chore: bump accounts deps

[ccharly]

Explanation

Aligning accounts deps.

References

• chore: bump accounts deps + remove eth_signTransaction from Money accounts metamask-mobile#34191
• chore: bump accounts deps metamask-extension#45145

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Touches many packages that depend on the keyring and account APIs with several major semver upgrades, but the PR does not change controller logic—risk is mainly version skew and downstream breaking API behavior from the bumped packages.

Overview
This PR aligns MetaMask accounts/keyring dependency versions across many packages/* workspaces so core stays in sync with extension and mobile consumers (#9754).

Keyring stack (major bumps): @metamask/keyring-api ^24.0.0, @metamask/keyring-internal-api ^12.0.0, @metamask/keyring-utils ^5.0.0, @metamask/keyring-sdk ^3.1.0, @metamask/account-api ^2.0.0, @metamask/eth-snap-keyring ^24.0.0, @metamask/keyring-snap-client ^10.0.0, and related bumps on HD/simple/money keyrings and snap clients. Controllers such as keyring-controller, accounts-controller, multichain-account-service, and snap-account-service pick these up via package.json only.

Validation library: @metamask/superstruct is raised from ^3.1.0 to ^3.4.1 broadly (RPC middleware, wallet-cli, data services, etc.).

Changes are lockfile + changelog entries; there are no application source edits in this diff.

^{Reviewed by Cursor Bugbot for commit 81a0d30. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​keyring-api@​23.7.0 ⏵ 24.0.0				+1
	@​metamask/​eth-snap-keyring@​23.0.0 ⏵ 24.0.0				+1
	@​metamask/​keyring-internal-api@​11.0.2 ⏵ 12.0.0				+2
	@​metamask/​keyring-internal-snap-client@​10.0.5 ⏵ 11.0.0				+2
	@​metamask/​keyring-utils@​4.0.0 ⏵ 5.0.0				+2
	@​metamask/​eth-money-keyring@​3.0.1 ⏵ 4.0.0				+1
	@​metamask/​keyring-snap-sdk@​9.2.1 ⏵ 10.0.0				+1
	@​metamask/​keyring-snap-client@​9.2.1 ⏵ 10.0.0	+1			+3
	@​metamask/​keyring-sdk@​2.3.0 ⏵ 3.1.0	+1		+1	+2
	@​metamask/​account-api@​1.1.1 ⏵ 2.0.0				+1
	@​metamask/​eth-simple-keyring@​12.0.2 ⏵ 13.0.0				+4
	@​metamask/​eth-hd-keyring@​14.1.2 ⏵ 15.0.0	+1			+2

View full report

[ccharly]

Going from 2 to 4 here, but the client (feature available on mobile only for now) was already using previous major 3. The new major 4 is mostly because we removed some EOL node.js support, so no real bad surprises to be expected here.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cf0e708. Configure here.}

[ccharly]

Removing this now. Since @metamask/eth-money-keyring@3.0.0 the handler for this method got removed. Those accounts are not supposed to sign transactions.

The mobile client (only client that uses money accounts for now), is already using this version too: https://github.com/MetaMask/metamask-mobile/blob/920629a885551f8dbf4ab523b1a4b352d9a84cd2/package.json#L288

I'll make a migration to clear up this method from the existing money accounts once aligning our deps there!

[ccharly]

Also bumping @metamask/superstruct since I'll soon use the new sensitive struct from this version!

[mcmire]

LGTM.