fix(deps): override axios to 1.20.0 for CVE-2026-67313 (AAP-88408)

[h-kataria]

Summary

• Bumps the axios override from 1.16.1 → 1.20.0 to remediate CVE-2026-67313
• Clears all 10 axios security advisories affecting versions >=1.0.0 <1.18.0

CVE Details

Field	Value
Jira	AAP-88408
CVE	CVE-2026-67313
GHSA	GHSA-42h9-826w-cgv3
Vulnerability	Excessive recursion in formDataToJSON — deeply nested bracket field names exhaust call stack → RangeError DoS
Affected range	>=1.0.0 <1.18.0
Previous version	1.16.1
Fixed version	1.20.0 (latest stable)

Additional advisories cleared by this upgrade

Upgrading to 1.20.0 also addresses 9 other axes advisories in the <1.18.0 range:

• GHSA-hcpx-6fm6-wx23 — form serializer maxDepth bypass via {} metatoken (>=1.15.1 <1.18.0)
• GHSA-xj6q-8x83-jv6g — Prototype pollution auth subfields inject Basic auth (>=1.15.2 <1.18.0)
• GHSA-mmx7-hfxf-jppx — Prototype pollution gadgets alter request construction (>=1.0.0 <1.18.0)
• GHSA-mwf2-3pr3-8698 — HTTP/2 streamed uploads bypass maxBodyLength (>=1.13.0 <1.18.0)
• GHSA-gcfj-64vw-6mp9 — Node HTTP adapter inherited proxy after interceptor cloning (>=1.15.2 <1.18.0)
• GHSA-7q8q-rj6j-mhjq — Nested option objects consume polluted prototype values (>=1.0.0 <1.18.0)
• GHSA-jqh4-m9w3-8hp9 — Fetch adapter ReadableStream uploads bypass maxBodyLength (>=1.7.0 <1.18.0)
• GHSA-f4gw-2p7v-4548 — NO_PROXY bypass for 0.0.0.0 local addresses (>=1.15.0 <1.18.0)

Test plan

• npm audit — zero axios vulnerabilities remaining after upgrade
• npx tsc --noEmit — type check passes with no errors
• CI pipeline passes

🤖 Generated with Claude Code