feat(solana-wallet-snap): bump solana kit v6.9

[taran-a]

Explanation

Upgrade Solana dependencies to @solana/kit 6.9.x, SNS SDK 1.x, and compatible Solana program packages.
Migrate transaction, instruction, signing, fee estimation, and RPC types/APIs to the new Kit interfaces.
Add support for resolving both .sns and .sol domains.
Update reverse address resolution to return .sns domains.
Update related tests, mocks, lockfile, and changelog.

Screen.Recording.2026-09-04.at.13.45.31.mov

References

• Related to WPN-1829

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​solana-name-service/​sns-sdk-kit@​0.9.0-beta ⏵ 1.0.1	+5		+19	+5
	@​solana-program/​compute-budget@​0.7.0 ⏵ 0.15.0	+1		+1	+3
	@​solana-program/​system@​0.7.0 ⏵ 0.12.2	+1		+1
	@​solana-program/​token@​0.5.1 ⏵ 0.14.0			+1	+2
	@​solana-program/​token-2022@​0.5.0 ⏵ 0.12.0			+1	+2
	@​solana/​kit@​2.1.0 ⏵ 6.10.0			+1

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Network access: npm @solana/program-client-core in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/solana-wallet-snap/package.json → npm/@solana/kit@6.10.0 → npm/@solana/program-client-core@6.10.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@solana/program-client-core@6.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @solana-program/zk-elgamal-proof reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: packages/solana-wallet-snap/package.json → npm/@solana-program/token-2022@0.12.0 → npm/@solana-program/zk-elgamal-proof@0.2.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@solana-program/zk-elgamal-proof@0.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ws is 75.0% likely to have a medium risk anomaly Notes: The code implements a standard EventTarget-like mixin for wrapping event listeners and dispatching events to user callbacks. There are no suspicious patterns such as dynamic code execution, hardcoded secrets, or network activity. The risk is contingent on what the consumer does inside their handlers; the snippet itself does not introduce malware or data leakage mechanisms beyond normal event dispatch. Overall security risk is low in isolation. Confidence: 0.75 Severity: 0.50 From: packages/solana-wallet-snap/package.json → npm/@solana/kit@6.10.0 → npm/ws@8.21.3 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ws@8.21.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[taran-a]

@metamaskbot publish-preview

[github-actions]

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.

@metamask-previews/bitcoin-wallet-snap@2.0.1-preview-471dac7
@metamask-previews/snap-networks-utils@1.0.0-preview-471dac7
@metamask-previews/solana-wallet-snap@6.0.0-preview-471dac7
@metamask-previews/stellar-wallet-snap@0.1.0-preview-471dac7
@metamask-previews/tron-wallet-snap@3.2.0-preview-471dac7

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
95.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mikesposito]

Thanks for taking care of this bump! This PR looks mostly good, I only have comments over typecasts

[mikesposito]

Is there a scenario where this turns out to be undefined? If so, perhaps we should add an if condition and throw an error in case it is - that will also make TS happy

[mikesposito]

hmm, I think these casts to InstructionWithData<Uint8Array> are needed because NormalizedInput does not accept any type parameter, so NormalizedInput.instructions always use the default one. Do you think we can change NormalizedInput with a generic type so that we avoid this cast here?

[mikesposito]

I was trying to figure out if this cast is necessary, and I realized that fromCompilableTransactionMessageToBase64String is only called by test files. Perhaps we should consider removing this function altogether

[mikesposito]

This cast is not ideal, but it was already there. We should consider removing it at some point.