Release 1247.0.0

[Mrtenz]

Explanation

Recreated #10155 after reverting in #10159.

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

High Risk
Monorepo-wide major releases and breaking platform requirements (ESM, Node 22) force coordinated client upgrades; misaligned versions can break messenger/controller wiring at runtime.

Overview
Publishes 1247.0.0 of @metamask/core-monorepo by cutting new major (or milestone) versions across many workspace packages and aligning their package.json dependency ranges.

The release mostly finalizes changelog entries that were sitting under [Unreleased]—especially ESM-only, Node.js 22+, and ES2022 build targets—while adding #10160 dependency bumps such as @metamask/messenger ^3, @metamask/base-controller ^10, @metamask/network-controller ^37, @metamask/transaction-controller ^70, and @metamask/controller-utils ^13. Heavily connected packages (e.g. assets-controller, assets-controllers, bridge-controller, core-backend) get matching semver bumps so the graph stays consistent.

The root package.json also bumps workspace dev dependencies on @metamask/eth-block-tracker, @metamask/eth-json-rpc-provider, @metamask/json-rpc-engine, and @metamask/network-controller. No application/controller source changes appear in this diff—only versions, changelogs, and dependency pins.

^{Reviewed by Cursor Bugbot for commit ffecd7b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Network access: npm @metamask/controller-utils in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/account-tree-controller/package.json → npm/@metamask/snaps-utils@12.2.1 → npm/@metamask/controller-utils@12.3.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/controller-utils@12.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[metamask-ci]

✅ Changelogs updated and pushed.

[cryptodev-2s]

One replace all for

[#10155](https://github.com/MetaMask/core/pull/10155)
to
[#10160](https://github.com/MetaMask/core/pull/10160)