Release 1247.0.0

[Mrtenz]

Explanation

This is the release candidate for version 1247.0.0.

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Wide major-version alignment across account, keyring, network, transaction, and messenger packages forces MetaMask clients to upgrade in lockstep; runtime risk is low here because the PR is versioning/changelog-only, but consumer breakage from semver is significant.

Overview
This PR cuts release candidate 1247.0.0 for the core monorepo by bumping the root version and publishing new versions across a large set of @metamask/* packages.

Most package releases are major bumps that finalize what was under [Unreleased]: ESM-only, Node.js 22+, and ES2022 output, plus coordinated dependency updates from #10155. Internal versions are aligned on shared infrastructure such as @metamask/base-controller ^10, @metamask/messenger ^3, @metamask/network-controller ^37, @metamask/transaction-controller ^70, @metamask/keyring-controller ^28, and @metamask/controller-utils ^13, with downstream controllers (assets, bridge, accounts, etc.) bumped to match.

The root package.json also updates dev tooling deps (eth-block-tracker, eth-json-rpc-provider, json-rpc-engine, network-controller). Changes are package.json / CHANGELOG.md only in the diff shown—no controller implementation changes in this release PR.

^{Reviewed by Cursor Bugbot for commit 35836ec. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Network access: npm @metamask/controller-utils in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/account-tree-controller/package.json → npm/@metamask/snaps-utils@12.2.1 → npm/@metamask/controller-utils@12.3.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/controller-utils@12.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[mcmire]

Some questions below on packages that we're bumping from an 0.x version to 1.0.0 version.

[Mrtenz]

@metamaskbot update-changelogs

[metamask-ci]

✅ Changelogs updated and pushed.

[mcmire]

LGTM!