fix(deps): update dependency @oclif/core to v5

[metamask-ci]

This PR contains the following updates:

Package	Change	Age	Confidence
@oclif/core	^4.10.5 → ^5.1.8

---

Release Notes

oclif/core (@​oclif/core)

v5.1.8

Compare Source

Bug Fixes

• use the error's oclif exit code when --json is enabled (bf35f78)

v5.1.7

Compare Source

Bug Fixes

• deps: bump @​humanfs/node from 0.16.6 to 0.16.8 (d4abfc2)

v5.1.6

Compare Source

Bug Fixes

• deps: bump undici from 6.28.0 to 6.29.0 (506e039)

v5.1.5

Compare Source

Bug Fixes

• deps: bump postcss-selector-parser from 7.1.5 to 7.1.6 (1321fb6)

v5.1.4

Compare Source

Bug Fixes

• deps: bump source-map-js from 1.2.1 to 1.2.2 (df72fa4)

v5.1.3

Compare Source

Bug Fixes

• deps: bump ip-address from 10.5.0 to 10.7.2 (9c89025)

v5.1.2

Compare Source

Bug Fixes

• deps: bump browserslist from 4.28.2 to 4.28.9 (1ba8dfd)

v5.1.1

Compare Source

Bug Fixes

• feedback from code review (W-24099831) (b36c51b)
• resolved autofixable eslint violations (W-24099831) (b9eabd3)
• resolved busted interoperability tests (W-24099831) (b6866f0)
• resolved circular eslint fixes (W-24099831) (d0935c1)

v5.1.0

Compare Source

Bug Fixes

• rename boolean var to satisfy unicorn/consistent-boolean-name (a1316cc)

Features

• support OCLIF_STDIN_TIMEOUT_MS env var for stdin read timeout @​W-24151668@ (effcb65)
• support OCLIF_STDIN_TIMEOUT_MS env var for stdin read timeout @​W-24151668@ (a869149)

5.0.1 (2026-09-23)

Bug Fixes

• getting CI/CD green again (W-24099831) (3c01350)

v5.0.1

Compare Source

Bug Fixes

• getting CI/CD green again (W-24099831) (3c01350)

v5.0.0

Compare Source

• feat!: require Node >=22 (940ad2d)
• feat!: upgrade core to V5 (01d00b9)

BREAKING CHANGES

• drop EOL Node versions
• require Node >=22, drop EOL Node versions

v4.14.0

Compare Source

Features

• bumping to eslint v10 (W-23473845) (248de04)

4.13.5 (2026-08-14)

Bug Fixes

• replaced require with dynamic import (W-23807278) (d35e325)

4.13.4 (2026-08-14)

Bug Fixes

• resolved security vulnerability in powershell path (W-23807278) (911e9d2)

4.13.3 (2026-08-04)

Bug Fixes

• deps: bump ip-address from 10.2.0 to 10.4.0 (e13240b)

4.13.2 (2026-07-27)

Bug Fixes

• deps: bump postcss from 8.5.10 to 8.5.23 (169b09a)

4.13.1 (2026-07-27)

Bug Fixes

• deps: bump tar from 7.5.16 to 7.5.22 (bc0d2d2)

v4.13.5

Compare Source

Bug Fixes

• replaced require with dynamic import (W-23807278) (d35e325)

v4.13.4

Compare Source

Bug Fixes

• resolved security vulnerability in powershell path (W-23807278) (911e9d2)

v4.13.3

Compare Source

Bug Fixes

• deps: bump ip-address from 10.2.0 to 10.4.0 (e13240b)

v4.13.2

Compare Source

Bug Fixes

• deps: bump postcss from 8.5.10 to 8.5.23 (169b09a)

v4.13.1

Compare Source

Bug Fixes

• deps: bump tar from 7.5.16 to 7.5.22 (bc0d2d2)

v4.13.0

Compare Source

Features

• expose root help formatter (644c4aa)

v4.12.0

Compare Source

Features

• add Args.option() for typed arg options (93139f7)

4.11.14 (2026-07-02)

Bug Fixes

• deps: bump @​sigstore/core from 3.2.0 to 3.2.1 (b45271f)

4.11.13 (2026-07-02)

Bug Fixes

• deps: bump sigstore from 4.1.0 to 4.1.1 (5d7fe54)

4.11.12 (2026-07-02)

Bug Fixes

• deps: bump @​sigstore/verify from 3.1.0 to 3.1.1 (e00068f)

4.11.11 (2026-06-23)

Bug Fixes

• deps: bump undici from 6.25.0 to 6.27.0 (319945a)

4.11.10 (2026-06-22)

Bug Fixes

• deps: bump tinyglobby from 0.2.16 to 0.2.17 (f941872)

4.11.9 (2026-06-21)

Bug Fixes

• deps: bump tar from 7.5.12 to 7.5.16 (153400e)

4.11.8 (2026-06-21)

Bug Fixes

• deps: bump @​babel/core from 7.23.0 to 7.29.7 (3e552ea)

4.11.7 (2026-06-17)

Bug Fixes

• include error message in --json output (2cb3a76), closes #​1608

4.11.6 (2026-06-15)

Bug Fixes

• causative errors are now also pretty-printed. @​W-22797799@ (e4dd03c)

4.11.5 (2026-06-15)

Bug Fixes

• refactored shell identification code (a33c256)
• test failure (a6ebe3e)
• typo in powershell command (e8b6efa)
• windows shell identification is more reliable @​W-22969497@ (ee8376d)

4.11.4 (2026-05-23)

Bug Fixes

• deps: bump semver from 7.8.0 to 7.8.1 (65e054c)

4.11.3 (2026-05-15)

Bug Fixes

• updating tinyglobby dependency [skip-validate-pr] (1dc29ff)

4.11.2 (2026-05-09)

Bug Fixes

• deps: bump semver from 7.7.4 to 7.8.0 (1471fe3)

4.11.1 (2026-05-07)

Bug Fixes

• deps: bump ip-address from 10.1.0 to 10.2.0 (e36a6d8)

v4.11.14

Compare Source

Bug Fixes

• deps: bump @​sigstore/core from 3.2.0 to 3.2.1 (b45271f)

v4.11.13

Compare Source

Bug Fixes

• deps: bump sigstore from 4.1.0 to 4.1.1 (5d7fe54)

v4.11.12

Compare Source

Bug Fixes

• deps: bump @​sigstore/verify from 3.1.0 to 3.1.1 (e00068f)

v4.11.11

Compare Source

Bug Fixes

• deps: bump undici from 6.25.0 to 6.27.0 (319945a)

v4.11.10

Compare Source

Bug Fixes

• deps: bump tinyglobby from 0.2.16 to 0.2.17 (f941872)

v4.11.9

Compare Source

Bug Fixes

• deps: bump tar from 7.5.12 to 7.5.16 (153400e)

v4.11.8

Compare Source

Bug Fixes

• deps: bump @​babel/core from 7.23.0 to 7.29.7 (3e552ea)

v4.11.7

Compare Source

Bug Fixes

• include error message in --json output (2cb3a76), closes #​1608

v4.11.6

Compare Source

Bug Fixes

• causative errors are now also pretty-printed. @​W-22797799@ (e4dd03c)

v4.11.5

Compare Source

Bug Fixes

• refactored shell identification code (a33c256)
• test failure (a6ebe3e)
• typo in powershell command (e8b6efa)
• windows shell identification is more reliable @​W-22969497@ (ee8376d)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

---

Note

Medium Risk
Major CLI framework upgrade with no code edits in the PR; risk is mainly runtime/CLI behavior on Windows/WSL and ensuring CI runs on Node 22+.

Overview
Bumps @oclif/core in @metamask/wallet-cli from ^4.10.5 to ^5.1.8, with the unreleased changelog entry and lockfile refresh. There are no application source changes; the mm CLI still uses the same oclif Command / Flags / execute entry points.

The lockfile shift pulls in oclif v5’s updated tree (e.g. ejs v6, wsl-utils v0.4 with powershell-utils, and a newer tinyglobby), and drops some v4-only transitive packages (async, jake, filelist, older minimatch/ejs chain). oclif v5 requires Node ≥22, which matches the package’s existing minimum Node bump.

^{Reviewed by Cursor Bugbot for commit 9e0675c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​oclif/​core@​4.11.4 ⏵ 5.1.8	-3			+1

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Priority	Alert  (click "▶" to expand/collapse)	Action
	System shell access: npm @oclif/core in module node:child_process Module: node:child_process Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Potential security risk (AI signal): npm powershell-utils is 70.0% likely risky Notes: This file does not contain explicit malware logic (no exfiltration/persistence in the snippet), but it implements a high-impact dual-use primitive: it base64-encodes caller-provided commands into PowerShell '-EncodedCommand' and executes them with '-ExecutionPolicy Bypass'. If upstream inputs are not tightly controlled, this can be used to run arbitrary PowerShell on the host and is therefore a significant supply-chain security concern at the module API level. Confidence: 0.70 Severity: 0.75 From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 → npm/powershell-utils@0.1.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/powershell-utils@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm powershell-utils in module node:child_process Module: node:child_process Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 → npm/powershell-utils@0.1.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/powershell-utils@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm wsl-utils in module node:child_process Module: node:child_process Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 → npm/wsl-utils@0.4.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/wsl-utils@0.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Network access: npm @oclif/core in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads LOCALAPPDATA Env Vars: LOCALAPPDATA Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads HOME Env Vars: HOME Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads HOMEDRIVE Env Vars: HOMEDRIVE Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads HOMEPATH Env Vars: HOMEPATH Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads USERPROFILE Env Vars: USERPROFILE Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads OCLIF_NEXT_VERSION Env Vars: OCLIF_NEXT_VERSION Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core Env Vars: OCLIF_DISABLE_LINKED_ESM_WARNING Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core Env Vars: OCLIF_DISABLE_ENGINE_WARNING Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads CLI_FLAGS_DEBUG Env Vars: CLI_FLAGS_DEBUG Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads OCLIF_STDIN_TIMEOUT_MS Env Vars: OCLIF_STDIN_TIMEOUT_MS Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads OCLIF_COLUMNS Env Vars: OCLIF_COLUMNS Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads SHELL Env Vars: SHELL Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads COMSPEC Env Vars: COMSPEC Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads OCLIF_DISABLE_RC Env Vars: OCLIF_DISABLE_RC Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads CI Env Vars: CI Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oclif/core reads TERM Env Vars: TERM Location: Package overview From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oclif/core@5.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm ejs is 66.0% likely to have a medium risk anomaly Notes: No explicit malicious payload (exfiltration, backdoor, persistence, command execution outside template compilation) is evident in this fragment. However, it has inherently high-risk capabilities: it compiles and executes attacker-influenced templates using new Function, and it can synchronously read additional templates from the filesystem based on resolved include paths/options. If an application supplies untrusted templates, locals that can affect control flow, or unvalidated include paths/views/root, this module can enable serious impact (e.g., code execution via template tags and/or unauthorized file reads depending on path validation). Debug options can also leak generated source via logs. Confidence: 0.66 Severity: 0.58 From: packages/wallet-cli/package.json → npm/@oclif/core@5.1.8 → npm/ejs@6.0.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ejs@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
See 2 more rows in the dashboard

View full report

[metamask-ci]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.