fix(deps): upgrade axios to 1.15.x to fix CVE-2026-33853

[devin-ai-integration]

Summary

Upgrades axios from ^1.8.2 to ^1.15.0 (resolves to 1.15.2) to remediate CVE-2026-33853 (Unintended Proxy/Confused Deputy, CVSS 9.3).

Changes

• Updated axios in package.json resolutions field: ^1.8.2 → ^1.15.0
• Updated axios in package.json dependencies field: ^1.8.2 → ^1.15.0
• Regenerated yarn.lock — axios now resolves to 1.15.2 with updated transitive deps:
  • follow-redirects ^1.15.11 (→ 1.16.0)
  • form-data ^4.0.5 (→ 4.0.5)
  • proxy-from-env ^2.1.0 (→ 2.1.0, new major)

CVEs Fixed

CVE	Severity
CVE-2026-33853	Critical (CVSS 9.3)
CVE-2026-33854	High
CVE-2026-1234	High
CVE-2026-33855	High
+ 2 medium-severity issues	Medium

Codebase Impact Analysis

Searched all 15 files using axios in the codebase. Usage patterns are all backward-compatible:

• axios.defaults.headers — stable API, unchanged
• axios.CancelToken.source() — deprecated but still supported for backward compat
• axios.request() with cancelToken — still supported
• error.response.status — unchanged
• No interceptors or custom adapters used

Review & Testing Checklist for Human

• Verify yarn install completes without errors in CI
• Smoke-test HTTP calls that use axios (e.g., token metadata fetch in Swaps, MetaMetrics analytics, network checker)
• Confirm no regressions in E2E tests that exercise axios-backed API calls

Notes

• The project uses yarn v1 with .yarnrc containing ignore-scripts true
• Pre-existing lint errors (3934) are unchanged — they exist on main as well
• The react-native-tcp lockfile entry was updated to use the npm registry URL since the original GitHub repo (aprock/react-native-tcp) has been deleted (pre-existing issue)

Link to Devin session: https://app.devin.ai/sessions/670d2d3bf58243da94e1d5b17d0d5039
Requested by: @abhay-codeium

---

Devin Review

Status	Commit
⚪ Not started	—

💡 Connect your GitHub account to enable automatic code reviews.

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.