Release/1307.0.0

[imblue-dabadee]

Explanation

This release candidate publishes:

• @metamask/phishing-controller 18.2.0
• @metamask/assets-controllers 112.1.0

@metamask/phishing-controller adds optional request-source attribution for URL scans. NftController in @metamask/assets-controllers adopts that API for NFT metadata scans using the nft-detection source.

The assets-controllers minor release also includes its existing additive consumer-facing changes, including optional RWA token security metadata, as documented in its changelog.

No breaking API changes are included. The assets-controllers dependency range is updated to consume @metamask/phishing-controller@^18.2.0.

References

• Related to feat: attribute dapp-scanning URL requests #10357
• Related to feat: extend the RWA token API types for security metadata #10542

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Release-only dependency and version updates with additive, optional phishing attribution APIs and no breaking changes called out in this PR.

Overview
This PR cuts monorepo release 1307.0.0 by publishing @metamask/phishing-controller@18.2.0 and @metamask/assets-controllers@112.1.0, then wiring dependents to those versions.

@metamask/phishing-controller@18.2.0 (documented in its changelog) adds optional request-source parameters on scanUrl / bulkScanUrls, which set an x-request-source header on phishing URL scans.

@metamask/assets-controllers@112.1.0 rolls that dependency forward and records NftController passing the nft-detection source on PhishingController:bulkScanUrls so NFT metadata URL checks are tagged separately in service metrics. The same release line also captures already-shipped additive API work (e.g. optional RWA securityData when includeTokenSecurityData is used).

@metamask/assets-controller and @metamask/bridge-controller bump their @metamask/assets-controllers and @metamask/phishing-controller ranges; yarn.lock and changelog compare links are updated accordingly. No application source changes appear in this diff—only versioning, changelogs, and lockfile alignment.

^{Reviewed by Cursor Bugbot for commit 6a4ff12. Bugbot is set up for automated code reviews on this repo. Configure here.}

[metamask-ci]

✅ Changelogs updated and pushed.