Description

CI is failing on yarn audit:ci due to a critical severity advisory (GHSA-3p68-rc4w-qgx5) in axios < 1.15.0. The vulnerability allows an attacker to bypass NO_PROXY hostname normalization, leading to SSRF.

This PR bumps axios from 1.13.5 to 1.15.0 across dependencies, resolutions, and the CI scripts package. Because 1.15.0 was published less than 3 days ago, it is also temporarily added to npmPreapprovedPackages in .yarnrc.yml to bypass the npmMinimalAgeGate. This preapproval entry should be removed after 2025-04-12.

Changelog

CHANGELOG entry: null

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.