chore(deps): update dependency nock to v15 by metamask-ci[bot] · Pull Request #11055 · MetaMask/core

use of a fetch() recording that uses gzip compression is missing the headers, Possible EventEmitter memory leak when used together with MongoDBContainer (#2869) (90b2a04)

`v14.0.4`

Compare Source

Bug Fixes

ClientRequest: support get with body (#2854) (26fb025)

`v14.0.3`

Compare Source

Bug Fixes

fetch: cloned response return correct url (#2852) (8348274)

`v14.0.2`

Compare Source

Bug Fixes

back: request body unusable in update mode (#2851) (eff7318)

`v14.0.1`

Compare Source

Bug Fixes

recorder: response body accessed multiple times in parallel requests (#2840) (ac7a1b2)

`v14.0.0`

Compare Source

BREAKING CHANGES

drop support for Node < 18

Features

support for native fetch (#2813) (ef3f158)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

Note

Low Risk
Changes are limited to devDependencies and test setup; production packages are unaffected aside from lockfile churn.

Overview
Upgrades nock from ^13.5.6 to ^15.0.5 across the root and all packages that mock HTTP in tests. Nock 15 intercepts native fetch (via @mswjs/interceptors), so the monorepo drops the root node-fetch devDependency and deletes tests/vitest/setup.ts, which previously patched globalThis.fetch for nock. Package Vitest config now only loads setup-after-env.ts.

A few tests and fixtures were adjusted for nock 15 behavior and typings: network failures may surface as fetch failed instead of the mocked error string; network-controller test helpers use a type cast so filteringRequestBody with a callback still type-checks; minor mock/type tweaks in assets and profile-sync fixtures. tsc-suppressions.json drops obsolete nock-related suppressions where types now align.

^{Reviewed by Cursor Bugbot for commit 115ee64. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-10-25T12:36:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nock@13.5.6 ⏵ 15.0.5	⁺¹

View full report

socket-security · 2026-10-25T12:36:55Z

Warning

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Priority	Alert (click "▶" to expand/collapse)	Action
	Potential code anomaly (AI signal): npm `@mswjs/interceptors` is 62.0% likely to have a medium risk anomaly Notes: This module is primarily an IPC-based remote HTTP interception/mocking mechanism rather than overt malware. The main security concerns are (a) sensitive data exposure due to serialization and verbose logging of headers/credentials/body, and (b) a powerful trust boundary where child-controlled IPC inputs (revived URL/headers/credentials/body) can drive handleRequest and outbound network behavior. While there is no explicit malicious payload execution in the shown code, it should be reviewed for IPC trustworthiness, message validation/integrity, destination allowlisting, and log redaction. Confidence: 0.62 Severity: 0.58 From: package.json → `npm/nock@15.0.5` → `npm/@mswjs/interceptors@0.44.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@mswjs/interceptors@0.44.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm `@mswjs/interceptors` reads DEBUG_LEVEL Env Vars: DEBUG_LEVEL Location: Package overview From: package.json → `npm/nock@15.0.5` → `npm/@mswjs/interceptors@0.44.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@mswjs/interceptors@0.44.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

cryptodev-2s · 2026-10-28T15:01:35Z

  headers: Record<string, string>,
 ): nock.Scope {
-  return nock(rpcUrl, { reqheaders: headers }).filteringRequestBody((body) => {
+  // The types for nock 15 only declare the form of `filteringRequestBody` that


nock 15's types only declare filteringRequestBody() with no arguments, but it still accepts a function at runtime, and that form is documented in the README under "Request Body filtering": https://github.com/nock/nock#request-body-filtering
The cast just lets us keep passing the function (it logs each request body through debug), since the typings don't expose that overload anymore.

I see that the source makes use of arguments as any to accept the function :( https://github.com/nock/nock/blob/415fc645e663aa79d3f9aaa8abbb82f4229ee524/lib/scope.ts#L310. So that must be why. Seems like an acceptable fix to me.

ccharly

LGTM for accounts

…etch

… the baseline

…ck 15 is the baseline" This reverts commit 7108d47.

mcmire

LGTM!

mcmire · 2026-10-28T18:57:46Z

  headers: Record<string, string>,
 ): nock.Scope {
-  return nock(rpcUrl, { reqheaders: headers }).filteringRequestBody((body) => {
+  // The types for nock 15 only declare the form of `filteringRequestBody` that


I see that the source makes use of arguments as any to accept the function :( https://github.com/nock/nock/blob/415fc645e663aa79d3f9aaa8abbb82f4229ee524/lib/scope.ts#L310. So that must be why. Seems like an acceptable fix to me.

… idiom Main migrated nock to v15 and made the nock-based tests independent of node-fetch (#11077, #11055) by replacing reply-callback request-body assertions with `nock.RequestBodyMatcher` arguments plus `.isDone()` checks. Convert `handleMockSetUserAssets` and its seven call sites to the same idiom — the old callback form hangs under nock v15 with native fetch.

…d transaction controllers (MetaMask#11132) ## Explanation Prepares network-controller, assets-controllers and transaction-controller for the nock 15 upgrade (MetaMask#11055) and removal of the node-fetch shim, so their tests pass on both setups. They share the nock helper in network-controller tests, so this fixes it once, along with timers and fetch error messages in the specs. ## References Related to MetaMask#11055 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  --- > [!NOTE] > **Low Risk** > Changes are limited to tests and lint suppressions; production code is untouched. > > **Overview** > **Test-only** updates so Nock-based specs stay valid when moving from **node-fetch** to **native `fetch`** and **Nock 15** (related to MetaMask#11055). No production/runtime behavior changes. > > **Network-controller** adds shared helpers: `getNockRequestBody` for Nock reply callbacks that may receive `(uri, body)` or a Fetch `Request`, and `buildFetchErrorPattern` so assertions accept either the original error text or native `fetch`’s generic **"fetch failed"**. RPC retry/circuit tests switch Vitest fake timers to leave `nextTick` / `queueMicrotask` / `setImmediate` real, drive retries with `runOnlyPendingTimersAsync`, and relax a few expectations (Nock mismatch messages, JSON parse errors, request URL from Nock events). `RpcService` tests unwrap `TypeError` causes so Nock errors stay non-retriable like with node-fetch. > > **assets-controllers** and **transaction-controller** mirror the same patterns: regex/`stringMatching` on network errors, timeout tests that hang instead of using long Nock delays, and integration tests that advance timers until promises settle (`advanceUntilSettled`) plus `nock.cleanAll` in teardown. **oxlint-suppressions** drops two entries for `rpc-service.test.ts` after the test fixes. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4a43379. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

…k#11171) ## Explanation On nock 15 only the native fetch error message `fetch failed` occurs, so the either or patterns left from the nock 13 era are dead. This narrows those assertions to the one message that really occurs, keeping `Failed to fetch` where `CodefiTokenPricesServiceV2` throws it itself. ## References Stacked on MetaMask#11055, related to MetaMask#11172 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

MetaMask#11172) ## Explanation Some nock test helpers still handle the nock 13 reply arguments (`(uri, body)`) and error messages, which cannot occur on nock 15. This reduces them to the one nock 15 path (a `Request`), removing `getRequestUrl`, `NockRequestInfo` and `buildFetchErrorPattern`. ## References Stacked on MetaMask#11171 and MetaMask#11055 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  --- > [!NOTE] > **Low Risk** > Test-only refactors with no production code changes; risk is limited to test suite compatibility with nock 15. > > **Overview** > Test helpers and fixtures are updated to assume **nock 15**, which always passes a Fetch **`Request`** into `.reply()` callbacks and related hooks. > > Shared utilities **`getRequestUrl`**, **`NockRequestInfo`**, and **`buildFetchErrorPattern`** are removed. Interceptors in **assets-controller**, **profile-sync-controller**, and **network-controller** now read query params and bodies via **`request.url`** / **`request.clone()`** instead of branching on URI strings or `(uri, body)` tuples. > > Network-client integration tests stop matching **node-fetch**-style error text and assert the generic **`fetch failed`** message instead, aligned with native **`fetch`** under the current nock stack. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 592521e. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

…dent of Node.js timing (MetaMask#11186) ## Explanation Since the nock 15 upgrade (MetaMask#11055), `main` fails the concurrent `onDegraded` test in `network-controller` on Node 22 and 24, because both responses are handled in the same turn of the event loop and the shared RPC method name is overwritten. PR checks only run Node 26, which is why it passed there. The test now holds the second response until the first `onDegraded` has fired, which matches how the service attributes the method name and no longer depends on the Node.js version. ## References Related to MetaMask#11055 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  --- > [!NOTE] > **Low Risk** > Test-only change in `rpc-service.test.ts`; no runtime or RPC service logic modified. > > **Overview** > Fixes a flaky **`RpcService`** test that asserts two concurrent slow RPC calls each fire **`onDegraded`** with the correct **`rpcMethodName`**. > > After the nock 15 upgrade, Node 22/24 could deliver both mocked responses in one event-loop turn, so the service’s shared **`#currentRpcMethodName`** was overwritten before the first callback ran and expectations failed. The test now **gates the second nock reply** on a promise resolved from the **`onDegraded`** mock (first callback unblocks **`eth_gasPrice`**), forcing ordering without relying on Node-specific timing. **Production behavior is unchanged**—test-only. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e954258. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

metamask-ci Bot requested review from a team as code owners October 25, 2026 12:36

metamask-ci Bot temporarily deployed to default-branch October 25, 2026 12:36 Inactive

metamask-ci Bot temporarily deployed to dependabot October 25, 2026 12:36 Inactive

cryptodev-2s enabled stacked auto-merge October 28, 2026 14:53

cryptodev-2s reviewed Oct 28, 2026

View reviewed changes

cryptodev-2s force-pushed the renovate/major-nock-nock branch from 62534f7 to 56f0bd6 Compare October 28, 2026 15:14

cryptodev-2s temporarily deployed to dependabot October 28, 2026 15:14 — with GitHub Actions Inactive

ccharly approved these changes Oct 28, 2026

View reviewed changes

salimtb approved these changes Oct 28, 2026

View reviewed changes

MoMannn approved these changes Oct 28, 2026

View reviewed changes

cryptodev-2s force-pushed the renovate/major-nock-nock branch from 56f0bd6 to f7c6252 Compare October 28, 2026 17:53

metamask-ci Bot temporarily deployed to dependabot October 28, 2026 17:53 Inactive

metamask-ci Bot and others added 8 commits October 28, 2026 19:54

chore(deps): update dependency nock to v15

7959f2e

test: fix the remaining nock 15 type and error message mismatches

1da3a77

test: remove the node-fetch shim now that nock 15 intercepts native f…

47c785d

…etch

test: update the tsc suppressions for nock 15

8f9c38a

test(assets-controller): drop the redundant reply type assertion

bbe39b7

test: assert only the native fetch error messages now that nock 15 is…

f6b12e4

… the baseline

Revert "test: assert only the native fetch error messages now that no…

c5928f6

…ck 15 is the baseline" This reverts commit 7108d47.

test(chomp-api-service): expect the native fetch error message

115ee64

cryptodev-2s force-pushed the renovate/major-nock-nock branch from f7c6252 to 115ee64 Compare October 28, 2026 18:54

metamask-ci Bot temporarily deployed to dependabot October 28, 2026 18:55 Inactive

mcmire approved these changes Oct 28, 2026

View reviewed changes

cryptodev-2s added this pull request to the merge queue Oct 28, 2026

Merged via the queue into main with commit 81453eb Oct 28, 2026
269 of 277 checks passed

cryptodev-2s deleted the renovate/major-nock-nock branch October 28, 2026 19:02

cryptodev-2s mentioned this pull request Oct 29, 2026

test(network-controller): make the concurrent onDegraded test independent of Node.js timing #11186

Merged

1 of 4 tasks

Navigation Menu

Repository navigation

chore(deps): update dependency nock to v15 - #11055

chore(deps): update dependency nock to v15#11055
cryptodev-2s merged 8 commits into
mainfrom
renovate/major-nock-nock

metamask-ci Bot commented Oct 25, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

cryptodev-2s Oct 28, 2026

Uh oh!

mcmire Oct 28, 2026

Uh oh!

ccharly left a comment

Uh oh!

mcmire left a comment

Uh oh!

mcmire Oct 28, 2026

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

metamask-ci Bot commented Oct 25, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

Features

Configuration

Uh oh!

socket-security Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ccharly left a comment

Choose a reason for hiding this comment

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

metamask-ci Bot commented Oct 25, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Oct 25, 2026 •

edited

Loading

socket-security Bot commented Oct 25, 2026 •

edited

Loading