refactor!: Replace getBearerToken constructor parameter with direct AuthenticationController:getBearerToken call

[Mrtenz]

Rather than providing a getBearerToken parameter to the constructor, the controller now directly calls AuthenticationController:getBearerToken.

---

Note

Medium Risk
Breaking API change: authentication token retrieval moves from a constructor callback to a required messenger action, which can break consumers if allowlists aren’t updated. It also changes how Authorization headers are attached to outbound API calls, so misconfiguration could impact authenticated requests.

Overview
Removes the getBearerToken constructor option and instead fetches bearer tokens by calling AuthenticationController:getBearerToken via the controller messenger for Transaction API and Sentinel requests.

Updates the controller’s allowed action types/messenger delegation and adjusts tests to mock the new messenger action and assert Authorization header behavior. Dependency updates include bumping @metamask/messenger to ^1.1.0 and adding @metamask/profile-sync-controller (plus lockfile/lavamoat adjustments), and the changelog documents the breaking migration steps.

^{Written by Cursor Bugbot for commit 2195fdd. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​base-controller@​9.0.0 ⏵ 9.0.1	+1			+6
	@​metamask/​messenger@​1.1.0
	@​metamask/​profile-sync-controller@​28.0.0 ⏵ 28.0.2				+2
	@​metamask/​json-rpc-engine@​10.2.3 ⏵ 10.2.4	+1			+3

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• @metamask/snaps-controllers@19.0.0

View full report

[Mrtenz]

@SocketSecurity ignore npm/@metamask/snaps-controllers@19.0.0

This is ours, and seems to be a false positive.