chore: popover issue with preview builds

[georgewrmarshall]

Description

This PR tests whether reverting the LavaMoat patch fixes the popover positioning issue in production builds.

This PR reverts commit ed02ac23e86fc3a20336901a2bef52365cdd6bb1 ("fix: lavamoat patch (#36628)") to test our theory that the LavaMoat policy changes are causing ALL popover components to fail to anchor properly to their reference elements in GitHub Actions builds.

The Problem:

• All popovers work correctly in local development and 13.5.0 branch builds
• All popovers fail to position correctly in GitHub Actions production builds on main branch
• Console errors show "TypeError: e is not a function" indicating @popperjs/core functions are blocked

The Theory:
The LavaMoat policy changes in the reverted commit are preventing @popperjs/core from accessing necessary DOM positioning APIs, causing popovers to float unanchored instead of positioning relative to their anchor elements.

This PR will prove/disprove the theory by:

1. Reverting the problematic LavaMoat changes
2. Testing if popovers work correctly in GitHub Actions builds
3. Determining if this is the root cause

Changelog

CHANGELOG entry: null

Related issues

Tests fix for popover positioning issue affecting ALL popover components in production builds.

Manual testing steps

1. Wait for GitHub Actions to build this PR
2. Download the built extension artifact
3. Load the extension in browser
4. Test popover positioning:
   • Click the account menu (top-right)
   • Click the global menu (hamburger icon)
   • Open network selector
   • Verify popovers anchor correctly to their reference elements

Expected Result: If our theory is correct, popovers should position correctly in the GitHub Actions build with the LavaMoat patch reverted.

Screenshots/Recordings

Before (Broken - main branch)

Popovers float unanchored in GitHub Actions builds due to LavaMoat blocking @popperjs/core

After (Testing - this PR)

Should show popovers correctly anchored if LavaMoat revert fixes the issue

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable (this IS the test)
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[metamaskbot]

✨ Files requiring CODEOWNER review ✨

🧩 @MetaMask/extension-devs (1 files, +1 -1)

• 📁 lavamoat/
  • 📁 build-system/
    • 📄 policy.json +1 -1

---

📜 @MetaMask/policy-reviewers (1 files, +1 -1)

• 📁 lavamoat/
  • 📁 build-system/
    • 📄 policy.json +1 -1

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.

---

🔗 @MetaMask/supply-chain (1 files, +1 -1)

• 📁 lavamoat/
  • 📁 build-system/
    • 📄 policy.json +1 -1

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​babel/​helper-hoist-variables@​7.24.7
	@​babel/​helper-environment-visitor@​7.24.7
	@​babel/​helper-split-export-declaration@​7.24.7
	to-fast-properties@​2.0.0
	@​babel/​helper-function-name@​7.24.7
	lavamoat-core@​16.7.1
	mixin-object@​2.0.1
	shallow-clone@​0.1.2
	clone-deep@​0.2.4
	lazy-cache@​1.0.4
	merge-deep@​3.0.3

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• [email protected]

View full report

[georgewrmarshall]

@metamaskbot update-policies

[metamaskbot]

No policy changes

[georgewrmarshall]

@SocketSecurity ignore [email protected]

[metamaskbot]

📊 Page Load Benchmark Results

Current Commit: d838472 | Date: 10/15/2025

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

• pageLoadTime-> current mean value: 1.08s (±78ms) 🟡 | historical mean value: 1.05s ⬆️ (historical data)
• domContentLoaded-> current mean value: 757ms (±73ms) 🟢 | historical mean value: 734ms ⬆️ (historical data)
• firstContentfulPaint-> current mean value: 82ms (±17ms) 🟢 | historical mean value: 80ms ⬆️ (historical data)

📈 Detailed Results

Metric	Mean	Std Dev	Min	Max	P95	P99
pageLoadTime	1.08s	78ms	1.03s	1.37s	1.35s	1.37s
domContentLoaded	757ms	73ms	714ms	1.04s	991ms	1.04s
firstPaint	82ms	17ms	60ms	204ms	92ms	204ms
firstContentfulPaint	82ms	17ms	60ms	204ms	92ms	204ms
largestContentfulPaint	0ms	0ms	0ms	0ms	0ms	0ms

---

Results generated automatically by MetaMask CI

[metamaskbot]

Builds ready [d838472]

• builds: chrome, firefox
• builds (beta): chrome, firefox
• builds (flask): chrome, firefox
• builds (test): chrome, firefox
• builds (test-flask): chrome, firefox
• build viz: Build System
• bundle size: Bundle Size Stats
• user-actions-benchmark: User Actions Stats
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts
• bundle viz:

  • background: 0, 1, 2, 3, 4, 5, 6, 7, 8
  • common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13
  • ui: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
  • content-script: 0
  • offscreen: 0

UI Startup Metrics (1240 ± 59 ms)

Platform	BuildType	Page	Metric	Mean (ms)	Min (ms)	Max (ms)	Std Dev (ms)	P 75 (ms)	P 95 (ms)
Chrome	Browserify	Home	uiStartup	1240	1105	1407	59	1272	1335
			load	1065	958	1200	54	1092	1147
			domContentLoaded	1058	953	1181	53	1086	1141
			domInteractive	18	13	56	9	17	42
			firstPaint	679	78	1213	437	1089	1147
			backgroundConnect	252	239	285	8	255	271
			firstReactRender	25	18	59	7	26	40
			getState	14	5	82	11	17	27
			initialActions	4	0	38	5	5	11
			loadScripts	813	711	921	51	841	901
			setupStore	9	6	24	3	10	16
	Webpack	Home	uiStartup	835	715	1141	76	846	1036
			load	632	577	964	78	634	880
			domContentLoaded	624	572	954	77	624	870
			domInteractive	16	11	57	10	14	47
			firstPaint	174	55	765	167	178	589
			backgroundConnect	21	10	41	7	26	32
			firstReactRender	27	16	58	8	32	36
			getState	9	3	16	3	11	12
			initialActions	2	0	9	2	4	5
			loadScripts	621	570	943	74	623	859
			setupStore	10	5	23	3	11	13
Firefox	Browserify	Home	uiStartup	1429	1258	2050	134	1502	1692
			load	1199	1073	1434	92	1273	1358
			domContentLoaded	1199	1073	1434	92	1272	1358
			domInteractive	99	33	296	54	104	243
			firstPaint	NaN	NaN	NaN	NaN	NaN	NaN
			backgroundConnect	35	22	148	18	39	54
			firstReactRender	29	25	54	5	31	40
			getState	9	5	68	9	8	16
			initialActions	5	2	101	11	4	9
			loadScripts	1176	1055	1405	90	1247	1341
			setupStore	16	5	247	35	10	61
	Webpack	Home	uiStartup	1555	1344	2029	131	1600	1818
			load	1331	1158	1624	98	1406	1527
			domContentLoaded	1331	1158	1623	98	1405	1527
			domInteractive	103	30	397	80	98	350
			firstPaint	NaN	NaN	NaN	NaN	NaN	NaN
			backgroundConnect	35	21	93	13	40	67
			firstReactRender	32	26	79	10	34	40
			getState	10	4	134	15	9	16
			initialActions	7	1	67	12	3	41
			loadScripts	1308	1142	1602	95	1381	1454
			setupStore	14	5	251	26	10	42

Bundle size diffs [🚀 Bundle size reduced!]

• background: 58 Bytes (0%)
• ui: 0 Bytes (0%)
• common: -111 Bytes (0%)