fix(sei-global-wallet): raise the axios override to 1.20.0

.changeset/fix-global-wallet-axios-override.md

@@ -0,0 +1,18 @@
+---
+'@sei-js/sei-global-wallet': patch
+---
+
+Raise the documented `axios` override to `1.20.0` to clear the Axios advisories published on 2026-09-30.
+
+Twelve advisories published that day cover every Axios release below `1.20.0`, including the `1.18.0` the [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) blocks pinned, so the nightly consumer run went red without any change in this repository. The wallet-only npm consumer, which is held to a strictly clean audit, reported nine findings: `axios` itself and the eight Dynamic packages above it in the dependency chain.
+
+Every one of them is patched in `1.20.0` and still open in `1.19.0`:
+
+- High: `GHSA-3pq3-5fj3-cg6v`, `GHSA-542g-h47m-68v8`, `GHSA-c29m-xwm3-cm6r`, `GHSA-m8m8-qj5v-23w3`, `GHSA-mghh-pgcx-3jjj`, `GHSA-r4gj-5m52-g5wh`, `GHSA-x97p-jq2g-jp4f`.
+- Medium: `GHSA-44g4-m2mj-wpvx`, `GHSA-4hqw-qxg8-jxx2`, `GHSA-9fr6-4gfg-395g`, `GHSA-j8rh-479h-cp32`, `GHSA-vh66-26gq-q6x8`.
+
+Dynamic still pins `axios@1.16.0` exactly, so the correction stays a root override. All three blocks now carry `"axios": "1.20.0"`, the first release outside every advisory reported against that pin. It ships the same exports and dependencies as `1.18.0`, apart from raising the `form-data` floor to `^4.0.6`.
+
+The README's Axios note described only the Node HTTP adapter issue that `1.18.0` cleared. It now covers the current set: the high-severity issues are in Node-only transports or are prototype-pollution gadgets, and the `toFormData` and fetch-adapter gadgets also apply in browsers.
+
+No published dependency or peer range changes.

package.json

@@ -7,7 +7,7 @@
 		"packages/*"
 	],
 	"overrides": {
-		"axios": "1.18.0",
+		"axios": "1.20.0",
 		"uuid": "11.1.1"
 	},
 	"scripts": {

packages/sei-global-wallet/README.md

@@ -25,7 +25,7 @@ Complete npm root overrides when the optional AA path is not enabled:
 ```json
 {
 	"overrides": {
-		"axios": "1.18.0",
+		"axios": "1.20.0",
 		"sharp": "0.35.4",
 		"uuid": "11.1.1",
 		"viem": {
@@ -39,7 +39,7 @@ Complete Bun root overrides. The block is the same with or without the optional
 ```json
 {
 	"overrides": {
-		"axios": "1.18.0",
+		"axios": "1.20.0",
 		"sharp": "0.35.4",
 		"uuid": "11.1.1"
 	}
@@ -48,15 +48,15 @@ Complete Bun root overrides. The block is the same with or without the optional
 
 The Axios, Sharp, and UUID overrides are temporary until Dynamic updates its exact transitive pins:
 
-- The high-severity Axios issue is in the Node HTTP adapter and requires a prerequisite prototype-pollution/interceptor pattern. Browser wallet paths do not use that adapter, which reduces exploitability but does not make the vulnerable install acceptable.
+- Dynamic pins `axios@1.16.0` exactly, and `1.20.0` is the first release outside every advisory reported against it. The high-severity Axios issues are in Node-only transports (the HTTP adapter, opt-in HTTP/2, and `NO_PROXY` handling) or are prototype-pollution gadgets that need a separate pollution primitive in the same process. Browser wallet paths do not use the Node transports, which reduces exploitability but does not make the vulnerable install acceptable; the `toFormData` and fetch-adapter gadgets apply in browsers too.
 - The high-severity Sharp issue is the bundled libheif heap overflow reported as `GHSA-rgj7-g3m4-5g8c`, reached through `@dynamic-labs/iconic`'s exact `sharp@0.35.0` pin. It is only triggered by decoding untrusted HEIF input, which no wallet path does, and `sharp` is a build-time image dependency that never reaches a browser bundle. The override is a patch-level move within `0.35.x`, so it carries no API change.
 - The UUID issue affects the v3, v5, and v6 buffer APIs. Dynamic's observed call sites use UUID v4, which reduces exploitability but does not clear the audit finding.
 
 Applications using the optional `./zerodev` / Dynamic account-abstraction path must also replace the vulnerable exact `bn.js@4.11.6` copies used by `ethjs-unit` and `number-to-bn`. The complete npm root override block is:
 ```json
 {
 	"overrides": {
-		"axios": "1.18.0",
+		"axios": "1.20.0",
 		"ethjs-unit": {
 			"bn.js": "4.12.5"
 		},

scripts/check-sei-global-wallet.ts

@@ -166,7 +166,7 @@ const assertTestedPeersFitPublishedRanges = (testedPeerVersions: TestedPeerVersi
 // Flat by necessity: Bun cannot nest overrides, so every entry here has to be
 // safe to apply globally.
 const baseSafeOverrides = {
-	axios: '1.18.0',
+	axios: '1.20.0',
 	sharp: '0.35.4',
 	uuid: '11.1.1'
 };