chore: preview build from https://github.com/MetaMask/internal-snaps/pull/108

[gabrieledm]

Description

This PR updates the preinstalled Solana Wallet Snap from ^2.10.0 to preview version 5.0.0-preview-a5753bb0, generated from MetaMask/internal-snaps#108.
The preview fixes an issue where small USDC-to-SOL swaps could be displayed as sends in the activity history.
When the received SOL was less than or equal to the transaction fee, the raw SOL balance could decrease even though SOL was received, causing the transaction to be classified incorrectly.
The Snap now determines native transfer direction using the fee-adjusted balance difference.
This correctly identifies the incoming SOL leg and classifies the transaction as a swap regardless of whether the received amount is less than, equal to, or greater than the transaction fee.
This PR only updates the Snap dependency and corresponding lockfile; the implementation and automated tests are contained in the linked Snap PR.

Changelog

CHANGELOG entry: Fixed small USDC-to-SOL swaps being incorrectly displayed as sends in Solana activity

Related issues

Fixes:

Manual testing steps

1. Initiate a swap from USDC to SOL for 0.00005 USDC.
2. Wait for the transaction to complete and open the Activity tab.
3. Verify that the activity entry is displayed as a USDC-to-SOL swap, rather than as a sent transaction.
4. Open the transaction details and verify that USDC is shown as outgoing and SOL as incoming.
5. Repeat the swap using 0.005 USDC.
6. Verify that the larger transaction is also displayed as a USDC-to-SOL swap.
7. As a regression check, swap 0.00005 SOL to USDC and verify that it is still classified as a swap.

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Preview snap replaces a stable release for Solana signing and transaction parsing; scope is dependency-only but affects all Solana wallet behavior until a stable 5.x ships.

Overview
Bumps the preinstalled @metamask/solana-wallet-snap dependency from stable ^2.10.0 to preview @metamask-previews/solana-wallet-snap@5.0.0-preview-a5753bb0 (from internal-snaps PR 108), with matching yarn.lock updates only—no mobile app source changes.

That preview snap fixes Solana activity misclassification: tiny USDC→SOL swaps could show as sends when received SOL was ≤ the fee, because raw SOL balance could drop despite an incoming leg. The snap now infers native transfer direction from a fee-adjusted balance delta so swaps classify correctly in Activity.

^{Reviewed by Cursor Bugbot for commit b41a9e0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[metamask-ci]

PR template — items to address before "Ready for review"

Warnings — informational, address before merging:

• Related issues section is empty. Add Fixes: #123 / Closes: <URL> / Refs: <Jira key>, or write a short rationale after the colon.
• Pre-merge author checklist has unchecked items (e.g. "I've tested with a power user scenario"). Every box must be consciously checked — see docs/readme/ready-for-review.md.

See docs/readme/ready-for-review.md for the full Definition of Ready for Review.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​metamask-previews/​solana-wallet-snap@​5.0.0-preview-a5753bb0

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Network access: npm @metamask-previews/solana-wallet-snap in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@metamask-previews/solana-wallet-snap@5.0.0-preview-a5753bb0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask-previews/solana-wallet-snap@5.0.0-preview-a5753bb0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.03%. Comparing base (1aa13f3) to head (f890ecb).
⚠️ Report is 174 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #34114      +/-   ##
==========================================
+ Coverage   84.90%   85.03%   +0.13%     
==========================================
  Files        6277     6314      +37     
  Lines      170088   171736    +1648     
  Branches    41681    42424     +743     
==========================================
+ Hits       144416   146043    +1627     
+ Misses      15832    15685     -147     
- Partials     9840    10008     +168     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeNetworkExpansion, SmokeSnaps, SmokeConfirmations, SmokeMultiChainAPI, SmokeNetworkAbstractions
• Selected Performance tags: None (no tests recommended)
• Risk Level: high
• AI Confidence: 90%

click to see 🤖 AI reasoning details

E2E Test Selection:
The PR updates @metamask/solana-wallet-snap from ^2.10.0 to a preview version 5.0.0-preview-a5753bb0 — a major version jump (2.x → 5.x) for a preinstalled snap that powers Solana wallet functionality.

Why this is high risk:

1. Major version bump (2.x → 5.x): A jump of 3 major versions in a preview build suggests significant API or behavioral changes that could break existing Solana flows.
2. Preinstalled snap: This snap is loaded at app startup via app/lib/snaps/preinstalled-snaps.ts (gated by the solana build flag), meaning any breaking change affects all Solana users immediately.
3. Heavily referenced in test fixtures: tests/framework/fixtures/constants.ts has 40+ references to npm:@metamask/solana-wallet-snap, meaning fixture state may need to be compatible with the new snap version.

Tag selection rationale:

• SmokeNetworkExpansion: Directly covers Solana Wallet Standard tests (solana-wallet-standard.spec.ts) — connect/disconnect, account display, session persistence, SOL transfers, and Solana message signing. This is the primary test suite for the changed snap.
• SmokeSnaps: Covers preinstalled snap tests (test-snap-preinstalled.spec.ts) and general snap lifecycle. The Solana snap is a preinstalled snap, so snap management tests are relevant.
• SmokeConfirmations: Per tag description, Solana transaction/signing flows hit confirmations. The Solana wallet standard spec includes signTransaction and signMessage flows that trigger confirmation UIs.
• SmokeMultiChainAPI: The Solana snap is used in multi-chain session fixtures. CAIP-25 session tests that include Solana scopes (EVM + Solana combinations) could be affected by snap version changes.
• SmokeNetworkAbstractions: Per tag dependency rules, when selecting SmokeMultiChainAPI, also select SmokeNetworkAbstractions (permission UI).

Performance Test Selection:
The change is a dependency update to the Solana wallet snap package. While this is a significant version bump, it does not directly affect app launch performance, login flows, asset loading, swap flows, account list rendering, onboarding, or any other performance-measured scenario. The Solana snap is a preinstalled snap that handles Solana-specific operations; its version change does not impact the performance metrics measured by the available performance test tags.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud