chore(deps): update dependency nock to v14

[metamask-ci]

This PR contains the following updates:

Package	Change	Age	Confidence
nock	^13.5.6 → ^14.0.17

---

Release Notes

nock/nock (nock)

v14.0.17

Compare Source

Bug Fixes

• remove interceptor from scope.interceptors on nock.removeInterceptor (#​2997) (1ee467c)

v14.0.16

Compare Source

Bug Fixes

• guard against AbortSignal-aborted requests in response handler (#​2977) (2d68e8a), closes #​2949

v14.0.15

Compare Source

Bug Fixes

• Revert "fix(backport): apply body delay before the response end" (#​2973) (de5450c), closes #​2969

v14.0.14

Compare Source

Bug Fixes

• backport: apply body delay before the response end (#​2969) (215cd2a)

v14.0.13

Compare Source

Bug Fixes

• types: align Definition with runtime; add rawHeaders, drop headers (#​2955) (07fbfab)

v14.0.12

Compare Source

Bug Fixes

• prevent crash when query params have conflicting dot-notation keys (#​2958) (7ea9933)

v14.0.11

Compare Source

Bug Fixes

• migrate to npm OIDC (#​2940) (113dcac)
• restore github actions write permissions (#​2941) (a4cb6b8)
• update @mswjs/interceptors to fix a memory leak (#​2938) (025db76)
• upgrade semantic-release (#​2943) (db0b280)

v14.0.10

Compare Source

Bug Fixes

• Use Error objects instead of plain objects with replyWithError() (#​2900) (f2a3389)

v14.0.9

Compare Source

Bug Fixes

• address timeout issue with mocked timers (Revert #​2880) (#​2902) (bc48f92)

v14.0.8

Compare Source

Bug Fixes

• ClientRequest: support http.Agent instances as agents for https requests (#​2896) (e4390b8)

v14.0.7

Compare Source

Bug Fixes

• address timeout issue with mocked timers (#​2880) (fb112f3)

v14.0.6

Compare Source

Bug Fixes

• upgrade interceptors (2bcaf0f)

v14.0.5

Compare Source

Bug Fixes

• use of a fetch() recording that uses gzip compression is missing the headers, Possible EventEmitter memory leak when used together with MongoDBContainer (#​2869) (90b2a04)

v14.0.4

Compare Source

Bug Fixes

• ClientRequest: support get with body (#​2854) (26fb025)

v14.0.3

Compare Source

Bug Fixes

• fetch: cloned response return correct url (#​2852) (8348274)

v14.0.2

Compare Source

Bug Fixes

• back: request body unusable in update mode (#​2851) (eff7318)

v14.0.1

Compare Source

Bug Fixes

• recorder: response body accessed multiple times in parallel requests (#​2840) (ac7a1b2)

v14.0.0

Compare Source

BREAKING CHANGES

• drop support for Node < 18

Features

• support for native fetch (#​2813) (ef3f158)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nock@​13.5.6 ⏵ 14.0.17	-12			+3

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm @mswjs/interceptors is 60.0% likely to have a medium risk anomaly Notes: No explicit malware or clear exfiltration mechanism is visible in the provided fragment. However, the code performs high-impact global instrumentation by patching XMLHttpRequest, routes request/response handling through an interceptor layer, and broadly exposes intercepted response data via events/callbacks and verbose logging (including full headers and response text/JSON/XML-derived content). In realistic deployments, this creates a meaningful confidentiality and security-logic risk if used outside a tightly controlled testing environment or if logs/listeners are accessible to untrusted parties. Confidence: 0.60 Severity: 0.60 From: package.json → npm/nock@14.0.17 → npm/@mswjs/interceptors@0.41.9 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mswjs/interceptors@0.41.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @mswjs/interceptors is 62.0% likely to have a medium risk anomaly Notes: No strong evidence of intentional malware in the provided fragment. However, it is a high-impact HTTP/HTTPS interception layer that can optionally forward real traffic (passthrough) and explicitly transforms URL credentials into Authorization: Basic headers. Combined with extensive logging of request options/auth-derived values and global monkey-patching of Node’s networking APIs, the security/privacy risk is meaningful—especially in environments where requests may contain secrets or logs are accessible. Confidence: 0.62 Severity: 0.61 From: package.json → npm/nock@14.0.17 → npm/@mswjs/interceptors@0.41.9 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mswjs/interceptors@0.41.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @open-draft/logger Location: Package overview From: package.json → npm/nock@14.0.17 → npm/@open-draft/logger@0.3.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@open-draft/logger@0.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bcc3e55. Configure here.}

[cursor]

Nock v14 breaks jsdom tests

Medium Severity

nock v14 loads @mswjs/interceptors, which requires TextEncoder. That global is missing in jsdom (Jest 30 / jsdom 26). nock is imported for every suite via tests/setupAfterEnv/nock.ts, so packages that use testEnvironment: 'jsdom' without a custom polyfill (network-controller, selected-network-controller, core-backend) can fail at setup with ReferenceError: TextEncoder is not defined.

Additional Locations (2)

• packages/network-controller/package.json#L90-L91
• packages/selected-network-controller/package.json#L69-L70

 

^{Reviewed by Cursor Bugbot for commit bcc3e55. Configure here.}