chore(deps-dev): bump @metamask/create-release-branch from 3.1.0 to 4.1.4 #432

dependabot · 2026-01-14T12:24:36Z

Bumps @metamask/create-release-branch from 3.1.0 to 4.1.4.

Release notes

Sourced from @metamask/create-release-branch's releases.

4.1.4

Changed

When a new major version of a package is being released but some of its direct dependents are missing, strongly suggest that they be included in the release as well (#193)

Update UI to improve how existing per-package error messages are shown so they are less prominent visually and provide clearer rationales/examples (#192)

4.1.3

Fixed

When creating a new release and populating the Unreleased section, use the same repo URLs in PR links as auto-changelog update would use (#165)

This prevents the updated changelog that create-release-branch produces from being invalid in the case where a non-standard URL was used to clone the repo originally.

4.1.2

Fixed

Improved error handling when opening browser fails due to System Events permissions or non-standard browser configurations (#178)

Now provides clear manual URL instructions instead of failing with osascript errors

Handles both cases: when terminal lacks System Events permissions and when using alternative browsers like Brave

4.1.1

Fixed

Ask users to include peer dependents of a major-bumped package in the release, even they've had no changes (#173)

UI: Include all peer dependents of a major-bumped package as available packages to release, even if they've had no changes (#173)

4.1.0

Added

Add interactive web UI for selecting package versions to release (#166)

Added --interactive (-i) flag to launch a web-based UI for easier version selection

Added --port option to configure the web server port (default: 3000)

Changed

Refine breaking change dependent detection to only consider peer dependencies (#170)

This change supports our policy of requiring packages with breaking changes to be released alongside their dependents

Regular dependencies are no longer included in this check

Allow npm:name@version dependency redirections in manifest (#158)

4.0.0

Changed

BREAKING: Bump minimum Node.js version to ^18.18 (#156)

BREAKING: Bump @metamask/auto-changelog to ^4.0.0 (#156)

This requires prettier@>=3.0.0.

Changelog

Sourced from @metamask/create-release-branch's changelog.

[4.1.4]

Changed

When a new major version of a package is being released but some of its direct dependents are missing, strongly suggest that they be included in the release as well (#193)

Update UI to improve how existing per-package error messages are shown so they are less prominent visually and provide clearer rationales/examples (#192)

[4.1.3]

Fixed

When creating a new release and populating the Unreleased section, use the same repo URLs in PR links as auto-changelog update would use (#165)

This prevents the updated changelog that create-release-branch produces from being invalid in the case where a non-standard URL was used to clone the repo originally.

[4.1.2]

Fixed

Improved error handling when opening browser fails due to System Events permissions or non-standard browser configurations (#178)

Now provides clear manual URL instructions instead of failing with osascript errors

Handles both cases: when terminal lacks System Events permissions and when using alternative browsers like Brave

[4.1.1]

Fixed

Ask users to include peer dependents of a major-bumped package in the release, even they've had no changes (#173)

UI: Include all peer dependents of a major-bumped package as available packages to release, even if they've had no changes (#173)

[4.1.0]

Added

Add interactive web UI for selecting package versions to release (#166)

Added --interactive (-i) flag to launch a web-based UI for easier version selection

Added --port option to configure the web server port (default: 3000)

Changed

Refine breaking change dependent detection to only consider peer dependencies (#170)

This change supports our policy of requiring packages with breaking changes to be released alongside their dependents

Regular dependencies are no longer included in this check

Allow npm:name@version dependency redirections in manifest (#158)

[4.0.0]

Changed

BREAKING: Bump minimum Node.js version to ^18.18 (#156)

BREAKING: Bump @metamask/auto-changelog to ^4.0.0 (#156)

... (truncated)

Commits

bde3474 4.1.4 (#196)
3855be0 Detect direct dependents missing from release (#193)
aaf2c3b Improve UI/copy for per-package error messages (#192)
9c6c63c Fix ESLint config (#191)
7d5f2c8 Add preview builds (#187)
b4d6fff chore: Update codeowners to @MetaMask/core-platform (#188)
7ba6cd2 4.1.3 (#182)
814254b Fix repo links in updated changelogs to match auto-changelog (#165)
8e22513 4.1.2 (#180)
748288e docs: format CHANGELOG.md with prettier (#181)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Medium Risk
Moderate risk because this upgrades a release automation tool across a major version and its new peer dependency requirement (prettier >=3) may conflict with the repo’s current prettier@^2.8.8, potentially breaking release workflows/CI installs.

Overview
Updates the dev dependency @metamask/create-release-branch from ^3.1.0 to ^4.1.4.

The lockfile is refreshed to pull in create-release-branch v4’s updated dependency tree (including newer @metamask/auto-changelog and new transitive deps like express/open) and its updated peer dependency expectations (notably prettier >=3).

^{Written by Cursor Bugbot for commit 96feb46. This will update automatically on new commits. Configure here.}

socket-security · 2026-01-14T12:25:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@metamask/create-release-branch@3.1.0 ⏵ 4.1.4	⁺¹		⁺⁶	⁺⁷

View full report

socket-security · 2026-01-14T12:25:17Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Network access: npm `@metamask/create-release-branch` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → `npm/@metamask/create-release-branch@4.1.4` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@metamask/create-release-branch@4.1.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `body-parser` in module http-errors Module: http-errors Location: Package overview From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/body-parser@1.20.4` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/body-parser@1.20.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `debug` in module net Module: net Location: Package overview From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/debug@2.6.9` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/debug@2.6.9`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `express` in module http Module: http Location: Package overview From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/express@4.22.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/express@4.22.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `express` in module https Module: https Location: Package overview From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/express@4.22.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/express@4.22.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `express` in module net Module: net Location: Package overview From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/express@4.22.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/express@4.22.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `express` in module http-errors Module: http-errors Location: Package overview From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/express@4.22.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/express@4.22.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `methods` in module http Module: http Location: Package overview From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/methods@1.1.2` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/methods@1.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `raw-body` in module http-errors Module: http-errors Location: Package overview From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/raw-body@2.5.3` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/raw-body@2.5.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `send` in module http-errors Module: http-errors Location: Package overview From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/send@0.19.2` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/send@0.19.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Publisher changed: npm `async-function` is now published by ljharb instead of eduardorfs New Author: ljharb Previous Author: eduardorfs From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/async-function@1.0.0` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/async-function@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Publisher changed: npm `encodeurl` is now published by blakeembrey instead of dougwilson New Author: blakeembrey Previous Author: dougwilson From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/encodeurl@2.0.0` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/encodeurl@2.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Publisher changed: npm `finalhandler` is now published by ulisesgascon instead of wesleytodd New Author: ulisesgascon Previous Author: wesleytodd From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/finalhandler@1.3.2` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/finalhandler@1.3.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Publisher changed: npm `http-errors` is now published by ulisesgascon instead of dougwilson New Author: ulisesgascon Previous Author: dougwilson From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/http-errors@2.0.1` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/http-errors@2.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Publisher changed: npm `statuses` is now published by ulisesgascon instead of dougwilson New Author: ulisesgascon Previous Author: dougwilson From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/statuses@2.0.2` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/statuses@2.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `content-disposition` is 100.0% likely to have a medium risk anomaly Notes: The code appears to be a standard, non-malicious Content-Disposition header parser with strict input validation and proper encoding/decoding utilities. No evident data exfiltration or remote execution within this fragment. The primary precaution is to ensure the external decodefield function is safe and that PARAM_REGEXP robustly handles edge-case inputs to prevent DoS or parsing failures. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/content-disposition@0.5.4` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/content-disposition@0.5.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `proxy-addr` is 100.0% likely to have a medium risk anomaly Notes: The code is a standard, well-scoped IP trust utility (proxy-addr) with no evidence of malicious behavior. It reads IPs from request headers, validates and normalizes them, and applies a trust policy to determine the client address. No backdoors, exfiltration, or dangerous operations are present. The security posture appears acceptable for its intended purpose when used as a dependency in an Open Source project. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/@metamask/create-release-branch@4.1.4` → `npm/proxy-addr@2.0.7` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/proxy-addr@2.0.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cursor · 2026-01-14T12:27:29Z

package.json

    "@lavamoat/allow-scripts": "^3.2.1",
    "@lavamoat/preinstall-always-fail": "^2.1.0",
-    "@metamask/create-release-branch": "^3.1.0",
+    "@metamask/create-release-branch": "^4.1.4",


Prettier peer dependency version mismatch breaks compatibility

High Severity

The updated @metamask/create-release-branch@^4.1.4 and its dependency @metamask/auto-changelog@^4.0.0 both require prettier>=3.0.0 as a peer dependency. However, the project has prettier: "^2.8.8" installed. This version mismatch will cause peer dependency warnings during installation and may result in runtime errors or incorrect behavior when using create-release-branch, since Prettier 3.x has different APIs and formatting behavior than Prettier 2.x.

Additional Locations (1)

package.json#L69-L70

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

cursor · 2026-02-04T12:26:16Z

yarn.lock

    yargs: "npm:^17.7.1"
  peerDependencies:
-    prettier: ^2
+    prettier: ">=3.0.0"


Peer dependency mismatch: Prettier 2 incompatible with v4

High Severity

The upgraded @metamask/create-release-branch@^4.1.4 declares a peer dependency of prettier: ">=3.0.0", and its transitive dependency @metamask/auto-changelog@^4.0.0 also requires prettier: ">=3.0.0". However, the project has prettier: "^2.8.8" installed. This peer dependency mismatch will cause the release tooling to fail at runtime when it tries to use Prettier functionality, since the installed version doesn't meet the minimum required version.

Additional Locations (2)

yarn.lock#L1556-L1558

package.json#L45-L46

Bumps [@metamask/create-release-branch](https://github.com/MetaMask/create-release-branch) from 3.1.0 to 4.1.4. - [Release notes](https://github.com/MetaMask/create-release-branch/releases) - [Changelog](https://github.com/MetaMask/create-release-branch/blob/main/CHANGELOG.md) - [Commits](MetaMask/create-release-branch@v3.1.0...v4.1.4) --- updated-dependencies: - dependency-name: "@metamask/create-release-branch" dependency-version: 4.1.4 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 14, 2026

dependabot bot requested a review from a team as a code owner January 14, 2026 12:24

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 14, 2026

cursor bot reviewed Jan 14, 2026

View reviewed changes

dependabot bot force-pushed the dependabot/npm_and_yarn/metamask/create-release-branch-4.1.4 branch 3 times, most recently from 6575eb2 to 7bb7840 Compare January 28, 2026 12:24

dependabot bot force-pushed the dependabot/npm_and_yarn/metamask/create-release-branch-4.1.4 branch 3 times, most recently from 69ff43b to 15b7000 Compare February 4, 2026 12:24

cursor bot reviewed Feb 4, 2026

View reviewed changes

dependabot bot force-pushed the dependabot/npm_and_yarn/metamask/create-release-branch-4.1.4 branch from 15b7000 to 96feb46 Compare February 4, 2026 15:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump @metamask/create-release-branch from 3.1.0 to 4.1.4 #432

chore(deps-dev): bump @metamask/create-release-branch from 3.1.0 to 4.1.4 #432

Uh oh!

dependabot bot commented on behalf of github Jan 14, 2026 •

edited by cursor bot

Loading

Uh oh!

socket-security bot commented Jan 14, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Jan 14, 2026 •

edited

Loading

Uh oh!

cursor bot Jan 14, 2026

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Feb 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

chore(deps-dev): bump @metamask/create-release-branch from 3.1.0 to 4.1.4 #432

Are you sure you want to change the base?

chore(deps-dev): bump @metamask/create-release-branch from 3.1.0 to 4.1.4 #432

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 14, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.1.4

Changed

4.1.3

Fixed

4.1.2

Fixed

4.1.1

Fixed

4.1.0

Added

Changed

4.0.0

Changed

[4.1.4]

Changed

[4.1.3]

Fixed

[4.1.2]

Fixed

[4.1.1]

Fixed

[4.1.0]

Added

Changed

[4.0.0]

Changed

Uh oh!

socket-security bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot Jan 14, 2026

Choose a reason for hiding this comment

Prettier peer dependency version mismatch breaks compatibility

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 4, 2026

Choose a reason for hiding this comment

Peer dependency mismatch: Prettier 2 incompatible with v4

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jan 14, 2026 •

edited by cursor bot

Loading

socket-security bot commented Jan 14, 2026 •

edited

Loading

socket-security bot commented Jan 14, 2026 •

edited

Loading