feat: Update RemoteFeatureFlag controller version to latest (#38584)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

This PR aims to update `RemoteFeatureFlagController` version to latest.
As `clientVersion` is introduced as new breaking change, PR also
includes base version of the app while initialising the controller.

As this is not a user facing feature - no changelog needed. 

Related core PR: MetaMask/core#7277

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/38584?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes: Extension part of MetaMask/core#7285

## **Manual testing steps**

N/A

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [X] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Upgrades the remote feature flag controller to v3 and begins sending
the app’s base SemVer as `clientVersion`, adding a helper and tests and
updating LavaMoat policies.
> 
> - **Controllers**:
> - Pass `clientVersion: getBaseSemVerVersion()` when initializing
`RemoteFeatureFlagController` in
`app/scripts/controller-init/remote-feature-flag-controller-init.ts`.
> - **Feature Flags**:
> - Add `getBaseSemVerVersion` in
`shared/lib/feature-flags/version-gating.ts` to return base SemVer;
include comprehensive unit tests.
> - **Tests**:
> - Update `remote-feature-flag-controller-init.test.ts` to expect
`clientVersion`.
> - **Security/Policies**:
> - LavaMoat policies: allow `@metamask/utils` for
`@metamask/remote-feature-flag-controller` across build variants.
> - **Dependencies**:
> - Bump `@metamask/remote-feature-flag-controller` to `^3.0.0`; update
lockfile.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7c17943. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: MetaMask Bot <[email protected]>

Author: OGPoyraz

app/scripts/controller-init/remote-feature-flag-controller-init.test.ts

@@ -118,6 +118,7 @@ describe('RemoteFeatureFlagControllerInit', () => {
       fetchInterval: expect.any(Number),
       getMetaMetricsId: expect.any(Function),
       clientConfigApiService: expect.any(ClientConfigApiService),
+      clientVersion: expect.any(String),
     });
   });
 });

app/scripts/controller-init/remote-feature-flag-controller-init.ts

@@ -8,6 +8,7 @@ import {
 } from '@metamask/remote-feature-flag-controller';
 import { ENVIRONMENT } from '../../../development/build/constants';
 import { previousValueComparator } from '../lib/util';
+import { getBaseSemVerVersion } from '../../../shared/lib/feature-flags/version-gating';
 import { ControllerInitFunction } from './types';
 import {
   RemoteFeatureFlagControllerInitMessenger,
@@ -89,6 +90,7 @@ export const RemoteFeatureFlagControllerInit: ControllerInitFunction<
     disabled: getIsDisabled(),
     getMetaMetricsId: () =>
       initMessenger.call('MetaMetricsController:getMetaMetricsId'),
+    clientVersion: getBaseSemVerVersion(),
     clientConfigApiService: new ClientConfigApiService({
       fetch: globalThis.fetch.bind(globalThis),
       config: {

lavamoat/browserify/beta/policy.json

@@ -2023,6 +2023,7 @@
       "packages": {
         "@metamask/base-controller": true,
         "@metamask/controller-utils": true,
+        "@metamask/utils": true,
         "uuid": true
       }
     },

lavamoat/browserify/experimental/policy.json

@@ -2023,6 +2023,7 @@
       "packages": {
         "@metamask/base-controller": true,
         "@metamask/controller-utils": true,
+        "@metamask/utils": true,
         "uuid": true
       }
     },

lavamoat/browserify/flask/policy.json

@@ -2023,6 +2023,7 @@
       "packages": {
         "@metamask/base-controller": true,
         "@metamask/controller-utils": true,
+        "@metamask/utils": true,
         "uuid": true
       }
     },

lavamoat/browserify/main/policy.json

@@ -2023,6 +2023,7 @@
       "packages": {
         "@metamask/base-controller": true,
         "@metamask/controller-utils": true,
+        "@metamask/utils": true,
         "uuid": true
       }
     },

lavamoat/webpack/mv2/policy.json

@@ -1952,6 +1952,7 @@
       "packages": {
         "@metamask/base-controller": true,
         "@metamask/controller-utils": true,
+        "@metamask/utils": true,
         "uuid": true
       }
     },

package.json

@@ -356,7 +356,7 @@
     "@metamask/profile-sync-controller": "^26.0.0",
     "@metamask/providers": "^22.1.1",
     "@metamask/rate-limit-controller": "^7.0.0",
-    "@metamask/remote-feature-flag-controller": "^2.0.0",
+    "@metamask/remote-feature-flag-controller": "^3.0.0",
     "@metamask/rpc-errors": "^7.0.0",
     "@metamask/safe-event-emitter": "^3.1.1",
     "@metamask/scure-bip39": "^2.0.3",

shared/lib/feature-flags/version-gating.test.ts

@@ -1,5 +1,6 @@
 import semver from 'semver';
 import {
+  getBaseSemVerVersion,
   hasMinimumRequiredVersion,
   validatedVersionGatedFeatureFlag,
   VersionGatedFeatureFlag,
@@ -265,4 +266,49 @@ describe('version-gating', () => {
       });
     });
   });
+
+  describe('getBaseSemVerVersion', () => {
+    const semverParseMock = semver.parse as jest.MockedFunction<
+      typeof semver.parse
+    >;
+
+    it('returns base version from package.json version', () => {
+      semverParseMock.mockReturnValue({
+        major: 12,
+        minor: 5,
+        patch: 0,
+      } as semver.SemVer);
+
+      expect(getBaseSemVerVersion()).toBe('12.5.0');
+      expect(semverParseMock).toHaveBeenCalledWith('12.5.0');
+    });
+
+    it('strips prerelease tag when parsing version', () => {
+      semverParseMock.mockReturnValue({
+        major: 13,
+        minor: 13,
+        patch: 0,
+        prerelease: ['experimental', 0],
+      } as unknown as semver.SemVer);
+
+      expect(getBaseSemVerVersion()).toBe('13.13.0');
+    });
+
+    it('strips build metadata when parsing version', () => {
+      semverParseMock.mockReturnValue({
+        major: 1,
+        minor: 0,
+        patch: 0,
+        build: ['build', '123'],
+      } as unknown as semver.SemVer);
+
+      expect(getBaseSemVerVersion()).toBe('1.0.0');
+    });
+
+    it('returns unknown when semver.parse returns null', () => {
+      semverParseMock.mockReturnValue(null);
+
+      expect(getBaseSemVerVersion()).toBe('unknown');
+    });
+  });
 });

shared/lib/feature-flags/version-gating.ts

@@ -8,6 +8,21 @@ export type VersionGatedFeatureFlag = {
 
 const APP_VERSION = packageJson.version;
 
+/**
+ * Extracts the base 3-part SemVer version (major.minor.patch) from the package.json version.
+ * Strips any prerelease or build metadata suffixes
+ *
+ * @returns The base version string (e.g., '13.13.0' or '13.2.3'), or 'unknown' if parsing fails
+ */
+export const getBaseSemVerVersion = (): string => {
+  const parsed = semver.parse(APP_VERSION);
+  if (!parsed) {
+    return 'unknown';
+  }
+
+  return `${parsed.major}.${parsed.minor}.${parsed.patch}`;
+};
+
 export const hasMinimumRequiredVersion = (
   minRequiredVersion?: string | null,
 ) => {