptodev-2s commented Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

cryptodev-2s commented Feb 2, 2026 •

edited by cursor bot

Loading

socket-security bot commented Feb 2, 2026 •

edited

Loading

socket-security bot commented Feb 2, 2026 •

edited

Loading