Upgrade axios@1.16.0

[vincent-tock]

Description

We're trying to adopt iterable-web-sdk at my company, Squarespace, however this will not pass our Vulnerability Scan step because this CVE.

New Vulnerable Dependency: axios
---
  Vulnerability: Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
  Severity: high
  Advisory: https://github.com/advisories/GHSA-pmwg-cvhr-8vh7
  Vulnerability in Versions: >=1.0.0 <1.15.1
  Version(s) in lock file: 1.13.4, 1.14.0, 1.7.4, 1.7.7, 1.8.4
  ---
  Vulnerability: Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
  Severity: high
  Advisory: https://github.com/advisories/GHSA-pf86-5x62-jrwf
  Vulnerability in Versions: >=1.0.0 <1.15.1
  Version(s) in lock file: 1.13.4, 1.14.0, 1.7.4, 1.7.7, 1.8.4
  ---
  Vulnerability: Axios: Header Injection via Prototype Pollution
  Severity: high
  Advisory: https://github.com/advisories/GHSA-6chq-wfr3-2hj9
  Vulnerability in Versions: >=1.0.0 <1.15.1
  Version(s) in lock file: 1.13.4, 1.14.0, 1.7.4, 1.7.7, 1.8.4
  ---
  Vulnerability: Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
  Severity: high
  Advisory: https://github.com/advisories/GHSA-q8qp-cvcw-x6jj
  Vulnerability in Versions: >=1.0.0 <1.15.2
  Version(s) in lock file: 1.13.4, 1.14.0, 1.7.4, 1.7.7, 1.8.4
  ---

Test Steps

Ran the test

[sameersw]

Hey team, any plans or blockers on approving this upgrade? We ask because our security team has also flagged this and atm we are evaluating options.

[sameersw]

Apologies for tagging @joaodordio, we really would love if you could help us with this one 🙏 Perhaps share if this could be merged or if there is a blocker?

[joaodordio]

Thanks for this @vincent-tock, and sorry for the slow turnaround. The report was accurate and useful. Also thanks @sameersw for the nudge.

I've opened #585 which does the upgrade, and I'm closing this one in favour of it. Two reasons we couldn't merge this as-is:

The lockfile points at a private registry. Both new entries resolve from artifactory.squarespace.net rather than registry.yarnpkg.com:

resolved "https://artifactory.squarespace.net/artifactory/api/npm/npm-all/axios/-/axios-1.16.0.tgz#..."

That's your company Artifactory mirror leaking in from a local .npmrc. Merging it would point our CI and every contributor at a host we don't control. Easy to avoid next time by running the install with --registry https://registry.yarnpkg.com.

1.16.0 has since gone stale. Ten advisories now affect it, including the high severity GHSA-gcfj-64vw-6mp9. So this would not have cleared your scan today either. All of them are patched in 1.18.0, which is what #585 lands on. I stopped short of 1.20.0 because it adds a generic to AxiosResponse that breaks compilation in our auth test suite, that cleanup is a separate change.

#585 carries you as co-author. It's green locally across typecheck, tests, both builds and lint, and it'll go out in the next release.