fix(deps): update dependency multiformats to v14

[metamask-ci]

This PR contains the following updates:

Package	Change	Age	Confidence
multiformats	^9.9.0 → ^14.0.5

---

Release Notes

multiformats/js-multiformats (multiformats)

v14.0.5

Compare Source

Bug Fixes

• reject non-minimally encoded varints (#​343) (8ada774)

v14.0.4

Compare Source

Bug Fixes

• allow specifying ByteView backing type (#​342) (646249f)

v14.0.3

Compare Source

Bug Fixes

• constrain identity bytes to single characters (#​338) (cb4eb32), closes #​122

v14.0.2

Compare Source

Bug Fixes

• verify CID hash before decoding in Block.create (#​340) (6784d3e), closes #​339

v14.0.1

Compare Source

Bug Fixes

• case-insensitive decode for base16/base32/base36 (multibase spec) (#​341) (ad87caa)

v14.0.0

Compare Source

⚠ BREAKING CHANGES

• all Hashers are now MultihashHasher<Code>s
• Returned Uint8Arrays are now Uint8Array<ArrayBuffer>

Bug Fixes

• identity hash is SyncMultihashHasher<0> (#​337) (9b5b12b), closes #​313 #​314
• specify type of backing buffer when Uint8Arrays are returned (#​335) (bac2da5)

v13.4.2

Compare Source

Dependencies

• dev: bump @​types/node from 24.10.3 to 25.0.0 (#​333) (0bad504)

v13.4.1

Compare Source

Dependencies

• dev: bump crypto-hash from 3.1.0 to 4.0.0 (#​332) (bbc711a)

v13.4.0

Compare Source

Features

• support truncating digests (#​329) (e4d3a22), closes #​328

v13.3.7

Compare Source

Dependencies

• dev: bump @​types/node from 22.15.31 to 24.0.0 (#​326) (bbb518e)

v13.3.6

Compare Source

Trivial Changes

• remove package-lock.json (#​324) (c65d07e)

Dependencies

• dev: bump aegir from 46.0.0 to 47.0.6 (#​325) (ea828e1)

v13.3.5

Compare Source

Bug Fixes

• perf: improve rfc4648 base decoding (#​323) (900b5f6)

v13.3.4

Compare Source

Dependencies

• dev: bump @​types/node from 22.15.17 to 22.15.18 (#​319) (dbf6eb5)

v13.3.3

Compare Source

Dependencies

• dev: bump aegir from 45.2.1 to 46.0.0 (#​317) (5fcf67b)

v13.3.2

Compare Source

Documentation

• add missing base36 from default multibases (#​315) (d03762a)

v13.3.1

Compare Source

Trivial Changes

• adjust examples for new linting rules (adc534b)

Dependencies

• dev: bump aegir from 44.1.4 to 45.0.0 (1cd48bf)

v13.3.0

Compare Source

Features

• add hasCode to Digest (#​308) (a5fbf61)

v13.2.4

Compare Source

Trivial Changes

• fix linting (9d24b62)

Dependencies

• dev: bump aegir from 43.0.3 to 44.1.1 (a0fdb76)

v13.2.3

Compare Source

Bug Fixes

• CID.parse(base36) (#​307) (892f198)

v13.2.2

Compare Source

Dependencies

• dev: bump @​types/node from 20.14.13 to 22.0.0 (2b65321)

v13.2.1

Compare Source

v13.2.0

Compare Source

Features

• BlockCodec methods are generic (2ee062e)

v13.1.3

Compare Source

Dependencies

• dev: bump @​stablelib/sha512 from 1.0.1 to 2.0.0 (3091935)

v13.1.2

Compare Source

Dependencies

• dev: bump @​stablelib/sha256 from 1.0.1 to 2.0.0 (bc7f8a5)

v13.1.1

Compare Source

Dependencies

• dev: bump aegir from 42.2.11 to 43.0.1 (bc14c48)

v13.1.0

Compare Source

Features

• support decoding ArrayBuffers (#​287) (e7f3272)

Trivial Changes

• Update .github/dependabot.yml [skip ci] (aa9c730)

v13.0.1

Compare Source

Dependencies

• dev: bump aegir from 41.3.5 to 42.1.0 (12c8686)

v13.0.0

Compare Source

⚠ BREAKING CHANGES

• this module is now TypeScript - the API has not changed but releasing as a major for saftey

Features

• convert codebase to typescript (#​251) (56bbb96), closes #​249

Trivial Changes

• deps: bump actions/setup-node from 3.8.2 to 4.0.0 (139b3c2)

v12.1.3

Compare Source

Trivial Changes

• deps: bump actions/setup-node from 3.8.1 to 3.8.2 (f190ad7)

Dependencies

• dev: bump crypto-hash from 2.0.1 to 3.0.0 (f5b9958)

v12.1.2

Compare Source

Bug Fixes

• switch interface method decl style (a33d24f)

Dependencies

• dev: bump aegir from 40.0.13 to 41.0.0 (41f008b)

v12.1.1

Compare Source

Bug Fixes

• update link interface path in exports map (#​270) (d38e4a8)

Trivial Changes

• deps: bump actions/checkout from 3 to 4 (f94559e)

v12.1.0

Compare Source

Features

• add sha1 support (4da0085)

v12.0.2

Compare Source

Bug Fixes

• linting (3d74818)
• remove old ts option (638dbed)

Trivial Changes

• add or force update .github/workflows/js-test-and-release.yml (21b7591)
• delete templates [skip ci] (#​263) (d2b614d)
• deps: bump actions/setup-node from 3.5.0 to 3.8.0 (7dcf225)
• deps: bump actions/setup-node from 3.8.0 to 3.8.1 (d7ec85c)
• deps: bump gozala/typescript-error-reporter-action (4a36fb7)
• Update .github/dependabot.yml [skip ci] (58bebda)

Dependencies

• dev: bump aegir from 37.12.1 to 40.0.11 (d17424d)

v12.0.1

Compare Source

Trivial Changes

• deps: bump codecov/codecov-action from 3.1.1 to 3.1.4 (#​256) (910eeeb)

Dependencies

• dev: bump @​types/node from 18.16.18 to 20.3.1 (7a6d036)

v12.0.0

Compare Source

⚠ BREAKING CHANGES

• use aegir for ESM-only build/testing/release

Features

• use aegir for ESM-only build/testing/release (f82e61b)

v11.0.2

Compare Source

Bug Fixes

• add interface files to the exports map (#​246) (a58a398), closes /github.com/ipld/js-dag-cbor/blob/master/src/index.js#L9

v11.0.1

Compare Source

Bug Fixes

• throw on CID.parse v0 string with multibase prefix (258a0be)

v11.0.0

Compare Source

⚠ BREAKING CHANGES

• Make link.toJSON return a DAG-JSON link

Features

• Make link.toJSON return a DAG-JSON link (9e087d6)

Bug Fixes

• build browser bundle (2ee6012), closes #​234
• list links of a block that is a CID (#​226) (c17673d)

Documentation

• fix typos in jsdoc comments (a246054)

v10.0.3

Compare Source

Documentation

• publish typedocs in gh-pages branch (#​233) (3a6d3ed)

v10.0.2

Compare Source

Bug Fixes

• use slash as flag that an object is a CID (#​217) (1cec619), closes #​212 #​213

Trivial Changes

• no-release: rename varint test file so it is run (#​209) (e32fe47)
• remove unnecessary dev deps (#​218) (a43ffff)

v10.0.1

Compare Source

Bug Fixes

• convert byteOffset and byteLength to getters (#​215) (4e09490), closes #​208 #​210

v10.0.0

Compare Source

⚠ BREAKING CHANGES

• remove use of Object.defineProperties in CID class
• use aegir for ESM-only build/testing/release

Features

• add complete set of aegir-based scripts (1190bc6)
• define Link interface for CID (88e29ea)
• remove deprecated CID properties & methods (ffc4e6f)
• use aegir for ESM-only build/testing/release (163d463)

Bug Fixes

• --no-cov for all but chrome main (b92f25f)
• add "browser" field, remove named local imports (d60ea06)
• additional lint items from Link interface work (91f677b)
• address JS & TS linting complaints (c12db2a)
• changes for new lint rules (e6c9957)
• distribute types in dist/types/ (c6defdb)
• ensure "master" as release branch (16f8d9e)
• make CID#asCID a regular property (a74f1c7)
• only release on master (d15f26f)
• properly export types, build more complete pack (8172ea8)
• remove "main" (ad3306c)
• remove use of Object.defineProperties in CID class (6149fae), closes #​200
• run coverage only where it's supposed to (872d121)
• test on all branches and pull requests (f2ae077)
• ts-use import path (53651c1)
• use extensions for relative ts imports (451998a), closes /github.com/multiformats/js-multiformats/pull/199#issuecomment-1252793515
• use parent tsc in ts-use (85a9296)

Tests

• check for non-enumerability of asCID property (b4ba07d)

Trivial Changes

• add test for structural copying (#​206) (e8def36)
• no-release: bump @​types/mocha from 9.1.1 to 10.0.0 (#​205) (a9a9347)
• no-release: bump actions/setup-node from 3.4.1 to 3.5.0 (#​204) (604ca1f)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

---

Note

Medium Risk
A five-major-version dependency jump affects IPFS CID parsing used for NFT gateway URLs; breakage would surface as runtime or build failures without any in-repo code updates in this diff.

Overview
Bumps multiformats in @metamask/assets-controllers from ^9.9.0 to ^14.0.5, with matching yarn.lock resolution and a CHANGELOG entry under the unreleased Changed section.

There are no application code changes in this PR—the package still uses CID.parse / toV1 from multiformats/cid for IPFS NFT URL formatting in assetsUtil.ts. Reviewers should confirm CI/tests cover that path, since v10–v14 include breaking API and typing changes upstream even though call sites are unchanged.

^{Reviewed by Cursor Bugbot for commit 1693319. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	multiformats@​9.9.0 ⏵ 14.0.5	+1			+7

View full report

[metamask-ci]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.