fix(deps): upgrade npm packages for 14 CVE fixes

[midays]

Summary

Upgrades 6 vulnerable npm dependencies to address 14 CVE security issues.

Security Fixes

Critical Dependencies:

• axios: 1.16.1 → 1.18.0

  • CVE-2026-67320: Information disclosure via Prototype Pollution
  • CVE-2026-67314: Outbound Request Tampering via Prototype Pollution
  • CVE-2026-67313: DoS via uncontrolled recursion in formDataToJSON
  • CVE-2026-67321: DoS via object serialization bypass

• fast-uri: 3.1.2 → 4.1.3

  • CVE-2026-16221: Security policy bypass due to URL parsing inconsistency

• node-tar: 7.5.6 → 7.5.22

  • CVE-2026-73566: DoS via crafted long-path tar archive
  • CVE-2026-59874: DoS via malformed tar archive header
  • CVE-2026-59873: DoS via crafted gzip bomb

• js-yaml: 3.14.1 → 5.4.1

  • CVE-2026-73643: DoS via exponential parsing in flow collections
  • CVE-2026-59869: DoS via crafted YAML documents

Additional Fixes:

• brace-expansion: 5.0.7 → 5.0.9

  • CVE-2026-14257: DoS via memory exhaustion in expand() function
  • CVE-2026-69152: DoS via unbounded intermediate arrays

• ip-address: 10.1.1 → 10.7.0

  • CVE-2026-69192: Inconsistent IP address parsing leads to SSRF

Excluded CVEs (Require ESM Migration):

• CVE-2026-73086 (nanoid): Requires nanoid 6.x which is ESM-only, breaking change
• CVE-2026-69153 (postcss): Requires postcss 8.5.26+ which depends on nanoid 6.x

These will be addressed in a separate migration PR.

Testing

• ✅ All unit tests passing (14/14)
• ✅ Build successful (no ESM compatibility issues)
• ✅ No breaking changes detected
• ✅ Yarn Berry compatibility maintained

Jira Tickets

Fixes: MIG-1993, MIG-1995, MIG-1994, MIG-1992, MIG-1991, MIG-1990, MIG-1983, MIG-1982, MIG-1970, MIG-1969, MIG-1968, MIG-1961, MIG-1960, MIG-1959

---

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 50 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 39feabab-7bd8-4953-8ce0-5c523edadc7a

📥 Commits

Reviewing files that changed from the base of the PR and between af2c1ee and d72e08a.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d8baf717-fa53-4628-b9ac-38b0c40fc2d8

📥 Commits

Reviewing files that changed from the base of the PR and between d4f2d13 and af2c1ee.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates the axios dependency and adjusts several transitive dependency resolutions in package.json.

Changes

Dependency updates

Layer / File(s)	Summary
Package dependency and resolution pins package.json	Updates axios to ^1.18.0, changes three resolution versions, and adds resolution pins for tar, js-yaml, nanoid, and postcss.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to af2c1

The PR updates dependency versions and resolutions for security fixes without any identified current-head merge-blocking risk; it is merge-ready after normal checks and review.

Suggested reviewers: awels

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies npm dependency upgrades for security fixes, which matches the main change. The stated count of 14 CVE fixes differs from the objective's count of 16, but this does not mak…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Title check

Explanation

The title clearly identifies npm dependency upgrades for security fixes, which matches the main change. The stated count of 14 CVE fixes differs from the objective's count of 16, but this does not make the title unrelated or generic.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}