Bump axios to ^1.18.0 to resolve six security advisories

[ggoranov-smar]

Summary

• Bumps axios from 1.16.0 → 1.18.1 (declared floor raised ^1.13.5 → ^1.18.0), clearing six open Dependabot alerts, all patched in axios 1.18.0.
• Raising the declared floor (not just the lockfile) ensures downstream SDK consumers cannot resolve a vulnerable axios version.

Advisories resolved

Severity	GHSA	Summary
High	GHSA-gcfj-64vw-6mp9	Node HTTP adapter can use an inherited proxy after interceptor config cloning
Medium	GHSA-jqh4-m9w3-8hp9	Fetch adapter ReadableStream uploads bypass maxBodyLength
Medium	GHSA-hcpx-6fm6-wx23	Form serializer maxDepth bypass via {} metatoken
Medium	GHSA-mwf2-3pr3-8698	HTTP/2 streamed uploads bypass maxBodyLength
Medium	GHSA-f4gw-2p7v-4548	NO_PROXY bypass for 0.0.0.0 local addresses
Medium	GHSA-xj6q-8x83-jv6g	Prototype pollution — auth subfields can inject Basic auth

axios stays within major v1, so no breaking changes. The SDK's usage in lib/utils/httpRequestor.js is standard get/post/put/patch/delete and does not touch any of the vulnerable configuration surfaces.

Test plan

• npm test — all 2084 tests pass across 90 suites
• Confirmed lockfile resolves axios to 1.18.1
• Verified remaining npm audit findings are dev-only transitive deps (babel, brace-expansion, fast-uri, js-yaml), not shipped in dist/

🤖 Generated with Claude Code

Summary by CodeRabbit

• Security

  • Updated the HTTP request library to address multiple known security vulnerabilities.

• Bug Fixes

  • Fixed sharing requests that could fail because of malformed or duplicated query strings.
  • Fixed asset-sharing updates that could trigger a runtime error.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c467b11b-20fd-4aec-a19f-bf50f0c22419

📥 Commits

Reviewing files that changed from the base of the PR and between 9a17eaf and 6dbd2c4.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• CHANGELOG.md
• package.json

---

📝 Walkthrough

Walkthrough

Updates axios to ^1.18.0 and documents the dependency security advisories plus fixes for sharing endpoint query strings and PATCH request support.

Changes

Axios release update

Layer / File(s)	Summary
Dependency and changelog update package.json, CHANGELOG.md	The runtime axios dependency is updated to ^1.18.0; the Unreleased changelog records related security advisories and sharing fixes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: ggyurchev

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: bumping axios to ^1.18.0 to address security advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/axios-security-vulns

---

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 29899613337

Warning

No base build found for commit 9a17eaf on mainline.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 97.619%

Details

• Patch coverage: No coverable lines changed in this PR.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	1274
Covered Lines:	1255
Line Coverage:	98.51%
Relevant Branches:	238
Covered Branches:	221
Branch Coverage:	92.86%
Branches in Coverage %:	Yes
Coverage Strength:	1788.14 hits per line

---

💛 - Coveralls