Skip to content

Commit ca3f535

Browse files
MarioAslausethkfmanGudahttCal-L
authored and
joaoloureirop
committed
feat: bump axios to fix audit issue (#25853)
<!-- Please submit this PR as a draft initially. Do not mark it as "Ready for review" until the template has been completely filled out, and PR status checks have passed at least once. --> ## **Description** **Reason for change:** `yarn audit:ci` was failing due to a high-severity vulnerability in `axios` (GHSA-43fc-jf86-j433): Denial of Service via the `__proto__` key in `mergeConfig`. Affected versions are ≤1.13.4; the project was on 1.12.2. **Solution:** - Bumped axios resolutions to `^1.13.5` in root `package.json` (both resolution entries) and in `.github/scripts/package.json`. - Added `axios` to `npmPreapprovedPackages` in `.yarnrc.yml` so Yarn’s 3-day minimal age gate allows the new release. - Ran `yarn install --no-immutable` to update the lockfile to axios 1.13.5. No code changes; dependency upgrade only. `yarn audit:ci` now passes. ## **Changelog** CHANGELOG entry: null ## **Related issues** Fixes: N/A ## **Manual testing steps** ```gherkin Feature: Security audit and dependency usage after axios upgrade Scenario: CI audit passes after axios upgrade Given the repo has axios resolved to 1.13.5 When I run yarn audit:ci Then the command exits with code 0 and reports no audit suggestions Scenario: App and scripts still run with upgraded axios Given the branch is checked out and dependencies are installed When I run yarn install and then run any flow that uses axios (e.g. scripts or app network calls) Then no runtime errors occur and behavior is unchanged ``` ## **Screenshots/Recordings** Not applicable (dependency-only change; no UI changes). ### **Before** N/A ### **After** N/A ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Dependency upgrade plus bundler resolution changes could affect runtime networking behavior or Metro module resolution, especially if any code relied on Axios’ Node build. > > **Overview** > Bumps `axios` to `^1.13.5` (and updates both root `yarn.lock` and `.github/scripts/yarn.lock`) to address the reported security advisory. > > Updates `metro.config.js` resolver logic to always redirect `axios` (and `axios/dist/node/*`) imports to `axios/dist/browser/axios.cjs`, while preserving the existing E2E-only Sentry module mocking behavior under the new unified `resolveRequest` handler. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 520829a. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: sethkfman <10342624+sethkfman@users.noreply.github.com> Co-authored-by: Mark Stacey <markjstacey@gmail.com> Co-authored-by: Cal-L <cal.leung@consensys.net>
1 parent f258325 commit ca3f535

5 files changed

Lines changed: 215 additions & 52 deletions

File tree

‎.github/scripts/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"dependencies": {
1616
"@actions/core": "^1.10.1",
1717
"@actions/github": "^6.0.0",
18-
"axios": "^1.7.4",
18+
"axios": "^1.13.5",
1919
"simple-git": "^3.25.0"
2020
},
2121
"devDependencies": {

‎.github/scripts/yarn.lock‎

Lines changed: 155 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ __metadata:
151151
"@lavamoat/allow-scripts": "npm:^3.2.0"
152152
"@lavamoat/preinstall-always-fail": "npm:^2.1.0"
153153
"@types/node": "npm:^20.16.2"
154-
axios: "npm:^1.7.4"
154+
axios: "npm:^1.13.5"
155155
simple-git: "npm:^3.25.0"
156156
ts-node: "npm:^10.5.0"
157157
typescript: "npm:~5.4.5"
@@ -487,21 +487,35 @@ __metadata:
487487
languageName: node
488488
linkType: hard
489489

490+
"async-function@npm:^1.0.0":
491+
version: 1.0.0
492+
resolution: "async-function@npm:1.0.0"
493+
checksum: 10/1a09379937d846f0ce7614e75071c12826945d4e417db634156bf0e4673c495989302f52186dfa9767a1d9181794554717badd193ca2bbab046ef1da741d8efd
494+
languageName: node
495+
linkType: hard
496+
497+
"async-generator-function@npm:^1.0.0":
498+
version: 1.0.0
499+
resolution: "async-generator-function@npm:1.0.0"
500+
checksum: 10/3d49e7acbeee9e84537f4cb0e0f91893df8eba976759875ae8ee9e3d3c82f6ecdebdb347c2fad9926b92596d93cdfc78ecc988bcdf407e40433e8e8e6fe5d78e
501+
languageName: node
502+
linkType: hard
503+
490504
"asynckit@npm:^0.4.0":
491505
version: 0.4.0
492506
resolution: "asynckit@npm:0.4.0"
493507
checksum: 10/3ce727cbc78f69d6a4722517a58ee926c8c21083633b1d3fdf66fd688f6c127a53a592141bd4866f9b63240a86e9d8e974b13919450bd17fa33c2d22c4558ad8
494508
languageName: node
495509
linkType: hard
496510

497-
"axios@npm:^1.7.4":
498-
version: 1.7.5
499-
resolution: "axios@npm:1.7.5"
511+
"axios@npm:^1.13.5":
512+
version: 1.13.5
513+
resolution: "axios@npm:1.13.5"
500514
dependencies:
501-
follow-redirects: "npm:^1.15.6"
502-
form-data: "npm:^4.0.0"
515+
follow-redirects: "npm:^1.15.11"
516+
form-data: "npm:^4.0.5"
503517
proxy-from-env: "npm:^1.1.0"
504-
checksum: 10/6cbcfe943a84089f420a900a3a3aeb54ee94dcc9c2b81b150434896357be5d1079eff0b1bbb628597371e79f896b1bc5776df04184756ba99656ff31df9a75bf
518+
checksum: 10/db726d09902565ef9a0632893530028310e2ec2b95b727114eca1b101450b00014133dfc3871cffc87983fb922bca7e4874d7e2826d1550a377a157cdf3f05b6
505519
languageName: node
506520
linkType: hard
507521

@@ -560,6 +574,16 @@ __metadata:
560574
languageName: node
561575
linkType: hard
562576

577+
"call-bind-apply-helpers@npm:^1.0.1, call-bind-apply-helpers@npm:^1.0.2":
578+
version: 1.0.2
579+
resolution: "call-bind-apply-helpers@npm:1.0.2"
580+
dependencies:
581+
es-errors: "npm:^1.3.0"
582+
function-bind: "npm:^1.1.2"
583+
checksum: 10/00482c1f6aa7cfb30fb1dbeb13873edf81cfac7c29ed67a5957d60635a56b2a4a480f1016ddbdb3395cc37900d46037fb965043a51c5c789ffeab4fc535d18b5
584+
languageName: node
585+
linkType: hard
586+
563587
"chownr@npm:^2.0.0":
564588
version: 2.0.0
565589
resolution: "chownr@npm:2.0.0"
@@ -668,6 +692,17 @@ __metadata:
668692
languageName: node
669693
linkType: hard
670694

695+
"dunder-proto@npm:^1.0.1":
696+
version: 1.0.1
697+
resolution: "dunder-proto@npm:1.0.1"
698+
dependencies:
699+
call-bind-apply-helpers: "npm:^1.0.1"
700+
es-errors: "npm:^1.3.0"
701+
gopd: "npm:^1.2.0"
702+
checksum: 10/5add88a3d68d42d6e6130a0cac450b7c2edbe73364bbd2fc334564418569bea97c6943a8fcd70e27130bf32afc236f30982fc4905039b703f23e9e0433c29934
703+
languageName: node
704+
linkType: hard
705+
671706
"eastasianwidth@npm:^0.2.0":
672707
version: 0.2.0
673708
resolution: "eastasianwidth@npm:0.2.0"
@@ -712,6 +747,41 @@ __metadata:
712747
languageName: node
713748
linkType: hard
714749

750+
"es-define-property@npm:^1.0.1":
751+
version: 1.0.1
752+
resolution: "es-define-property@npm:1.0.1"
753+
checksum: 10/f8dc9e660d90919f11084db0a893128f3592b781ce967e4fccfb8f3106cb83e400a4032c559184ec52ee1dbd4b01e7776c7cd0b3327b1961b1a4a7008920fe78
754+
languageName: node
755+
linkType: hard
756+
757+
"es-errors@npm:^1.3.0":
758+
version: 1.3.0
759+
resolution: "es-errors@npm:1.3.0"
760+
checksum: 10/96e65d640156f91b707517e8cdc454dd7d47c32833aa3e85d79f24f9eb7ea85f39b63e36216ef0114996581969b59fe609a94e30316b08f5f4df1d44134cf8d5
761+
languageName: node
762+
linkType: hard
763+
764+
"es-object-atoms@npm:^1.0.0, es-object-atoms@npm:^1.1.1":
765+
version: 1.1.1
766+
resolution: "es-object-atoms@npm:1.1.1"
767+
dependencies:
768+
es-errors: "npm:^1.3.0"
769+
checksum: 10/54fe77de288451dae51c37bfbfe3ec86732dc3778f98f3eb3bdb4bf48063b2c0b8f9c93542656986149d08aa5be3204286e2276053d19582b76753f1a2728867
770+
languageName: node
771+
linkType: hard
772+
773+
"es-set-tostringtag@npm:^2.1.0":
774+
version: 2.1.0
775+
resolution: "es-set-tostringtag@npm:2.1.0"
776+
dependencies:
777+
es-errors: "npm:^1.3.0"
778+
get-intrinsic: "npm:^1.2.6"
779+
has-tostringtag: "npm:^1.0.2"
780+
hasown: "npm:^2.0.2"
781+
checksum: 10/86814bf8afbcd8966653f731415888019d4bc4aca6b6c354132a7a75bb87566751e320369654a101d23a91c87a85c79b178bcf40332839bd347aff437c4fb65f
782+
languageName: node
783+
linkType: hard
784+
715785
"escalade@npm:^3.1.1":
716786
version: 3.2.0
717787
resolution: "escalade@npm:3.2.0"
@@ -726,13 +796,13 @@ __metadata:
726796
languageName: node
727797
linkType: hard
728798

729-
"follow-redirects@npm:^1.15.6":
730-
version: 1.15.6
731-
resolution: "follow-redirects@npm:1.15.6"
799+
"follow-redirects@npm:^1.15.11":
800+
version: 1.15.11
801+
resolution: "follow-redirects@npm:1.15.11"
732802
peerDependenciesMeta:
733803
debug:
734804
optional: true
735-
checksum: 10/70c7612c4cab18e546e36b991bbf8009a1a41cf85354afe04b113d1117569abf760269409cb3eb842d9f7b03d62826687086b081c566ea7b1e6613cf29030bf7
805+
checksum: 10/07372fd74b98c78cf4d417d68d41fdaa0be4dcacafffb9e67b1e3cf090bc4771515e65020651528faab238f10f9b9c0d9707d6c1574a6c0387c5de1042cde9ba
736806
languageName: node
737807
linkType: hard
738808

@@ -746,14 +816,16 @@ __metadata:
746816
languageName: node
747817
linkType: hard
748818

749-
"form-data@npm:^4.0.0":
750-
version: 4.0.0
751-
resolution: "form-data@npm:4.0.0"
819+
"form-data@npm:^4.0.5":
820+
version: 4.0.5
821+
resolution: "form-data@npm:4.0.5"
752822
dependencies:
753823
asynckit: "npm:^0.4.0"
754824
combined-stream: "npm:^1.0.8"
825+
es-set-tostringtag: "npm:^2.1.0"
826+
hasown: "npm:^2.0.2"
755827
mime-types: "npm:^2.1.12"
756-
checksum: 10/7264aa760a8cf09482816d8300f1b6e2423de1b02bba612a136857413fdc96d7178298ced106817655facc6b89036c6e12ae31c9eb5bdc16aabf502ae8a5d805
828+
checksum: 10/52ecd6e927c8c4e215e68a7ad5e0f7c1031397439672fd9741654b4a94722c4182e74cc815b225dcb5be3f4180f36428f67c6dd39eaa98af0dcfdd26c00c19cd
757829
languageName: node
758830
linkType: hard
759831

@@ -782,13 +854,51 @@ __metadata:
782854
languageName: node
783855
linkType: hard
784856

857+
"generator-function@npm:^2.0.0":
858+
version: 2.0.1
859+
resolution: "generator-function@npm:2.0.1"
860+
checksum: 10/eb7e7eb896c5433f3d40982b2ccacdb3dd990dd3499f14040e002b5d54572476513be8a2e6f9609f6e41ab29f2c4469307611ddbfc37ff4e46b765c326663805
861+
languageName: node
862+
linkType: hard
863+
785864
"get-caller-file@npm:^2.0.5":
786865
version: 2.0.5
787866
resolution: "get-caller-file@npm:2.0.5"
788867
checksum: 10/b9769a836d2a98c3ee734a88ba712e62703f1df31b94b784762c433c27a386dd6029ff55c2a920c392e33657d80191edbf18c61487e198844844516f843496b9
789868
languageName: node
790869
linkType: hard
791870

871+
"get-intrinsic@npm:^1.2.6":
872+
version: 1.3.1
873+
resolution: "get-intrinsic@npm:1.3.1"
874+
dependencies:
875+
async-function: "npm:^1.0.0"
876+
async-generator-function: "npm:^1.0.0"
877+
call-bind-apply-helpers: "npm:^1.0.2"
878+
es-define-property: "npm:^1.0.1"
879+
es-errors: "npm:^1.3.0"
880+
es-object-atoms: "npm:^1.1.1"
881+
function-bind: "npm:^1.1.2"
882+
generator-function: "npm:^2.0.0"
883+
get-proto: "npm:^1.0.1"
884+
gopd: "npm:^1.2.0"
885+
has-symbols: "npm:^1.1.0"
886+
hasown: "npm:^2.0.2"
887+
math-intrinsics: "npm:^1.1.0"
888+
checksum: 10/bb579dda84caa4a3a41611bdd483dade7f00f246f2a7992eb143c5861155290df3fdb48a8406efa3dfb0b434e2c8fafa4eebd469e409d0439247f85fc3fa2cc1
889+
languageName: node
890+
linkType: hard
891+
892+
"get-proto@npm:^1.0.1":
893+
version: 1.0.1
894+
resolution: "get-proto@npm:1.0.1"
895+
dependencies:
896+
dunder-proto: "npm:^1.0.1"
897+
es-object-atoms: "npm:^1.0.0"
898+
checksum: 10/4fc96afdb58ced9a67558698b91433e6b037aaa6f1493af77498d7c85b141382cf223c0e5946f334fb328ee85dfe6edd06d218eaf09556f4bc4ec6005d7f5f7b
899+
languageName: node
900+
linkType: hard
901+
792902
"glob@npm:^10.2.2, glob@npm:^10.3.10":
793903
version: 10.4.5
794904
resolution: "glob@npm:10.4.5"
@@ -805,13 +915,36 @@ __metadata:
805915
languageName: node
806916
linkType: hard
807917

918+
"gopd@npm:^1.2.0":
919+
version: 1.2.0
920+
resolution: "gopd@npm:1.2.0"
921+
checksum: 10/94e296d69f92dc1c0768fcfeecfb3855582ab59a7c75e969d5f96ce50c3d201fd86d5a2857c22565764d5bb8a816c7b1e58f133ec318cd56274da36c5e3fb1a1
922+
languageName: node
923+
linkType: hard
924+
808925
"graceful-fs@npm:^4.2.6":
809926
version: 4.2.11
810927
resolution: "graceful-fs@npm:4.2.11"
811928
checksum: 10/bf152d0ed1dc159239db1ba1f74fdbc40cb02f626770dcd5815c427ce0688c2635a06ed69af364396da4636d0408fcf7d4afdf7881724c3307e46aff30ca49e2
812929
languageName: node
813930
linkType: hard
814931

932+
"has-symbols@npm:^1.0.3, has-symbols@npm:^1.1.0":
933+
version: 1.1.0
934+
resolution: "has-symbols@npm:1.1.0"
935+
checksum: 10/959385c98696ebbca51e7534e0dc723ada325efa3475350951363cce216d27373e0259b63edb599f72eb94d6cde8577b4b2375f080b303947e560f85692834fa
936+
languageName: node
937+
linkType: hard
938+
939+
"has-tostringtag@npm:^1.0.2":
940+
version: 1.0.2
941+
resolution: "has-tostringtag@npm:1.0.2"
942+
dependencies:
943+
has-symbols: "npm:^1.0.3"
944+
checksum: 10/c74c5f5ceee3c8a5b8bc37719840dc3749f5b0306d818974141dda2471a1a2ca6c8e46b9d6ac222c5345df7a901c9b6f350b1e6d62763fec877e26609a401bfe
945+
languageName: node
946+
linkType: hard
947+
815948
"hasown@npm:^2.0.2":
816949
version: 2.0.2
817950
resolution: "hasown@npm:2.0.2"
@@ -995,6 +1128,13 @@ __metadata:
9951128
languageName: node
9961129
linkType: hard
9971130

1131+
"math-intrinsics@npm:^1.1.0":
1132+
version: 1.1.0
1133+
resolution: "math-intrinsics@npm:1.1.0"
1134+
checksum: 10/11df2eda46d092a6035479632e1ec865b8134bdfc4bd9e571a656f4191525404f13a283a515938c3a8de934dbfd9c09674d9da9fa831e6eb7e22b50b197d2edd
1135+
languageName: node
1136+
linkType: hard
1137+
9981138
"mime-db@npm:1.52.0":
9991139
version: 1.52.0
10001140
resolution: "mime-db@npm:1.52.0"

‎metro.config.js‎

Lines changed: 32 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -93,29 +93,39 @@ module.exports = function (baseConfig) {
9393
buffer: '@craftzdog/react-native-buffer',
9494
'node:buffer': '@craftzdog/react-native-buffer',
9595
},
96-
resolveRequest: isE2E
97-
? (context, moduleName, platform) => {
98-
if (moduleName === '@sentry/react-native') {
99-
return {
100-
type: 'sourceFile',
101-
filePath: path.resolve(
102-
__dirname,
103-
'tests/module-mocking/sentry/react-native.ts',
104-
),
105-
};
106-
}
107-
if (moduleName === '@sentry/core') {
108-
return {
109-
type: 'sourceFile',
110-
filePath: path.resolve(
111-
__dirname,
112-
'tests/module-mocking/sentry/core.ts',
113-
),
114-
};
115-
}
116-
return context.resolveRequest(context, moduleName, platform);
96+
resolveRequest: (context, moduleName, platform) => {
97+
// Use axios browser build so Node-only deps (e.g. http2) are never pulled in
98+
if (
99+
moduleName === 'axios' ||
100+
moduleName.includes('axios/dist/node/')
101+
) {
102+
return {
103+
filePath: require.resolve('axios/dist/browser/axios.cjs'),
104+
type: 'sourceFile',
105+
};
106+
}
107+
if (isE2E) {
108+
if (moduleName === '@sentry/react-native') {
109+
return {
110+
type: 'sourceFile',
111+
filePath: path.resolve(
112+
__dirname,
113+
'tests/module-mocking/sentry/react-native.ts',
114+
),
115+
};
117116
}
118-
: defaultConfig.resolver.resolveRequest,
117+
if (moduleName === '@sentry/core') {
118+
return {
119+
type: 'sourceFile',
120+
filePath: path.resolve(
121+
__dirname,
122+
'tests/module-mocking/sentry/core.ts',
123+
),
124+
};
125+
}
126+
}
127+
return context.resolveRequest(context, moduleName, platform);
128+
},
119129
},
120130
transformer: {
121131
babelTransformerPath: require.resolve('./metro.transform.js'),

‎package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@
142142
"d3-color": "3.1.0",
143143
"color-string": "^1.9.1",
144144
"tough-cookie": "4.1.3",
145-
"axios": "^1.12.0",
145+
"axios": "^1.13.5",
146146
"redux-persist-filesystem-storage/react-native-blob-util": "^0.19.9",
147147
"xmldom": "npm:@xmldom/xmldom@0.7.13",
148148
"@metamask/metamask-eth-abis": "3.1.1",
@@ -349,7 +349,7 @@
349349
"@walletconnect/utils": "^2.23.0",
350350
"@xmldom/xmldom": "^0.8.10",
351351
"asyncstorage-down": "4.2.0",
352-
"axios": "^1.8.2",
352+
"axios": "^1.13.5",
353353
"bignumber.js": "^9.0.1",
354354
"bitcoin-address-validation": "2.2.3",
355355
"bnjs4": "npm:bn.js@^4.12.0",

0 commit comments

Comments
 (0)