chore(runway): cherry-pick fix: cp-7.60.0 bump transaction controller and transaction pay controller versions

[runway-github]

• fix: cp-7.60.0 bump transaction controller and transaction pay controller versions (fix: cp-7.60.0 bump transaction controller and transaction pay controller versions #23029)

Description

Update controller versions for @metamask/transaction-controller and
@metamask/transaction-pay-controller.

Changelog

CHANGELOG entry: null

Related issues

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I’ve followed MetaMask Contributor
  Docs and MetaMask Mobile
  Coding
  Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format
  if applicable
• I’ve applied the right labels on the PR (see labeling
  guidelines).
  Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the
  app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described
  in the ticket it closes and includes the necessary testing evidence such
  as recordings and or screenshots.

---

Note

Upgrade @metamask/transaction-controller (61.3.0 → 62.0.0) and @metamask/transaction-pay-controller (7.x → 9.x), updating patches and aligning peer deps; refresh yarn.lock accordingly.

• Dependencies:
  • Upgrade @metamask/transaction-controller to 62.0.0 (patched reference updated in resolutions and dependencies).
  • Upgrade @metamask/transaction-pay-controller to ^9.0.0.
  • Align related peer deps in lockfile:
    • @metamask/controller-utils → ^11.16.0.
    • Peers: accounts-controller ^35, gas-fee-controller ^26, network-controller ^26.
    • Transaction Pay peers: assets-controllers ^90, bridge(-status)-controller ^62, gas-fee-controller ^26, network-controller ^26, transaction-controller ^62.
  • Update yarn.lock entries to reflect new versions and checksums.

^{Written by Cursor Bugbot for commit f6b6f4c. This will update automatically on new commits. Configure here.}

cfd16f1

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​metamask/​controller-utils@​11.15.0 ⏵ 11.16.0			+1	+2
	npm/​@​metamask/​transaction-pay-controller@​7.0.0 ⏵ 9.0.0				+1
	npm/​@​metamask/​transaction-controller@​62.0.0

View full report

[cursor]

Bug: Patch file version mismatch with upgraded package

The @metamask/transaction-controller package is upgraded from version 61.3.0 to 62.0.0, but the patch file reference still points to @metamask-transaction-controller-npm-61.0.0-cccac388c7.patch. This patch was created for version 61.0.0 and may not apply correctly to version 62.0.0, potentially causing the patch to fail silently, apply incorrectly, or miss critical changes between versions. The patch adds swapsTransactions metadata which might not be properly applied to the new version's structure.

 

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeCore, SmokeWalletPlatform, SmokeAccounts
• Risk Level: medium
• AI Confidence: 45%

click to see 🤖 AI reasoning details

Only package.json (CRITICAL) and yarn.lock were modified, indicating a dependency update. Without being able to view the git diff to determine which specific dependencies were updated, I'm taking a conservative approach.

INVESTIGATION ATTEMPTS:

• Attempted to get git diff for package.json - failed
• Read full package.json file - too large to identify specific changes
• Checked CHANGELOG - no recent dependency update notes
• Unable to determine exact dependency changes

RISK FACTORS:

1. package.json is marked CRITICAL by the system
2. Dependency changes can have wide-ranging impacts on app functionality
3. Unknown which dependencies changed (could be controllers, React Native, crypto libs, etc.)
4. MetaMask Mobile has many interconnected features

SELECTED TAGS RATIONALE:

• SmokeCore: Essential to verify core wallet functionality still works
• SmokeWalletPlatform: Tests core wallet operations, accounts, network switching - critical infrastructure
• SmokeAccounts: Account management is fundamental and often affected by controller updates

WHY MEDIUM RISK:

• This is a dependency-only change (no code logic changes visible)
• If it were a major breaking change, it would likely include code changes too
• However, without knowing specifics, cannot rule out impactful updates

CONFIDENCE LEVEL (45%):

• LOW confidence due to inability to see actual changes
• Cannot determine which dependencies were updated
• Cannot assess if updates are patch/minor/major versions
• Cannot identify if critical packages (controllers, React Native, crypto) were affected
• Making educated guess based on general best practices

RECOMMENDATION:
If the PR description or commit messages provide details about which dependencies were updated, that information should be used to make a more targeted decision. Consider running additional tags if the dependency changes are known to affect specific features (e.g., if swap-related packages updated, run SmokeSwaps).

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[metamaskbot]

No release label on PR. Adding release label release-7.60.0 on PR, as PR was cherry-picked in branch 7.60.0.