Skip to content

Conversation

@ffmcgee725
Copy link
Member

@ffmcgee725 ffmcgee725 commented Sep 23, 2025

Explanation

Uniswap reported a bug in slack here where MetaMask was unpermitting any EVM connections for a dapp if that dapp used the solana wallet standard provider to make a connect request and then cancelled it.

This call to disconnect() is happening outside of our packages and is not related to a previous but similar bug where our own wallet-standard provider was calling wallet_revokeSession when receiving an empty solana accountsChanged event.

To fix this, this PR updates our solana wallet-standard provider to only revoke the solana scopes when it is asked to disconnect, via the update made to multichain-api-client on MetaMask/multichain-api-client#75.

References

@ffmcgee725 ffmcgee725 requested a review from a team as a code owner September 23, 2025 12:57
@socket-security
Copy link

socket-security bot commented Sep 23, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​metamask/​multichain-api-client@​0.6.4 ⏵ 0.8.0100 +1100100 +1100 +8100

View full report

@ffmcgee725 ffmcgee725 changed the title chore: update multichain api client package feat: allow partial revokes via wallet_revokeSession Sep 23, 2025
@EdouardBougon
Copy link
Contributor

There is a new release MetaMask/multichain-api-client#78

@ffmcgee725
Copy link
Member Author

@EdouardBougon it seems like 0.8.0 is not yet published. Would you prefer if this PR bumps it up after it's actually been deployed to npm ?

@EdouardBougon
Copy link
Contributor

Yes, sorry — it was released after my message: https://www.npmjs.com/package/@metamask/multichain-api-client?activeTab=versions

@ffmcgee725 ffmcgee725 merged commit 025f661 into main Sep 23, 2025
22 checks passed
github-merge-queue bot pushed a commit to MetaMask/metamask-extension that referenced this pull request Sep 24, 2025
…onnection is rejected (#36283)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

When a dapp connects to MetaMask via EVM and the user *rejects a
subsequent connection request for SVM*, the *existing EVM connection is
closed*. This can potentially break dapp flows and edge cases where
maintaining the EVM connection is critical.

To fix this, we implemented partial revoking into the
`wallet_revokeSession` handler on
MetaMask/core#6668 so that we can then update
our solana wallet-standard provider would only revoke the solana scopes
when it is asked to disconnect, here
MetaMask/solana-wallet-standard#53.

This PR bumps all necessary packages for this to take place, fixing the
undesired EVM permissions revoke when a solana wallet standard
connection is refused.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixes existing EVM permissions removed when a Solana
Wallet Standard connection is rejected

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413

## **Manual testing steps**

1. Go to https://orca.so
2. On dev tools console, call `window.ethereum.enable()`
3. Proceed with permission (make sure _NO PERMISSIONS for Solana are
checked_) and confirm
4. Click "Connect Wallet" button, choose "MetaMask" and proceed.
5. When wallet UI prompts to accept connection, click "Cancel" button.
6. Now, on dev tools console, call 
```
await window.ethereum.request({
 "method": "wallet_getPermissions",
 "params": [],
});
```
7. Permission for `eth_accounts` should still be present with the
permitted account in `caveats` array.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**


https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d

### **After**


https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
github-merge-queue bot pushed a commit to MetaMask/metamask-extension that referenced this pull request Sep 24, 2025
…onnection is rejected (#36283)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

When a dapp connects to MetaMask via EVM and the user *rejects a
subsequent connection request for SVM*, the *existing EVM connection is
closed*. This can potentially break dapp flows and edge cases where
maintaining the EVM connection is critical.

To fix this, we implemented partial revoking into the
`wallet_revokeSession` handler on
MetaMask/core#6668 so that we can then update
our solana wallet-standard provider would only revoke the solana scopes
when it is asked to disconnect, here
MetaMask/solana-wallet-standard#53.

This PR bumps all necessary packages for this to take place, fixing the
undesired EVM permissions revoke when a solana wallet standard
connection is refused.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixes existing EVM permissions removed when a Solana
Wallet Standard connection is rejected

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413

## **Manual testing steps**

1. Go to https://orca.so
2. On dev tools console, call `window.ethereum.enable()`
3. Proceed with permission (make sure _NO PERMISSIONS for Solana are
checked_) and confirm
4. Click "Connect Wallet" button, choose "MetaMask" and proceed.
5. When wallet UI prompts to accept connection, click "Cancel" button.
6. Now, on dev tools console, call 
```
await window.ethereum.request({
 "method": "wallet_getPermissions",
 "params": [],
});
```
7. Permission for `eth_accounts` should still be present with the
permitted account in `caveats` array.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**


https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d

### **After**


https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
github-merge-queue bot pushed a commit to MetaMask/metamask-extension that referenced this pull request Sep 24, 2025
…onnection is rejected (#36283)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

When a dapp connects to MetaMask via EVM and the user *rejects a
subsequent connection request for SVM*, the *existing EVM connection is
closed*. This can potentially break dapp flows and edge cases where
maintaining the EVM connection is critical.

To fix this, we implemented partial revoking into the
`wallet_revokeSession` handler on
MetaMask/core#6668 so that we can then update
our solana wallet-standard provider would only revoke the solana scopes
when it is asked to disconnect, here
MetaMask/solana-wallet-standard#53.

This PR bumps all necessary packages for this to take place, fixing the
undesired EVM permissions revoke when a solana wallet standard
connection is refused.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixes existing EVM permissions removed when a Solana
Wallet Standard connection is rejected

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413

## **Manual testing steps**

1. Go to https://orca.so
2. On dev tools console, call `window.ethereum.enable()`
3. Proceed with permission (make sure _NO PERMISSIONS for Solana are
checked_) and confirm
4. Click "Connect Wallet" button, choose "MetaMask" and proceed.
5. When wallet UI prompts to accept connection, click "Cancel" button.
6. Now, on dev tools console, call 
```
await window.ethereum.request({
 "method": "wallet_getPermissions",
 "params": [],
});
```
7. Permission for `eth_accounts` should still be present with the
permitted account in `caveats` array.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**


https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d

### **After**


https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
jeffsmale90 pushed a commit to MetaMask/metamask-extension that referenced this pull request Sep 24, 2025
…onnection is rejected (#36283)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

When a dapp connects to MetaMask via EVM and the user *rejects a
subsequent connection request for SVM*, the *existing EVM connection is
closed*. This can potentially break dapp flows and edge cases where
maintaining the EVM connection is critical.

To fix this, we implemented partial revoking into the
`wallet_revokeSession` handler on
MetaMask/core#6668 so that we can then update
our solana wallet-standard provider would only revoke the solana scopes
when it is asked to disconnect, here
MetaMask/solana-wallet-standard#53.

This PR bumps all necessary packages for this to take place, fixing the
undesired EVM permissions revoke when a solana wallet standard
connection is refused.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixes existing EVM permissions removed when a Solana
Wallet Standard connection is rejected

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413

## **Manual testing steps**

1. Go to https://orca.so
2. On dev tools console, call `window.ethereum.enable()`
3. Proceed with permission (make sure _NO PERMISSIONS for Solana are
checked_) and confirm
4. Click "Connect Wallet" button, choose "MetaMask" and proceed.
5. When wallet UI prompts to accept connection, click "Cancel" button.
6. Now, on dev tools console, call 
```
await window.ethereum.request({
 "method": "wallet_getPermissions",
 "params": [],
});
```
7. Permission for `eth_accounts` should still be present with the
permitted account in `caveats` array.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**


https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d

### **After**


https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
jeffsmale90 pushed a commit to MetaMask/metamask-extension that referenced this pull request Sep 24, 2025
…onnection is rejected (#36283)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

When a dapp connects to MetaMask via EVM and the user *rejects a
subsequent connection request for SVM*, the *existing EVM connection is
closed*. This can potentially break dapp flows and edge cases where
maintaining the EVM connection is critical.

To fix this, we implemented partial revoking into the
`wallet_revokeSession` handler on
MetaMask/core#6668 so that we can then update
our solana wallet-standard provider would only revoke the solana scopes
when it is asked to disconnect, here
MetaMask/solana-wallet-standard#53.

This PR bumps all necessary packages for this to take place, fixing the
undesired EVM permissions revoke when a solana wallet standard
connection is refused.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixes existing EVM permissions removed when a Solana
Wallet Standard connection is rejected

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413

## **Manual testing steps**

1. Go to https://orca.so
2. On dev tools console, call `window.ethereum.enable()`
3. Proceed with permission (make sure _NO PERMISSIONS for Solana are
checked_) and confirm
4. Click "Connect Wallet" button, choose "MetaMask" and proceed.
5. When wallet UI prompts to accept connection, click "Cancel" button.
6. Now, on dev tools console, call 
```
await window.ethereum.request({
 "method": "wallet_getPermissions",
 "params": [],
});
```
7. Permission for `eth_accounts` should still be present with the
permitted account in `caveats` array.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**


https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d

### **After**


https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
github-merge-queue bot pushed a commit to MetaMask/metamask-mobile that referenced this pull request Sep 25, 2025
…onnection is rejected (#20309)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

When a dapp connects to MetaMask via EVM and the user *rejects a
subsequent connection request for SVM*, the *existing EVM connection is
closed*. This can potentially break dapp flows and edge cases where
maintaining the EVM connection is critical.

To fix this, we implemented partial revoking into the
`wallet_revokeSession` handler on
MetaMask/core#6668 so that we can then update
our solana wallet-standard provider would only revoke the solana scopes
when it is asked to disconnect, here
MetaMask/solana-wallet-standard#53.

This PR bumps all necessary packages for this to take place, fixing the
undesired EVM permissions revoke when a solana wallet standard
connection is refused.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixes existing EVM permissions removed when a Solana
Wallet Standard connection is rejected

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413

## **Manual testing steps**

```gherkin
Feature: fix EVM permmissions removed when Solana Wallet Standard connection rejected

  Scenario: user rejects Solana Wallet Standard connection
    Given there are existing EVM permissions for the dapp

    When user rejects Solana Wallet Standard connection
    Then EVM permissions should still exist, and not be revoked
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
weitingsun pushed a commit to MetaMask/metamask-mobile that referenced this pull request Oct 15, 2025
…onnection is rejected (#20309)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

When a dapp connects to MetaMask via EVM and the user *rejects a
subsequent connection request for SVM*, the *existing EVM connection is
closed*. This can potentially break dapp flows and edge cases where
maintaining the EVM connection is critical.

To fix this, we implemented partial revoking into the
`wallet_revokeSession` handler on
MetaMask/core#6668 so that we can then update
our solana wallet-standard provider would only revoke the solana scopes
when it is asked to disconnect, here
MetaMask/solana-wallet-standard#53.

This PR bumps all necessary packages for this to take place, fixing the
undesired EVM permissions revoke when a solana wallet standard
connection is refused.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixes existing EVM permissions removed when a Solana
Wallet Standard connection is rejected

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413

## **Manual testing steps**

```gherkin
Feature: fix EVM permmissions removed when Solana Wallet Standard connection rejected

  Scenario: user rejects Solana Wallet Standard connection
    Given there are existing EVM permissions for the dapp

    When user rejects Solana Wallet Standard connection
    Then EVM permissions should still exist, and not be revoked
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants