chore: bump axios to ^1.18.0 to resolve moderate security advisories by weitingsun · Pull Request #33541 · MetaMask/metamask-mobile

weitingsun · 2026-07-20T18:51:54Z

Description

yarn audit:ci was failing because axios@1.16.1 was locked across the entire
dependency tree, triggering three moderate-severity advisories.
The resolutions override in package.json was pinning axios to ^1.16.0,
which kept the vulnerable 1.16.1 in yarn.lock even though newer patched
versions exist. This PR bumps axios to ^1.18.0 (resolves to 1.18.1) in both
the direct dependency and the resolutions override, then relocks so every
dependent (Appium, Ledger, on-ramp-sdk, sats-connect, stellar-sdk, etc.) uses
the patched version.

Advisories resolved

Advisory	Issue	Fixed in
GHSA-42h9-826w-cgv3	Excessive recursion in `formDataToJSON` → DoS	1.18.0
GHSA-xj6q-8x83-jv6g	Prototype pollution in auth subfields → Basic auth injection	1.18.0
GHSA-pmv8-rq9r-6j72	Deep `formToJSON` key recursion → DoS	1.18.0

Changes

package.json: bump axios ^1.16.0 → ^1.18.0 (direct dependency + resolutions)
yarn.lock: relock — axios@1.16.1 → axios@1.18.1

Changelog

CHANGELOG entry:null

Related issues

Fixes: CI audit failing

Manual testing steps

Run yarn audit:ci → passes with No audit suggestions (exit code 0)
Run yarn why axios → all dependents resolve to axios@npm:1.18.1
Smoke test flows that use axios (on-ramp/buy, Ledger connection, Appium E2E) to confirm no regressions

Screenshots/Recordings

N/A

Pre-merge author checklist

I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
I've completed the PR template to the best of my ability
I've included tests if applicable
I've documented my code using JSDoc format if applicable
I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

I've tested on Android
- Ideally on a mid-range device; emulator is acceptable
I've tested with a power user scenario
- Use these power-user SRPs to import wallets with many accounts and tokens
I've instrumented key operations with Sentry traces for production performance metrics
- See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

github-actions · 2026-07-20T18:52:03Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

metamask-ci · 2026-07-20T18:52:41Z

PR template — items to address before "Ready for review"

Warnings — informational, address before merging:

Pre-merge author checklist has unchecked items (e.g. "I've included tests if applicable"). Every box must be consciously checked — see docs/readme/ready-for-review.md.

See docs/readme/ready-for-review.md for the full Definition of Ready for Review.

github-actions · 2026-07-20T18:54:34Z

🔍 Smart E2E Test Selection

Selected E2E tags: SmokeMoney, SmokeNetworkAbstractions
Selected Performance tags: None (no tests recommended)
Risk Level: low
AI Confidence: 82%

click to see 🤖 AI reasoning details

E2E Test Selection:
The PR bumps axios from ^1.16.0 (resolved: 1.16.1) to ^1.18.0 (resolved: 1.18.1) — a minor version bump applied as an override/resolution forcing all packages to use the new version.

Axios usage in app code is limited to:

Card controller services (BaanxService.ts, ImmersveService.ts) → SmokeMoney
Network checker utility (networkChecker.util.ts) → SmokeNetworkAbstractions

Axios is also used in E2E test infrastructure (FixtureHelper.ts, e2eCommandPolling.ts, e2eStateExport.ts) and performance test helpers, but these are test utilities that are unlikely to be broken by a minor axios version bump.

Since axios maintains backward compatibility within major versions (1.x), this is a low-risk change. The minor version bump (1.16→1.18) typically includes bug fixes and security patches without breaking API changes. Selected SmokeMoney and SmokeNetworkAbstractions to cover the two main app-code consumers of axios. No performance tests are needed as this is a dependency version bump with no changes to performance-sensitive rendering or computation paths.

Performance Test Selection:
The axios bump is a minor version update to an HTTP client library. While axios is used in the performance test feature-flag-helper.ts, this is a test utility file, not app code that affects measured performance metrics. No performance-sensitive rendering, computation, or data loading paths are changed. No performance tags are warranted.

View GitHub Actions results

Cal-L

LGTM

sonarqubecloud · 2026-07-20T19:12:24Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

gauthierpetetin · 2026-07-21T10:06:01Z

Missing release label release-8.3.0 on PR. Adding release label release-8.3.0 on PR and removing other release labels(release-8.5.0), as PR was cherry-picked in branch 8.3.0.

gauthierpetetin · 2026-07-21T10:06:02Z

Missing release label release-8.4.0 on PR. Adding release label release-8.4.0 on PR and removing other release labels(release-8.5.0), as PR was cherry-picked in branch 8.4.0.

gauthierpetetin · 2026-07-22T10:07:29Z

More than one release label on PR. Keeping the lowest one (release-8.3.0) on PR and removing other release labels (release-8.4.0).

gauthierpetetin · 2026-07-22T10:07:29Z

More than one release label on PR. Keeping the lowest one (release-8.3.0) on PR and removing other release labels (release-8.4.0).

chore: bump axios to ^1.18.0 to resolve moderate security advisories

1b395b0

metamask-ci Bot added the team-mobile-platform Mobile Platform team label Jul 20, 2026

github-actions Bot added the size-XS label Jul 20, 2026

weitingsun marked this pull request as ready for review July 20, 2026 18:53

Cal-L approved these changes Jul 20, 2026

View reviewed changes

weitingsun enabled auto-merge July 20, 2026 18:56

github-actions Bot added the risk:low AI analysis: low risk label Jul 20, 2026

weitingsun self-assigned this Jul 20, 2026

joaoloureirop approved these changes Jul 20, 2026

View reviewed changes

weitingsun added this pull request to the merge queue Jul 20, 2026

Merged via the queue into main with commit ed232b8 Jul 20, 2026
346 of 378 checks passed

weitingsun deleted the wsun/upgrade-axios-to-1.18.0 branch July 20, 2026 19:48

github-actions Bot locked and limited conversation to collaborators Jul 20, 2026

metamask-ci Bot added the release-8.5.0 Issue or pull request that will be included in release 8.5.0 label Jul 20, 2026

metamaskbot added release-8.3.0 Issue or pull request that will be included in release 8.3.0 release-8.4.0 Issue or pull request that will be included in release 8.4.0 and removed release-8.5.0 Issue or pull request that will be included in release 8.5.0 labels Jul 21, 2026

metamaskbot removed the release-8.4.0 Issue or pull request that will be included in release 8.4.0 label Jul 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore: bump axios to ^1.18.0 to resolve moderate security advisories#33541

chore: bump axios to ^1.18.0 to resolve moderate security advisories#33541
weitingsun merged 1 commit into
mainfrom
wsun/upgrade-axios-to-1.18.0

weitingsun commented Jul 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

metamask-ci Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

Cal-L left a comment

Uh oh!

sonarqubecloud Bot commented Jul 20, 2026

Uh oh!

Uh oh!

gauthierpetetin commented Jul 21, 2026

Uh oh!

gauthierpetetin commented Jul 21, 2026

Uh oh!

gauthierpetetin commented Jul 22, 2026

Uh oh!

gauthierpetetin commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Uh oh!

Conversation

weitingsun commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Advisories resolved

Changes

Changelog

Related issues

Manual testing steps

Screenshots/Recordings

Pre-merge author checklist

Performance checks (if applicable)

Pre-merge reviewer checklist

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

metamask-ci Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR template — items to address before "Ready for review"

Uh oh!

github-actions Bot commented Jul 20, 2026

🔍 Smart E2E Test Selection

Uh oh!

Cal-L left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Jul 20, 2026

Quality Gate passed

Uh oh!

Uh oh!

gauthierpetetin commented Jul 21, 2026

Uh oh!

gauthierpetetin commented Jul 21, 2026

Uh oh!

gauthierpetetin commented Jul 22, 2026

Uh oh!

gauthierpetetin commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

weitingsun commented Jul 20, 2026 •

edited

Loading

metamask-ci Bot commented Jul 20, 2026 •

edited

Loading