Skip to content

chore(runway): cherry-pick f6dcbae#28459

Merged
chloeYue merged 1 commit into
release/7.73.0from
runway-cherry-pick-7.73.0-1775563918
Apr 7, 2026
Merged

chore(runway): cherry-pick f6dcbae#28459
chloeYue merged 1 commit into
release/7.73.0from
runway-cherry-pick-7.73.0-1775563918

Conversation

@runway-github

@runway-github runway-github Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

Description

Bumps @xmldom/xmldom from ^0.8.10 to ^0.8.12 to address the
failing production dependency audit (GHSA-wh4c-j3r5-mjhp).

Changelog

CHANGELOG entry: null

Related issues

Fixes:

Manual testing steps

Feature: Production dependency audit compliance

  Scenario: audit CI passes after xmldom patch update
    Given the repository is on branch chore/fix-audit-xmldom
    When I run yarn audit:ci
    Then no audit suggestions are reported

Screenshots/Recordings

Before

N/A (dependency-only change)

After

N/A (dependency-only change)

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the
    app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described
    in the ticket it closes and includes the necessary testing evidence such
    as recordings and or screenshots.

Note

Low Risk
Low risk dependency-only update; main risk is unexpected behavior
changes in XML parsing due to the transitive library patch bump.

Overview
Updates the production dependency @xmldom/xmldom from
^0.8.10/0.8.11 to ^0.8.12 and refreshes yarn.lock to lock the
new resolved version/checksum, addressing the flagged security advisory.

Reviewed by Cursor Bugbot for commit
776772f. Bugbot is set up for automated
code reviews on this repo. Configure
here.

[f6dcbae](https://github.com/MetaMask/metamask-mobile/commit/f6dcbae040f3e774c389aa131c4b525534c684a9)

…#28424)

## **Description**

Bumps `@xmldom/xmldom` from `^0.8.10` to `^0.8.12` to address the
failing production dependency audit (`GHSA-wh4c-j3r5-mjhp`).

## **Changelog**

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

```gherkin
Feature: Production dependency audit compliance

  Scenario: audit CI passes after xmldom patch update
    Given the repository is on branch chore/fix-audit-xmldom
    When I run yarn audit:ci
    Then no audit suggestions are reported
```

## **Screenshots/Recordings**

### **Before**

N/A (dependency-only change)

### **After**

N/A (dependency-only change)

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk dependency-only update; main risk is unexpected behavior
changes in XML parsing due to the transitive library patch bump.
> 
> **Overview**
> Updates the production dependency `@xmldom/xmldom` from
`^0.8.10`/`0.8.11` to `^0.8.12` and refreshes `yarn.lock` to lock the
new resolved version/checksum, addressing the flagged security advisory.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
776772f. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@github-actions

github-actions Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the team-bots Bot team (for MetaMask Bot, Runway Bot, etc.) label Apr 7, 2026

@chloeYue chloeYue left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​xmldom/​xmldom@​0.8.11 ⏵ 0.8.1299100 +16100 +188 +38100

View full report

@github-actions github-actions Bot added the risk-low Low testing needed · Low bug introduction risk label Apr 7, 2026
@github-actions

github-actions Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeWalletPlatform
  • Selected Performance tags: None (no tests recommended)
  • Risk Level: low
  • AI Confidence: 82%
click to see 🤖 AI reasoning details

E2E Test Selection:
The only change is a patch version bump of @xmldom/xmldom from ^0.8.10 (resolved: 0.8.11) to ^0.8.12 (resolved: 0.8.12). This library is used exclusively in app/util/favicon/index.ts for parsing HTML to extract favicon URLs from dApp websites in the browser. The favicon utility is part of the browser/dApp connection experience. Since this is a patch-level dependency update with very limited scope (one utility file, favicon fetching only), the risk is low. SmokeWalletPlatform is selected as it covers browser navigation and dApp interactions where favicons are displayed. No other test areas are directly impacted by this change. No performance tests are needed as this is a minor utility library patch with no performance-sensitive code paths.

Performance Test Selection:
The @xmldom/xmldom patch version bump only affects favicon HTML parsing, which is not a performance-sensitive operation and does not impact any measured performance flows (account list, onboarding, login, swaps, launch, asset loading, predict, or perps).

View GitHub Actions results

@sonarqubecloud

sonarqubecloud Bot commented Apr 7, 2026

Copy link
Copy Markdown

@github-actions

github-actions Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

E2E Fixture Validation — Schema is up to date
17 value mismatches detected (expected — fixture represents an existing user).
View details

@chloeYue chloeYue merged commit 3b5e9b9 into release/7.73.0 Apr 7, 2026
277 of 281 checks passed
@chloeYue chloeYue deleted the runway-cherry-pick-7.73.0-1775563918 branch April 7, 2026 14:30
@github-actions github-actions Bot locked and limited conversation to collaborators Apr 7, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

risk-low Low testing needed · Low bug introduction risk size-XS team-bots Bot team (for MetaMask Bot, Runway Bot, etc.)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants