chore: bump axios to ^1.18.0 to resolve moderate security advisories

[weitingsun]

Description

yarn audit:ci was failing because axios@1.16.1 was locked across the entire
dependency tree, triggering three moderate-severity advisories.
The resolutions override in package.json was pinning axios to ^1.16.0,
which kept the vulnerable 1.16.1 in yarn.lock even though newer patched
versions exist. This PR bumps axios to ^1.18.0 (resolves to 1.18.1) in both
the direct dependency and the resolutions override, then relocks so every
dependent (Appium, Ledger, on-ramp-sdk, sats-connect, stellar-sdk, etc.) uses
the patched version.

Advisories resolved

Advisory	Issue	Fixed in
GHSA-42h9-826w-cgv3	Excessive recursion in formDataToJSON → DoS	1.18.0
GHSA-xj6q-8x83-jv6g	Prototype pollution in auth subfields → Basic auth injection	1.18.0
GHSA-pmv8-rq9r-6j72	Deep formToJSON key recursion → DoS	1.18.0

Changes

• package.json: bump axios ^1.16.0 → ^1.18.0 (direct dependency + resolutions)
• yarn.lock: relock — axios@1.16.1 → axios@1.18.1

Changelog

CHANGELOG entry:null

Related issues

Fixes: CI audit failing

Manual testing steps

1. Run yarn audit:ci → passes with No audit suggestions (exit code 0)
2. Run yarn why axios → all dependents resolve to axios@npm:1.18.1
3. Smoke test flows that use axios (on-ramp/buy, Ledger connection, Appium E2E) to confirm no regressions

Screenshots/Recordings

N/A

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[metamask-ci]

PR template — items to address before "Ready for review"

Warnings — informational, address before merging:

• Pre-merge author checklist has unchecked items (e.g. "I've included tests if applicable"). Every box must be consciously checked — see docs/readme/ready-for-review.md.

See docs/readme/ready-for-review.md for the full Definition of Ready for Review.

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeMoney, SmokeNetworkAbstractions
• Selected Performance tags: None (no tests recommended)
• Risk Level: low
• AI Confidence: 82%

click to see 🤖 AI reasoning details

E2E Test Selection:
The PR bumps axios from ^1.16.0 (resolved: 1.16.1) to ^1.18.0 (resolved: 1.18.1) — a minor version bump applied as an override/resolution forcing all packages to use the new version.

Axios usage in app code is limited to:

1. Card controller services (BaanxService.ts, ImmersveService.ts) → SmokeMoney
2. Network checker utility (networkChecker.util.ts) → SmokeNetworkAbstractions

Axios is also used in E2E test infrastructure (FixtureHelper.ts, e2eCommandPolling.ts, e2eStateExport.ts) and performance test helpers, but these are test utilities that are unlikely to be broken by a minor axios version bump.

Since axios maintains backward compatibility within major versions (1.x), this is a low-risk change. The minor version bump (1.16→1.18) typically includes bug fixes and security patches without breaking API changes. Selected SmokeMoney and SmokeNetworkAbstractions to cover the two main app-code consumers of axios. No performance tests are needed as this is a dependency version bump with no changes to performance-sensitive rendering or computation paths.

Performance Test Selection:
The axios bump is a minor version update to an HTTP client library. While axios is used in the performance test feature-flag-helper.ts, this is a test utility file, not app code that affects measured performance metrics. No performance-sensitive rendering, computation, or data loading paths are changed. No performance tags are warranted.

View GitHub Actions results

[Cal-L]

LGTM

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud