Skip to content

chore(ci): cherry-pick xmldom 0.8.12 bump (#28424) into release/7.72.0#28458

Merged
chloeYue merged 2 commits into
release/7.72.0from
chore/cherry-pick-28424-xmldom
Apr 7, 2026
Merged

chore(ci): cherry-pick xmldom 0.8.12 bump (#28424) into release/7.72.0#28458
chloeYue merged 2 commits into
release/7.72.0from
chore/cherry-pick-28424-xmldom

Conversation

@chloeYue

@chloeYue chloeYue commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Cherry-picks PR #28424 (chore(deps): bump @xmldom/xmldom to 0.8.12 + lockfile dedupe) onto release/7.72.0 for inclusion in the release train tracked by PR #27990.

Motivation

Addresses production dependency audit (GHSA-wh4c-j3r5-mjhp) by bumping @xmldom/xmldom to 0.8.12 and deduping yarn.lock so resolved versions align.

Commits (cherry-picked)

  • 46057e87e4 — chore(deps): bump @xmldom/xmldom to 0.8.12
  • 776772ffcd — chore(deps): dedupe lockfile after xmldom bump
    CHANGELOG entry: null

Testing

  • CI green on this PR
  • yarn audit:ci / audit expectations as appropriate for release branch

Made with Cursor


Note

Low Risk
Low risk dependency-only change: bumps @xmldom/xmldom and updates the lockfile resolution/checksum, with no application code changes.

Overview
Updates the @xmldom/xmldom dependency from ^0.8.10 to ^0.8.12 in package.json.

Refreshes yarn.lock to resolve @xmldom/xmldom to 0.8.12 (updated resolution key/checksum), aligning the lockfile with the bumped version.

Reviewed by Cursor Bugbot for commit 307083e. Bugbot is set up for automated code reviews on this repo. Configure here.

@github-actions

github-actions Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the team-qa QA team label Apr 7, 2026
@chloeYue chloeYue changed the title chore(deps): cherry-pick xmldom 0.8.12 bump (#28424) into release/7.72.0 chore(ci): cherry-pick xmldom 0.8.12 bump (#28424) into release/7.72.0 Apr 7, 2026
@github-actions github-actions Bot added the risk-low Low testing needed · Low bug introduction risk label Apr 7, 2026
@github-actions

github-actions Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeNetworkExpansion
  • Selected Performance tags: None (no tests recommended)
  • Risk Level: low
  • AI Confidence: 82%
click to see 🤖 AI reasoning details

E2E Test Selection:
The only change is a patch version bump of @xmldom/xmldom from 0.8.11 to 0.8.12. This library is used exclusively in app/util/favicon/index.ts for parsing HTML to extract favicon URLs from dApp websites. The favicon utility is used in the browser/dApp connection context to display site icons.

This is a very narrow, low-risk change:

  1. It's a patch-level dependency update (0.8.11 → 0.8.12), likely a bug fix or security patch
  2. Only affects favicon display in the browser/dApp context
  3. No core wallet functionality, controllers, transactions, or critical paths are affected
  4. The DOMParser usage in favicon/index.ts is straightforward and unlikely to be broken by a patch update

Since the change touches browser/dApp functionality (favicon parsing when connecting to dApps), SmokeNetworkExpansion covers dApp connection flows which would exercise the favicon utility. However, given the extremely narrow scope of this change (just favicon display), even this may be conservative. No performance tests are needed as this is a utility library patch with no performance implications.

Performance Test Selection:
The @xmldom/xmldom patch update only affects favicon HTML parsing, which is a lightweight utility operation with no meaningful performance impact. No performance tests are warranted.

View GitHub Actions results

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​xmldom/​xmldom@​0.8.11 ⏵ 0.8.1299100 +16100 +188 +38100

View full report

@chloeYue chloeYue added team-mobile-delivery and removed team-qa QA team labels Apr 7, 2026
@sonarqubecloud

sonarqubecloud Bot commented Apr 7, 2026

Copy link
Copy Markdown

@metamaskbot metamaskbot added the INVALID-PR-TEMPLATE PR's body doesn't match template label Apr 7, 2026
@github-actions

github-actions Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

E2E Fixture Validation — Schema is up to date
17 value mismatches detected (expected — fixture represents an existing user).
View details

@chloeYue chloeYue merged commit 5ad0a71 into release/7.72.0 Apr 7, 2026
105 of 114 checks passed
@chloeYue chloeYue deleted the chore/cherry-pick-28424-xmldom branch April 7, 2026 12:55
@github-actions github-actions Bot locked and limited conversation to collaborators Apr 7, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

INVALID-PR-TEMPLATE PR's body doesn't match template risk-low Low testing needed · Low bug introduction risk size-XS team-mobile-delivery

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants