feat: enable require-pr-numbers flag for changelog generation

[Qbandev]

Description

This PR updates the changelog workflows to use the new @metamask/auto-changelog@5.3.0 which always filters out direct commits without PR numbers. This ensures all changelog entries represent reviewed and approved changes.

Changes:

• Update @metamask/auto-changelog from ^5.1.0 to ^5.3.0
• Update update-release-changelog workflow to use github-tools@v1.1.2

The --requirePrNumbers flag is now always applied by default in github-tools, so no additional configuration is needed.

This aligns metamask-mobile with metamask-extension for consistent changelog generation across platforms.

Changelog

CHANGELOG entry: null

Related issues

• Related to: MetaMask/metamask-extension#38520
• ✅ MetaMask/auto-changelog#253 - Merged (v5.3.0)
• ✅ MetaMask/github-tools#181 - Merged and released as v1.1.2

Manual testing steps

Feature: Changelog generation with PR number filtering

  Scenario: Only PR commits appear in changelog
    Given a release branch exists

    When a commit with an associated PR is merged
    Then the changelog should include that commit

    When a direct commit without PR is pushed
    Then the changelog should NOT include that commit

Tested on consensys-test/metamask-extension-test with release/1100.0.0:

• Generated changelog

Screenshots/Recordings

Before

Direct commits without PR numbers would appear in the changelog.

After

Only commits with PR numbers (representing reviewed changes) appear in the changelog.

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: None (no tests recommended)
• Risk Level: low
• AI Confidence: 95%

click to see 🤖 AI reasoning details

The changes in this PR are limited to:

1. @metamask/auto-changelog bump (5.1.0 → 5.3.0): This is a dev dependency used exclusively for generating changelogs during the release process. It is not imported or used in any runtime application code (verified by searching the codebase).

2. GitHub workflow update: The update-release-changelog.yml workflow was updated to use newer versions of MetaMask GitHub tools (v1.1.0 → v1.1.2). This workflow is only triggered during release processes and has no impact on the application code.

3. yarn.lock: Simply reflects the auto-changelog version update.

None of these changes:

• Affect runtime application code
• Modify any features, UI components, or business logic
• Impact any user-facing functionality
• Touch any E2E test infrastructure

While package.json is flagged as CRITICAL, in this specific case the change is purely a dev tooling update with zero impact on application behavior. No E2E tests are necessary to validate these changes.

View GitHub Actions results

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​metamask/​auto-changelog@​5.1.0 ⏵ 5.3.0	-2			-7

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Network access: npm @metamask/auto-changelog in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@metamask/auto-changelog@5.3.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@5.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud