Patch MetaMask extension to v12.9.0 for GHSA-9cwf-fhxr-4f53

[Copilot]

MetaMask extension v12.8.1 contains a vulnerable version of @metamask/key-tree (GHSA-9cwf-fhxr-4f53) affecting key derivation. Updated to v12.9.0 which includes the patched library.

Changes

• Yarn patch for @coinbase/onchaintestkit: Package hardcodes MetaMask v12.8.1. Patch updates constants and CLI script to v12.9.0

  • dist/src/wallets/MetaMask/utils/constants.js
  • dist/src/wallets/MetaMask/utils/constants.d.ts
  • src/cli/prepare-metamask.mjs

• Resolution pinning: Added @coinbase/onchaintestkit to resolutions with exact version to ensure patch stability across installs

• Gitignore: Excluded apps/web/e2e/.cache/ to prevent committing downloaded extension artifacts

Technical Notes

The vulnerability exists in the bundled extension, not our direct dependencies. Yarn patches are applied at install time and persist across the team via .yarn/patches/.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/MetaMask/metamask-extension/releases
  • Triggering command: /usr/bin/curl curl -s REDACTED su cjs/�� -p -c cal/bin/bash (http block)
• www.npmjs.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Yaketh (Kushmanmb)]

Kushmanmb