chore(deps-dev): bump @metamask/auto-changelog from 5.1.0 to 5.2.0 #853

dependabot · 2025-11-26T19:13:43Z

Bumps @metamask/auto-changelog from 5.1.0 to 5.2.0.

Release notes

Sourced from @metamask/auto-changelog's releases.

5.2.0

Added

Deduplicate commits with no PR number in subject (#254)

For commits with no PR number in the subject (non-"Squash & Merge" commits), deduplication now checks if exact description text already exists in changelog

Merge commits are deduplicated using commit body instead of the generic merge subject

Changelog

Sourced from @metamask/auto-changelog's changelog.

[5.2.0]

Added

Deduplicate commits with no PR number in subject (#254)

For commits with no PR number in the subject (non-"Squash & Merge" commits), deduplication now checks if exact description text already exists in changelog

Merge commits are deduplicated using commit body instead of the generic merge subject

Commits

5586ef8 5.2.0 (#260)
c267d3a fix(INFRA-3081): implement duplicate detection for all commit types (#254)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Upgrade @metamask/auto-changelog devDependency to 5.2.0 across packages and update the lockfile.

Dependencies:
- Bump devDependency @metamask/auto-changelog from ^5.1.0 to ^5.2.0 in:
  - packages/design-system-react-native/package.json
  - packages/design-system-react/package.json
  - packages/design-system-shared/package.json
  - packages/design-system-tailwind-preset/package.json
  - packages/design-system-twrnc-preset/package.json
  - packages/design-tokens/package.json
- Update yarn.lock accordingly.

^{Written by Cursor Bugbot for commit a959a6e. This will update automatically on new commits. Configure here.}

Bumps [@metamask/auto-changelog](https://github.com/MetaMask/auto-changelog) from 5.1.0 to 5.2.0. - [Release notes](https://github.com/MetaMask/auto-changelog/releases) - [Changelog](https://github.com/MetaMask/auto-changelog/blob/main/CHANGELOG.md) - [Commits](MetaMask/auto-changelog@v5.1.0...v5.2.0) --- updated-dependencies: - dependency-name: "@metamask/auto-changelog" dependency-version: 5.2.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

socket-security · 2025-11-26T19:14:38Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@metamask/auto-changelog@5.1.0 ⏵ 5.2.0	^-2			^-9

View full report

socket-security · 2025-11-26T19:14:42Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Network access: npm `@metamask/auto-changelog` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/design-system-react-native/package.json → `npm/@metamask/[email protected]` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@metamask/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2025-11-26T19:15:14Z

📖 Storybook Preview

View PR Storybook

georgewrmarshall · 2025-11-27T18:20:42Z

@SocketSecurity ignore npm/@metamask/[email protected]

…log-5.2.0

github-actions · 2025-11-27T18:22:38Z

📖 Storybook Preview

View PR Storybook

## **Description** This PR releases version 17.0.0 of the MetaMask Design System, featuring important fixes for mobile font compatibility, the addition of the ButtonHero component to React, export fixes for React Native, and various dependency updates including ESLint configuration upgrades. ## **Included PRs** #836, #837, #838, #840, #843, #845, #846, #847, #848, #850, #851, #852, #853, #854, #855, #856, #857, #858, #859, #861, #862, #863, #864 ## **Manual testing steps** 1. Check package.json version bumps align with included changes 2. Check changelog accurately reflects the release ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > Release 17.0.0 introducing React `ButtonHero`, RN font naming changes and TWRNC preset font family rename (both breaking), plus RN export fix and dependency updates. > > - **Release 17.0.0** > - Bump root `package.json` to `17.0.0`. > - **React (`@metamask/[email protected]`)** > - Add `ButtonHero` component for prominent CTAs. > - Update `@metamask/utils` peer to `^11.8.1`. > - **React Native (`@metamask/[email protected]`)** > - BREAKING: Rename font files to hyphenated PostScript format for iOS Metro compatibility. > - Export missing `TextButtonSize` enum. > - Peer: require `@metamask/design-system-twrnc-preset@^0.3.0`; update `@metamask/utils` peer. > - **TWRNC preset (`@metamask/[email protected]`)** > - BREAKING: Rename font family names to hyphenated PostScript format for iOS/expo-font. > - **Changelogs** > - Update `CHANGELOG.md` links and entries for all packages. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 9a90311. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 26, 2025

dependabot bot requested a review from a team as a code owner November 26, 2025 19:13

dependabot bot added the javascript Pull requests that update Javascript code label Nov 26, 2025

Merge branch 'main' into dependabot/npm_and_yarn/metamask/auto-change…

a959a6e

…log-5.2.0

georgewrmarshall approved these changes Nov 27, 2025

View reviewed changes

georgewrmarshall merged commit 335097d into main Nov 27, 2025
42 checks passed

georgewrmarshall deleted the dependabot/npm_and_yarn/metamask/auto-changelog-5.2.0 branch November 27, 2025 18:31

georgewrmarshall mentioned this pull request Dec 9, 2025

Release/17.0.0 #865

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps-dev): bump @metamask/auto-changelog from 5.1.0 to 5.2.0 #853

chore(deps-dev): bump @metamask/auto-changelog from 5.1.0 to 5.2.0 #853

Uh oh!

dependabot bot commented on behalf of github Nov 26, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Nov 26, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Nov 26, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 26, 2025

Uh oh!

georgewrmarshall commented Nov 27, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

chore(deps-dev): bump @metamask/auto-changelog from 5.1.0 to 5.2.0 #853

chore(deps-dev): bump @metamask/auto-changelog from 5.1.0 to 5.2.0 #853

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

5.2.0

Added

[5.2.0]

Added

Uh oh!

socket-security bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 26, 2025

📖 Storybook Preview

Uh oh!

georgewrmarshall commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 27, 2025

📖 Storybook Preview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot bot commented on behalf of github Nov 26, 2025 •

edited

Loading

socket-security bot commented Nov 26, 2025 •

edited

Loading

socket-security bot commented Nov 26, 2025 •

edited

Loading

georgewrmarshall commented Nov 27, 2025 •

edited

Loading