chore: Migrate SIWE dependency to @signinwithethereum/siwe v4

[caveman-eth]

Explanation

Current state

The monorepo depends on two SIWE (Sign-In With Ethereum / EIP-4361) packages originally maintained by Spruce:

• @spruceid/siwe-parser v2.1.0 — used by @metamask/controller-utils to detect and parse SIWE messages via detectSIWE()
• siwe v2.3.2 — used by @metamask/profile-sync-controller to construct SIWE login messages via new SiweMessage({...}).prepareMessage()

The Spruce siwe package is no longer actively maintained.

Stewardship of the SIWE standard has moved to the Ethereum Identity Foundation (GitHub).
@signinwithethereum/siwe is the official successor TypeScript implementation.

Similar migrations:

x402-foundation/x402 x402-foundation/x402#1917,
magiclabs/magic-js magiclabs/magic-js#1074

What this PR does

Swaps the abandoned packages for the actively maintained successors. The ParsedMessage and SiweMessage class APIs are identical — same constructors, same fields, same methods. This is purely a dependency swap with import path updates.

Files changed:

Package	File	Change
controller-utils	package.json	@spruceid/siwe-parser → @signinwithethereum/siwe-parser
controller-utils	src/siwe.ts	Import path updated
controller-utils	src/siwe.test.ts	Import path updated
profile-sync-controller	package.json	siwe → @signinwithethereum/siwe
profile-sync-controller	src/sdk/authentication-jwt-bearer/flow-siwe.ts	Import path updated

Notable changes in the new packages

• Parse errors now throw SiweParseError (with .errors: string[]) instead of generic Error — no impact since detectSIWE catches all errors generically
• ethers is now an optional peer dependency of @signinwithethereum/siwe (was required in siwe) — no impact since profile-sync-controller only calls prepareMessage(), not verify()
• Prototype pollution hardening in the ABNF parser via null-prototype callbacks
• Transitive deps removed: @stablelib/random, uri-js, valid-url
• No Buffer usage in the new packages (improved bundler compat)

⚠️ Note for extension and mobile teams (does not affect this repo)

This repo (core) does not patch the SIWE parser and is unaffected by this section. However, both metamask-extension and metamask-mobile maintain their own patches on @spruceid/siwe-parser to disable EIP-55 address checksum enforcement — the parser strictly rejects non-checksummed (e.g. all-lowercase) Ethereum addresses, but many dApps produce lowercase addresses in SIWE messages.

Those patches live in the client repos, not here:

• Extension: .yarn/patches/@spruceid-siwe-parser-npm-2.1.0-060b7ede7a.patch
• Mobile: patches/@spruceid+siwe-parser+2.1.0.patch

They target @spruceid/siwe-parser by package name. When the client repos upgrade to this new version of controller-utils, the old package will disappear from their dependency trees and those patches will silently stop applying. The new @signinwithethereum/siwe-parser will arrive unpatched with EIP-55 enforcement active.

Action for client teams before upgrading: Create equivalent patches for @signinwithethereum/siwe-parser that remove the isEIP55Address check from the address callback in the compiled output. Same concept — remove a ~5-line if block — just targeting the new package name.

References

• New maintainer repo: https://github.com/signinwithethereum/siwe
• @signinwithethereum/siwe-parser on npm: https://www.npmjs.com/package/@signinwithethereum/siwe-parser
• @signinwithethereum/siwe on npm: https://www.npmjs.com/package/@signinwithethereum/siwe
• EIP-4361 spec: https://eips.ethereum.org/EIPS/eip-4361

---

Note

Medium Risk
Swaps core SIWE parsing/message-construction dependencies used in signature and auth flows; behavior should be compatible but parser differences or peer dependency changes could affect SIWE detection/login in edge cases.

Overview
Updates SIWE dependencies to the Ethereum Identity Foundation maintained packages, replacing @spruceid/siwe-parser with @signinwithethereum/siwe-parser in controller-utils and replacing siwe with @signinwithethereum/siwe in profile-sync-controller.

Updates the corresponding imports (ParsedMessage, SiweMessage) and refreshes changelogs and yarn.lock to reflect the new packages and transitive dependency changes.

^{Reviewed by Cursor Bugbot for commit 5cd254a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​signinwithethereum/​siwe@​4.1.0
	@​signinwithethereum/​siwe-parser@​4.1.0

View full report