Skip to content

chore(ci): bump xmldom & ignore uuid advisory to address ci audit failure#29222

Merged
joaoloureirop merged 3 commits into
mainfrom
fix/ci-audit-xmldom
Apr 22, 2026
Merged

chore(ci): bump xmldom & ignore uuid advisory to address ci audit failure#29222
joaoloureirop merged 3 commits into
mainfrom
fix/ci-audit-xmldom

Conversation

@joaoloureirop

@joaoloureirop joaoloureirop commented Apr 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description

uuid version update in progress https://consensyssoftware.atlassian.net/browse/MCWP-557

Changelog

CHANGELOG entry: null

Related issues

Fixes: https://consensyssoftware.atlassian.net/browse/MCWP-556

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Performance checks (if applicable)

  • I've tested on Android
    • Ideally on a mid-range device; emulator is acceptable
  • I've tested with a power user scenario
    • Use these power-user SRPs to import wallets with many accounts and tokens
  • I've instrumented key operations with Sentry traces for production performance metrics

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@github-actions

github-actions Bot commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbotv2 metamaskbotv2 Bot added the team-mobile-platform Mobile Platform team label Apr 22, 2026
@github-actions github-actions Bot added size-XS risk:high AI analysis: high risk labels Apr 22, 2026
@socket-security

socket-security Bot commented Apr 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​xmldom/​xmldom@​0.8.12 ⏵ 0.8.1399100 +40100 +192 +4100

View full report

@joaoloureirop joaoloureirop changed the title chore(ci): bump xmldom to address ci audit failure chore(ci): bump xmldom & ignore uuid advisory to address ci audit failure Apr 22, 2026
Cal-L
Cal-L previously approved these changes Apr 22, 2026
View reviewed changes

@Cal-L Cal-L left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@joaoloureirop joaoloureirop requested a review from Cal-L April 22, 2026 23:06
@github-actions

github-actions Bot commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

AI PR Analysis

🚫 Merge safe: false | 🟠 Risk: high

Merge decision: AI analysis did not complete — manual review required before merging.

AI analysis did not complete. Manual review recommended.

View run

@github-actions

github-actions Bot commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeBrowser
  • Selected Performance tags: None (no tests recommended)
  • Risk Level: low
  • AI Confidence: 88%
click to see 🤖 AI reasoning details

E2E Test Selection:
The changes are minimal and low-risk:

  1. @xmldom/xmldom patch bump (^0.8.12 → ^0.8.13): This library is used exclusively in app/util/favicon/index.ts for HTML DOM parsing to extract favicon URLs from web pages. The only affected functionality is favicon loading in the in-app browser. A minor patch update is unlikely to introduce regressions, but SmokeBrowser is selected as a precautionary measure to validate favicon parsing still works correctly in browser navigation flows.

  2. .yarnrc.yml audit suppression: Adding advisory 1116970 (uuid buffer bounds check for v3/v5/v6) as an ignored advisory. The app uses uuid v4 and v1 which are unaffected. This is a pure CI/audit configuration change with zero runtime impact.

  3. yarn.lock: Lock file update corresponding to the xmldom version bump.

No core controllers, Engine, navigation, confirmations, accounts, or other critical paths are affected. The impact is isolated to the browser favicon utility, making SmokeBrowser the only relevant test tag.

Performance Test Selection:
The changes are limited to a minor patch update of @xmldom/xmldom (used only for favicon HTML parsing) and a security advisory suppression in .yarnrc.yml. Neither change affects UI rendering performance, data loading, state management, account/network components, critical user flows, or app startup. No performance tests are warranted.

View GitHub Actions results

@sonarqubecloud

sonarqubecloud Bot commented Apr 22, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@github-actions

github-actions Bot commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

✅ E2E Fixture Validation — Schema is up to date
12 value mismatches detected (expected — fixture represents an existing user).
View details

@joaoloureirop joaoloureirop enabled auto-merge April 22, 2026 23:35
Cal-L
Cal-L approved these changes Apr 22, 2026
View reviewed changes

@Cal-L Cal-L left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@joaoloureirop joaoloureirop added this pull request to the merge queue Apr 22, 2026
Merged via the queue into main with commit dbdf5b0 Apr 22, 2026
114 of 115 checks passed
@joaoloureirop joaoloureirop deleted the fix/ci-audit-xmldom branch April 22, 2026 23:36
@github-actions github-actions Bot locked and limited conversation to collaborators Apr 22, 2026
@metamaskbotv2 metamaskbotv2 Bot added the release-7.75.0 Issue or pull request that will be included in release 7.75.0 label Apr 22, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@Cal-L Cal-L Cal-L approved these changes

Assignees

No one assigned

Labels

release-7.75.0 Issue or pull request that will be included in release 7.75.0 risk:high AI analysis: high risk size-XS team-mobile-platform Mobile Platform team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@joaoloureirop @Cal-L