Sacha Al Himdani 23bf204ae7 Bump axios override to 1.16.0 for security fixes ...

Pulls fixes for the cluster of advisories filed against 1.15.0:
prototype-pollution gadgets in resolveConfig/mergeConfig, CRLF
injection in headers and multipart bodies, no_proxy bypass via
RFC 1122 loopback subnet and IP aliases, parseReviver tampering,
withXSRFToken cross-origin leakage, validateStatus auth bypass,
and AxiosURLSearchParams null-byte injection. Addressed across
axios 1.15.1, 1.15.2, and 1.16.0.

axios is only present as a transitive peer dep (ibm-cloud-sdk-core);
the override forces a single 1.16.0 resolution.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

2026-05-06 09:45:33 +02:00

1.1 KiB

Raw Blame History

View Raw