You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
chore(runway): cherry-pick fix: bump axios to 1.15.0 to resolve critical SSRF vulnerability (#28717)
- fix: bump axios to 1.15.0 to resolve critical SSRF vulnerability
(#28620)
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->
## **Description**
CI is failing on `yarn audit:ci` due to a critical severity advisory
([GHSA-3p68-rc4w-qgx5](GHSA-3p68-rc4w-qgx5))
in axios < 1.15.0. The vulnerability allows an attacker to bypass
`NO_PROXY` hostname normalization, leading to SSRF.
This PR bumps axios from 1.13.5 to 1.15.0 across `dependencies`,
`resolutions`, and the CI scripts package. Because 1.15.0 was published
less than 3 days ago, it is also temporarily added to
`npmPreapprovedPackages` in `.yarnrc.yml` to bypass the
`npmMinimalAgeGate`. This preapproval entry should be removed after
2025-04-12.
## **Changelog**
<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`
If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`
(This helps the Release Engineer do their job more quickly and
accurately)
-->
CHANGELOG entry: null
## **Related issues**
Fixes:
## **Manual testing steps**
```gherkin
Feature: my feature name
Scenario: user [verb for user action]
Given [describe expected initial app state]
When user [verb for user action]
Then [describe expected outcome]
```
## **Screenshots/Recordings**
<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->
### **Before**
<!-- [screenshots/recordings] -->
### **After**
<!-- [screenshots/recordings] -->
## **Pre-merge author checklist**
- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.
## **Pre-merge reviewer checklist**
- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Updates a widely used HTTP client to remediate a critical SSRF
advisory; moderate risk due to potential subtle networking/proxy
behavior changes across the app and CI scripts.
>
> **Overview**
> **Bumps `axios` from `^1.13.5` to `^1.15.0` across the repo** (app
`dependencies`, `resolutions`, and the `.github/scripts` workspace) to
address the flagged security advisory.
>
> Updates both lockfiles to the new `axios` and its transitive
`proxy-from-env@^2.1.0`, and temporarily adds `axios` to `.yarnrc.yml`
`npmPreapprovedPackages` to bypass the 3-day `npmMinimalAgeGate` for
this release.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
34350ca. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
[f8a6fb8](f8a6fb8)
---------
Co-authored-by: Wei Sun <wei.sun@consensys.net>
Co-authored-by: georgewrmarshall <george.marshall@consensys.net>
![runway-github[bot]](https://avatars.githubusercontent.com/in/86225?v=4&size=40){kind=avatar}
0 commit comments