Skip to content

chore: bump axios 16.1#30815

Merged
tommasini merged 2 commits into
mainfrom
chore/bump-axios-16-1
May 29, 2026
Merged

chore: bump axios 16.1#30815
tommasini merged 2 commits into
mainfrom
chore/bump-axios-16-1

Conversation

@tommasini

@tommasini tommasini commented May 29, 2026

Copy link
Copy Markdown
Contributor

Description

Fix audit issue: GHSA-35jp-ww65-95wh

Changelog

CHANGELOG entry:

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Performance checks (if applicable)

  • I've tested on Android
    • Ideally on a mid-range device; emulator is acceptable
  • I've tested with a power user scenario
    • Use these power-user SRPs to import wallets with many accounts and tokens
  • I've instrumented key operations with Sentry traces for production performance metrics

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Low Risk
Dependency-only security patch with no app code changes; standard patch-level HTTP client upgrade.

Overview
Bumps axios from ^1.15.x to ^1.16.0 in package.json (direct dependency and Yarn resolutions) and refreshes yarn.lock so the tree resolves to axios 1.16.1, addressing advisory GHSA-35jp-ww65-95wh.

The lockfile also picks up follow-redirects 1.16.0 and axios’s updated transitive deps (e.g. https-proxy-agent). No application source changes.

Reviewed by Cursor Bugbot for commit e4f36bb. Bugbot is set up for automated code reviews on this repo. Configure here.

@tommasini tommasini added the no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed label May 29, 2026
@github-actions

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbotv2 metamaskbotv2 Bot added the team-mobile-platform Mobile Platform team label May 29, 2026
weitingsun
weitingsun previously approved these changes May 29, 2026
@github-actions github-actions Bot added size-XS risk:medium AI analysis: medium risk labels May 29, 2026
@tommasini tommasini enabled auto-merge May 29, 2026 17:18
joaoloureirop
joaoloureirop previously approved these changes May 29, 2026
@infiniteflower infiniteflower mentioned this pull request May 29, 2026
10 tasks
@tommasini tommasini dismissed stale reviews from joaoloureirop and weitingsun via e4f36bb May 29, 2026 19:09
@github-actions

Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeMoney, SmokeNetworkAbstractions
  • Selected Performance tags: None (no tests recommended)
  • Risk Level: low
  • AI Confidence: 82%
click to see 🤖 AI reasoning details

E2E Test Selection:
The PR contains only two changed files: package.json and yarn.lock, both reflecting a minor version bump of the axios HTTP client library from 1.15.x to 1.16.x (specifically 1.15.2 → 1.16.1). The transitive dependency follow-redirects was also bumped from 1.15.11 → 1.16.0, and a new https-proxy-agent dependency was added internally to axios 1.16.x.

No application code was changed — this is purely a dependency update.

Axios is used in the following areas of the app:

  1. Card controller (app/core/Engine/controllers/card-controller/services/BaanxService.ts) — used for Card API calls → SmokeMoney
  2. Ramp/Deposit hooks (app/components/UI/Ramp/Deposit/hooks/) — used for deposit routing and user flows → SmokeMoney
  3. Network checker (app/core/RPCMethods/networkChecker.util.ts) — used for RPC network validation → SmokeNetworkAbstractions
  4. Test utilities (app/util/test/, tests/framework/, tests/performance/) — test infrastructure only, not production flows

Since this is a minor version bump (semver-compatible), the risk of behavioral regression is low. However, to validate that the HTTP client still works correctly in the most affected user-facing flows (Card/Ramp and network checking), SmokeMoney and SmokeNetworkAbstractions are selected as targeted coverage. No performance tests are needed as this is a library version bump with no UI or rendering changes.

Performance Test Selection:
This is a minor version bump of the axios HTTP client library with no UI, rendering, state management, or initialization changes. There is no expected performance impact from this dependency update, so no performance tests are needed.

View GitHub Actions results

@tommasini tommasini added this pull request to the merge queue May 29, 2026
Merged via the queue into main with commit 3e5edf7 May 29, 2026
302 of 308 checks passed
@tommasini tommasini deleted the chore/bump-axios-16-1 branch May 29, 2026 20:22
@github-actions github-actions Bot locked and limited conversation to collaborators May 29, 2026
@metamaskbotv2 metamaskbotv2 Bot added the release-7.81.0 Issue or pull request that will be included in release 7.81.0 label May 29, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed release-7.81.0 Issue or pull request that will be included in release 7.81.0 risk:medium AI analysis: medium risk size-XS team-mobile-platform Mobile Platform team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants