chore: Migrate SIWE dependency to @signinwithethereum/siwe v4 by caveman-eth · Pull Request #8497 · MetaMask/core

caveman-eth · 2026-04-16T18:42:40Z

Superseeds #8419 (couldn't reopen due to force-push).

Explanation

Current state

The monorepo depends on two SIWE (Sign-In With Ethereum / EIP-4361) packages originally maintained by Spruce:

@spruceid/siwe-parser v2.1.0 — used by @metamask/controller-utils to detect and parse SIWE messages via detectSIWE()
siwe v2.3.2 — used by @metamask/profile-sync-controller to construct SIWE login messages via new SiweMessage({...}).prepareMessage()

The Spruce `siwe` package is no longer actively maintained.

Stewardship of the SIWE standard has moved to the Ethereum Identity Foundation (GitHub).
@signinwithethereum/siwe is the official successor TypeScript implementation.

Similar migrations:

x402-foundation/x402 x402-foundation/x402#1917,
magiclabs/magic-js magiclabs/magic-js#1074

What this PR does

Swaps the abandoned packages for the actively maintained successors. The ParsedMessage and SiweMessage class APIs are identical - same constructors, same fields, same methods. This is purely a dependency swap with import path updates.

Files changed:

Package	File	Change
`controller-utils`	`package.json`	Replaced dependency
`controller-utils`	`src/siwe.ts`	Import path updated
`controller-utils`	`src/siwe.test.ts`	Import path updated
`profile-sync-controller`	`package.json`	Replaced dependency
`profile-sync-controller`	`src/sdk/authentication-jwt-bearer/flow-siwe.ts`	Import path updated

EIP-55 patches in client repos become obsolete

The old version strictly rejected non checksummed Ethereum addresses in SIWE messages. Because many dApps produce lowercase addresses, both MetaMask client repos maintain patches to disable the check — otherwise detectSIWE returns { isSIWEMessage: false } and users don't see the specialized SIWE approval screen.

@signinwithethereum/siwe-parser v4.2.0 (release notes) relaxes this:

All-lowercase and all-uppercase addresses now parse successfully with a non-fatal warning on the new warnings: string[] field of ParsedMessage
Only mixed-case addresses with an incorrect checksum still fail to parse
Verification is case-insensitive for EOA signature recovery
Object-constructed SiweMessage instances are normalized to EIP-55

If the client repos upgrade to this version of controller-utils, they can delete these patches and any related package.json resolutions:

References

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
Changes SIWE parsing and login message construction on auth-related paths; APIs are intended to be compatible, but v4.2.0 address-checksum behavior differs from the old strict parser.

Overview
Replaces unmaintained Spruce SIWE packages with @signinwithethereum successors (^4.2.0) in @metamask/controller-utils and @metamask/profile-sync-controller.

controller-utils swaps @spruceid/siwe-parser for @signinwithethereum/siwe-parser and updates imports in siwe.ts / tests. detectSIWE still uses ParsedMessage the same way.

profile-sync-controller drops the siwe package for @signinwithethereum/siwe and updates flow-siwe.ts so JWT SIWE login still builds messages via new SiweMessage({...}).prepareMessage().

Changelogs note that v4.2.0 relaxes EIP-55 parsing: all-lowercase or all-uppercase addresses parse (with optional warnings); only bad mixed-case checksums fail. That may let extension/mobile remove local parser patches once they pick up this core release.

^{Reviewed by Cursor Bugbot for commit 0ae4c09. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-04-16T18:43:59Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@signinwithethereum/siwe-parser@4.2.0
	@signinwithethereum/siwe@4.2.0

View full report

Swap SpruceID-maintained SIWE packages for the @signinwithethereum scoped packages and update usages. Update package.json dependencies and imports (controller-utils: siwe.ts, siwe.test.ts; profile-sync-controller: flow-siwe.ts) and add changelog notes describing the migration. Uses @signinwithethereum/siwe-parser and @signinwithethereum/siwe ^4.2.0 — maintained by the Ethereum Identity Foundation and backward-compatible (parser v4.2.0 relaxes EIP-55 checksum enforcement and surfaces non-fatal warnings).

Replace placeholder PR links [#XXXX] with the actual PR number [MetaMask#8497] in CHANGELOG.md for packages/controller-utils and packages/profile-sync-controller. These entries document the replacement of the old siwe packages with the @signinwithethereum scoped packages.

caveman-eth · 2026-05-04T14:15:25Z

Let me know if you guys have any questions around this.

caveman-eth · 2026-08-31T17:24:12Z

bumping this up

OGPoyraz · 2026-09-01T08:06:31Z

Thanks for the PR @caveman-eth

PR looks good to me and hopefully be ready after fixing conflicts 🙏

…ncies-2

caveman-eth · 2026-09-01T10:45:22Z

Thanks for the PR @caveman-eth

PR looks good to me and hopefully be ready after fixing conflicts 🙏

Hey great - I've resolved the conflicts and merged in main

OGPoyraz · 2026-09-01T13:35:28Z

Hey @caveman-eth I think we have two issues here:

Blocking: TS1479 build error from @signinwithethereum/siwe-parser@4.2.0's packaging
@signinwithethereum/siwe-parser@4.2.0's package.json sets "type": "module", but only ships one unconditional .d.ts (no separate .d.cts for the CJS entry). Under our repo's Node16 module resolution, TS infers that shared .d.ts as ESM-only. So when controller-utils (compiled as CJS) does import { ParsedMessage } from '@signinwithethereum/siwe-parser', it throws:
TS1479: The current file is a CommonJS module whose imports will produce 'require' calls;
however, the referenced file is an ECMAScript module and cannot be imported with 'require'.
This breaks yarn build and the wallet-cli e2e jobs. I confirmed it's not a fluke of this branch - reproduced identically on a fresh main in #10049.

Important: the package's runtime behavior is fine (dual CJS/ESM exports are correctly set up, and our Jest tests - which bypass ts-bridge - pass). This is purely a type-declaration packaging gap upstream, not a real incompatibility.

Can we publish conditional type declarations (.d.cts / .d.mts) matching their dual CJS/ESM exports, per the standard "dual package hazard" from https://github.com/signinwithethereum/siwe ?

Non-blocking, unrelated to the code: fork-based changelog-check failures

This PR is from a fork (caveman-eth/metamask-core), the branch doesn't exist on origin (MetaMask/core), and those workflows try to git fetch/checkout the head branch directly from origin. This is a known limitation of those workflows with fork PRs - not something fixable from the PR branch itself. I confirmed this disappears when the same commits are pushed as a same-repo branch instead of a fork (see #10049). If you don't mind we can close this PR and continue from #10049.

When we have fix for the first issue, I can update the version and give another try?

caveman-eth · 2026-09-01T17:00:53Z

@OGPoyraz, thanks for digging into this.

TS1479
Agreed. Runtime dual CJS/ESM was already in place; the gap was types. @signinwithethereum/siwe-parser and @signinwithethereum/siwe 4.2.1 are published with matching declarations:

import → .d.mts + .mjs
require → .d.cts + .cjs
Same change on both packages, since profile-sync-controller would have hit the same error on siwe.

https://www.npmjs.com/package/@signinwithethereum/siwe/v/4.2.1

Age gate: Core’s Yarn config waits 3 days after publish (npmMinimalAgeGate: 4320). 4.2.1 went up at 2026-09-01 16:50 UTC, so yarn install should accept it around 2026-09-04 16:50 UTC. Happy to bump this PR (or #10049) as soon as that window opens.

Fork changelog-check
Understood that this is a workflow limitation on fork PRs, not something we can fix on the branch. Fine to continue from chore: Migrate SIWE dependency to @signinwithethereum/siwe v4 #10049 if that is easier for CI. Changelog entries currently cite chore: Migrate SIWE dependency to @signinwithethereum/siwe v4 #8497; we can retarget those if chore: Migrate SIWE dependency to @signinwithethereum/siwe v4 #10049 is the one that merges.

OGPoyraz · 2026-09-02T08:07:15Z

Hey @caveman-eth, thanks for the quick turnaround on 4.2.1 with the .d.cts/.d.mts fix, that's exactly what we needed.

The only remaining blocker is the npmMinimalAgeGate: 4320 in our Yarn config - 4.2.1 was published on 2026-09-01 at 16:50 UTC so we can't install it until ~2026-09-04 16:50 UTC. Nothing to do on your end, just waiting out the 3-day window :)

Once that clears I'll bump both @signinwithethereum/siwe-parser and @signinwithethereum/siwe to ^4.2.1 on #10049 and we should be good to merge.

Thanks again for staying on top of this 🙏

caveman-eth · 2026-09-02T17:26:24Z

@OGPoyraz great, sounds good. I'll ping you here after 2026-09-04 16:50 UTC :)

caveman-eth · 2026-09-04T17:39:36Z

Should be all clear now @OGPoyraz as of an hour ago

OGPoyraz · 2026-09-07T07:49:27Z

Hey @caveman-eth, just to note PR is in the review now, hoping to merge it soon, fyi

#10049

OGPoyraz · 2026-09-09T09:10:27Z

Here is my latest update:

As #10049 is merged, I will let teams to update package dependencies because there are some BC other teams need to handle. But naturally this downstream dependency(parser package) will happen in the clients eventually.

fyi @caveman-eth

caveman-eth · 2026-09-09T09:13:27Z

Here is my latest update:

As #10049 is merged, I will let teams to update package dependencies because there are some BC other teams need to handle. But naturally this downstream dependency(parser package) will happen in the clients eventually.

fyi @caveman-eth

I was following along, happy to see it, thanks @OGPoyraz 🙏

…sk#10049) Reproduction of MetaMask#8497 on a same-repo branch (not a fork) to verify CI, specifically to confirm the TS1479 build failure and rule out fork-only changelog-check failures. ## Explanation ### Current state The monorepo depends on two SIWE (Sign-In With Ethereum / EIP-4361) packages originally maintained by Spruce: - `@spruceid/siwe-parser` v2.1.0 — used by `@metamask/controller-utils` to detect and parse SIWE messages via `detectSIWE()` - `siwe` v2.3.2 — used by `@metamask/profile-sync-controller` to construct SIWE login messages via `new SiweMessage({...}).prepareMessage()` #### The Spruce `siwe` package is no longer actively maintained. Stewardship of the SIWE standard has moved to the Ethereum Identity Foundation. `@signinwithethereum/siwe` is the official successor TypeScript implementation. ### What this PR does Swaps the abandoned packages for the actively maintained successors. The `ParsedMessage` and `SiweMessage` class APIs are identical - same constructors, same fields, same methods. This is purely a dependency swap with import path updates. ### Known issue (reproduced here) `@signinwithethereum/siwe-parser@4.2.0` declares \"type\": \"module\" but only ships a single unconditional `.d.ts` (no separate `.d.cts`). Under this repo's `Node16` module resolution, TypeScript infers the shared `.d.ts` as ESM-only, causing a TS1479 error when `controller-utils` (a CJS package) imports it. This reproduction branch is to confirm that failure in CI independent of the fork-related changelog-check issues seen on MetaMask#8497. ## Package review Supply-chain: `4.2.0->4.2.1` is types-only (`.d.mts`/`.d.cts`, `isUri: boolean`), zero runtime change, deps unchanged (`apg-js`, `@noble/hashes`), no CVEs, owner Ethereum Identity Foundation (active). Minimal risk. CodeQL/Semgrep/zizmor/Socket pass on this PR. Correct split: `controller-utils` -> `siwe-parser` (parse via `ParsedMessage`), `profile-sync-controller` -> `siwe` (construct via `SiweMessage.prepareMessage()`). Parser has no `SiweMessage` export, so swapping profile-sync to parser breaks Build/Tests (TS2307) plus knip (unused/unlisted) and cascades to account-tree/notification/profile-metrics dependents. Fix applied locally (uncommitted): profile-sync back to `siwe@^4.2.1` + `yarn install`. Verified: LSP clean, `lint:misc --check` pass, knip no unused/unlisted, `authentication.test.ts` 28 passed. Backend (`/api/v2/siwe/login`) remains the auth boundary — reviewers confirm nonce single-use, domain/uri/chainId binding, expiry, and EIP-191/1271 verification.  --- > [!NOTE] > **Medium Risk** > Touches SIWE parsing and profile login message construction on auth-related paths, though APIs are described as backward compatible and server verification remains the trust boundary. > > **Overview** > Migrates unmaintained Spruce SIWE dependencies to the Ethereum Identity Foundation **`@signinwithethereum`** packages, with import and lockfile updates only. > > **`@metamask/controller-utils`** swaps **`@spruceid/siwe-parser`** for **`@signinwithethereum/siwe-parser`** ^4.2.1 (`ParsedMessage` in `detectSIWE` / SIWE origin checks). **v4.2.1** loosens EIP-55 parsing: all-lower or all-upper addresses can parse (optional **`warnings`**); only bad mixed-case checksums still fail. > > **`@metamask/profile-sync-controller`** replaces the **`siwe`** package with **`@signinwithethereum/siwe`** ^4.2.1 for JWT SIWE login message construction in **`flow-siwe.ts`** (`SiweMessage.prepareMessage()` usage unchanged). > > Changelogs document the swap; **`yarn.lock`** drops legacy **`siwe`** / extra Spruce parser entries and adds the new scoped packages. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6d9bd98. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

caveman-eth requested review from a team as code owners April 16, 2026 18:42

caveman-eth mentioned this pull request Apr 16, 2026

chore: Migrate SIWE dependency to @signinwithethereum/siwe v4 #8419

Closed

4 tasks

caveman-eth force-pushed the update-siwe-dependencies-2 branch from c500fd3 to abf04a9 Compare April 17, 2026 14:13

caveman-eth force-pushed the update-siwe-dependencies-2 branch from abf04a9 to 5dc2a17 Compare April 22, 2026 12:46

caveman-eth force-pushed the update-siwe-dependencies-2 branch from 5dc2a17 to 0889956 Compare April 24, 2026 12:04

caveman-eth added 2 commits April 28, 2026 17:26

caveman-eth force-pushed the update-siwe-dependencies-2 branch from 0889956 to 6b91d4d Compare April 28, 2026 14:26

OGPoyraz self-requested a review September 1, 2026 08:06

Merge remote-tracking branch 'upstream/main' into update-siwe-depende…

0ae4c09

…ncies-2

OGPoyraz mentioned this pull request Sep 1, 2026

chore: Migrate SIWE dependency to @signinwithethereum/siwe v4 #10049

Merged

caveman-eth mentioned this pull request Sep 1, 2026

fix: ship .d.mts and .d.cts for dual ESM/CJS TypeScript consumers signinwithethereum/siwe#15

Merged

OGPoyraz removed their request for review September 9, 2026 09:59

Navigation Menu

Uh oh!

chore: Migrate SIWE dependency to @signinwithethereum/siwe v4 - #8497

chore: Migrate SIWE dependency to @signinwithethereum/siwe v4#8497
caveman-eth wants to merge 3 commits into
MetaMask:mainfrom
caveman-eth:update-siwe-dependencies-2

caveman-eth commented Apr 16, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

caveman-eth commented May 4, 2026

Uh oh!

caveman-eth commented Aug 31, 2026

Uh oh!

OGPoyraz commented Sep 1, 2026

Uh oh!

caveman-eth commented Sep 1, 2026

Uh oh!

OGPoyraz commented Sep 1, 2026

Uh oh!

caveman-eth commented Sep 1, 2026 •

edited

Loading

Uh oh!

OGPoyraz commented Sep 2, 2026

Uh oh!

caveman-eth commented Sep 2, 2026

Uh oh!

caveman-eth commented Sep 4, 2026

Uh oh!

OGPoyraz commented Sep 7, 2026

Uh oh!

OGPoyraz commented Sep 9, 2026

Uh oh!

caveman-eth commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

caveman-eth commented Apr 16, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Current state

The Spruce siwe package is no longer actively maintained.

Similar migrations:

What this PR does

EIP-55 patches in client repos become obsolete

References

Checklist

Uh oh!

socket-security Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

caveman-eth commented May 4, 2026

Uh oh!

caveman-eth commented Aug 31, 2026

Uh oh!

OGPoyraz commented Sep 1, 2026

Uh oh!

caveman-eth commented Sep 1, 2026

Uh oh!

OGPoyraz commented Sep 1, 2026

Uh oh!

caveman-eth commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

OGPoyraz commented Sep 2, 2026

Uh oh!

caveman-eth commented Sep 2, 2026

Uh oh!

caveman-eth commented Sep 4, 2026

Uh oh!

OGPoyraz commented Sep 7, 2026

Uh oh!

OGPoyraz commented Sep 9, 2026

Uh oh!

caveman-eth commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

caveman-eth commented Apr 16, 2026 •

edited by cursor Bot

Loading

The Spruce `siwe` package is no longer actively maintained.

socket-security Bot commented Apr 16, 2026 •

edited

Loading

caveman-eth commented Sep 1, 2026 •

edited

Loading