v1.3.2 — axios security upgrade
Security
Upgrade axios 1.14.0 → 1.16.1 to remediate the Snyk/GitHub-reported vulnerabilities in the transitive axios dependency, including:
- Prototype Pollution (CWE-1321, CVSS 9.1)
- HTTP Response Splitting / CRLF Injection (CWE-113)
- Uncontrolled Recursion (CWE-674)
- SSRF, Confused Deputy, and improper output encoding
All flagged issues are fixed by axios >= 1.15.2; 1.16.1 includes those plus later patches. Pulls in follow-redirects@1.16.0 and https-proxy-agent@5.0.1.
Maintenance
- Realigned the
package-lock.jsonversion field (had drifted at1.3.0).
Verification
npm audit --omit=dev→ 0 vulnerabilities- Test suite: 42/42 passing
No source/API changes — drop-in upgrade.