Remediate 9 CVEs in axios:axios-1.16.0.tgz

[eng-cve-remediation-app]

This PR contains the following updates:

Package	Type	Update	Change
axios:axios-1.16.0.tgz	dependencies	security	1.16.0 → 1.18.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	8.2	CVE-2026-67320
Medium	5.8	CVE-2026-67317
Medium	5.3	CVE-2026-67312
Medium	5.8	CVE-2026-67318
Medium	4.0	CVE-2026-67319
Medium	5.3	CVE-2026-67321
Medium	5.8	CVE-2026-67315
Medium	5.3	CVE-2026-67313
Medium	6.5	CVE-2026-67314

---

Bump strategy

axios 1.16.0 -> 1.18.0 (CAT-2744)

axios is a direct dependency, declared in package.json as the range
>= 1.15.0 < 2.0.0. That range already permits 1.18.0, so no manifest edit
was needed or made — only the lockfile's resolved version required a bump.

Re-locked axios to 1.18.0 in package-lock.json via npm install. As a
side effect, agent-base, debug, https-proxy-agent, and ms lost their
dev: true flag in the lockfile: axios 1.18.0 now depends on
https-proxy-agent directly, so these transitive packages are genuinely
needed at runtime, not just for devDependencies as before. This is expected
lockfile fallout from the bump, not an unrelated change.

Verified with npm ls axios (resolves to 1.18.0) and npm run compile
(clean).

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Report: axios 1.16.0 → 1.18.0 (CAT-2744)

Summary

Mend bumped axios from 1.16.0 to 1.18.0 to remediate 9 CVEs
(CVE-2026-67320 and 8 others, HIGH/MEDIUM severity). The diff is
lockfile-only (package-lock.json) — package.json already pins
axios with a range (">= 1.15.0 < 2.0.0", package.json:669), so no manifest edit was needed.
Reviewed release notes for axios 1.16.1, 1.17.0, and 1.18.0 (upstream
publishes no release-notes.md/CHANGELOG artifact in the Mend PR body,
so this was sourced from GitHub). No breaking changes were found in
the stable public API; all notable changes are security hardening,
bug fixes, or opt-in/additive features. Verdict: not breaking.

Upstream changes (1.16.1 → 1.18.0)

Version	Date	Notable changes
1.16.1	2026-05-13	Security: prototype-pollution defense in formDataToJSON; fixed HTTPS-over-cleartext leak to HTTP proxies. Bug fixes: RFC 2397 data-URI parsing, unicode header preservation, XHR upload progress, webpack 4 fetch-adapter compat.
1.17.0	2026-06-01/03	Security: config/adapter paths hardened to read only own properties with null-prototype objects (blocks polluted auth/baseURL/socketPath/beforeRedirect/insecureHTTPParser from prototype chain). New opt-in allowedSocketPaths config to restrict UNIX socket paths. New opt-in zstd response decompression (transitional.advertiseZstdAcceptEncoding). Bug fixes: Basic-auth restored on same-origin redirects, HTTPS-proxy TLS option preservation, RN FormData Content-Type, empty header-name handling. Minor: AxiosHeaders.toJSON() / isCancel TS type corrections, smaller published package (files allowlist).
1.18.0	2026-06-13	Security: Node HTTP adapter now strips sensitive headers on cross-origin redirects (prevents credential leakage — this is the CVE fix). URL hardening: rejects malformed http:/https: URLs missing // with ERR_INVALID_URL (previously such URLs may have been silently mis-parsed). Bug fix: new transitional.validateStatusUndefinedResolves option lets validateStatus: undefined behave as "option omitted" (opt-in; validateStatus: null remains the explicit accept-all). Plus prototype-pollution-safe config reads, stream/FormData/data-URL size limits, local-proxy-matching fixes.

No maintainer changelog entry across these three releases is flagged as
"BREAKING" — all are described as security hardening, bug fixes, or
additive/opt-in features.

Lockfile side-effect worth noting

The diff also flips agent-base@6.0.2, debug@4.3.4, https-proxy-agent@5.0.1,
and ms@2.1.2 from "dev": true to production dependencies, because
axios 1.18.0 now declares https-proxy-agent@^5.0.1 as a runtime
dependency (package-lock.json diff lines 26-29). This slightly grows
the shipped production dependency tree but doesn't change any API this
repo calls — informational only.

How we use it

axios is used in exactly two runtime call sites plus one test file, all
via the default export doing plain GET requests with a URL, params,
and headers — no advanced config:

• src/forge.ts:47-56 getPDKVersion — axios.get('https://s3.amazonaws.com/...')
• src/forge.ts:69-78 getModuleInfo — axios.get('https://forgeapi.puppet.com/v3/modules/${title}')
• src/forge.ts:118-127 getPuppetModuleCompletion — axios.get('https://forgeapi.puppet.com/private/modules?starts_with=${text}')
• src/feature/PuppetfileHoverFeature.ts:38 calls into getModuleInfo above (no direct axios usage)
• src/test/suite/links.test.ts:12,23 — test-only axios.get(link) link-checks against well-formed, hardcoded HTTPS URLs

Checked against each 1.17.0/1.18.0 change:

Change	Repo impact
Strips sensitive headers on cross-origin redirects (1.18.0)	Not affected — this repo doesn't set custom auth headers expected to survive a redirect; the only header sent is a static User-Agent/Content-Type, and none of the called URLs redirect cross-origin. Pure security improvement.
Malformed URL rejection, missing // (1.18.0)	Not affected — all URLs are hardcoded, well-formed https://... literals or simple template-string concatenations (https://forgeapi.puppet.com/v3/modules/${title}); none can produce a scheme without //.
transitional.validateStatusUndefinedResolves (1.18.0)	Not used — repo never sets validateStatus; grep for validateStatus across src/ found no matches. Default behavior unchanged unless opted in.
Own-property/null-prototype config hardening (1.17.0)	Not affected — config objects passed (params, headers) are plain object literals with only own, enumerable properties.
allowedSocketPaths, zstd decompression (1.17.0)	Both opt-in/additive; not referenced anywhere in src/ (grep for socketPath, proxy found no matches).
AxiosHeaders.toJSON() / isCancel type corrections (1.17.0)	Not used — repo never calls .toJSON() on headers or axios.isCancel.

Action items / risks

No action needed. The bump is lockfile-only, package.json's existing
range (>= 1.15.0 < 2.0.0) already permits 1.18.0, and none of the
documented changes touch how this repo calls axios. The promotion of
agent-base/debug/https-proxy-agent/ms from dev-only to production
dependencies is a minor, expected side effect of axios's own dependency
graph and requires no follow-up.

References

• axios GitHub Releases
• axios v1.18.0 release notes
• axios v1.x CHANGELOG.md

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.77%. Comparing base (0170a8c) to head (b3f982b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #948   +/-   ##
=======================================
  Coverage   77.77%   77.77%           
=======================================
  Files           1        1           
  Lines           9        9           
=======================================
  Hits            7        7           
  Misses          2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[eng-cve-remediation-app]

The fix-ci agent made no change this run while CI is red. The reconcile sweep will escalate this PR to a human rather than retry.

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog / Impact Report — axios 1.16.0 → 1.18.0

Summary

This is a lockfile-only bump of axios from 1.16.0 to 1.18.0, remediating 9 CVEs (CAT-2744), plus transitive bumps of form-data (4.0.5→4.0.6) and hasown (2.0.2→2.0.4). No manifest change was needed — package.json already declares "axios": ">= 1.15.0 < 2.0.0". Verdict: not breaking. Upstream release notes for 1.16.1/1.17.0/1.18.0 are all security hardening + additive features; nothing removed or changed in a way that affects this repo's usage (simple axios.get() calls with params/headers, no proxy/redirect/validateStatus/adapter customization).

Upstream changes, by version

Axios does not publish structured release notes for this range in a way the bump workflow could extract (/tmp/release-notes.md was empty), so this is from the project's CHANGELOG.md and GitHub release page.

Version	Date	Type	Notable changes
1.16.0 (current)	2026-05-02	baseline	Fetch adapter enforces maxBodyLength/maxContentLength; proxy Host header preservation; URL-decode Basic-auth creds in URLs; parseProtocol stricter; new QUERY HTTP method; ECONNREFUSED exposed on AxiosError; encode export from buildURL
1.16.1	2026-05-13	security patch	Defence-in-depth hardening of formDataToJSON against prototype pollution; fixed HTTPS→HTTP-proxy cleartext data leak; fromDataURI regex tightened to RFC 2397; preserved Unicode header values through interceptors; restored Webpack 4 fetch-adapter compat; reverted URL-object support as config.url (regression revert, not new break)
1.17.0	2026-06-01	security + features	Config hardening against prototype pollution via socketPath/params/paramsSerializer; npm staged publishing w/ provenance; Node zstd decompression support (opt-in via transitional.advertiseZstdAcceptEncoding); restored same-origin Basic auth on Node redirects while still stripping cross-origin; preserved user httpsAgent TLS options through proxy tunneling; fixed React Native FormData Content-Type handling; empty/whitespace header names now silently skipped instead of throwing; AxiosHeaders.toJSON() return-type fix
1.18.0 (target)	2026-06-13	security	Node HTTP adapter strips caller-specified sensitive headers on cross-origin redirects; malformed HTTP/HTTPS URLs missing // now rejected with ERR_INVALID_URL; additional prototype-pollution/stream-size/FormData-depth/data-URL-size/proxy-matching hardening; new transitional.validateStatusUndefinedResolves option (opt-in, additive — validateStatus: null still the way to accept all statuses); dependency/tooling maintenance only otherwise

No version in this range documents a breaking change to stable public API. The closest thing to a behavior change that could theoretically bite a caller is the 1.18.0 URL-hardening rejecting malformed URLs that lack // — but that only affects callers passing already-invalid URLs, and 1.16.1 already reverted an unrelated URL-parsing regression from the same area, suggesting the axios team is treating this surface carefully.

How we use it

axios is a genuine runtime dependency here, not just a transitive pull-in.

• src/forge.ts:2,47,69,118 — three call sites, all axios.get(url, { params: { exclude_fields }, headers: { 'Content-Type', 'User-Agent' } }) against s3.amazonaws.com and forgeapi.puppet.com. Plain well-formed https:// URLs, no proxy config, no custom validateStatus, no redirect/adapter/agent options, no FormData usage.
• src/test/suite/links.test.ts:2,12,23 — test-only, axios.get(link) to validate doc links resolve. Same shape: plain GET, well-formed URL, default options.
• src/feature/PuppetfileHoverFeature.ts:1 — a commented-out require('axios'), not live code.

None of the call sites touch the surfaces that changed across 1.16.0→1.18.0 (proxy tunneling, redirect header stripping, validateStatus, FormData depth, data URLs, zstd). All URLs used are well-formed, so the new ERR_INVALID_URL strictness in 1.18.0 does not apply.

Transitive lockfile churn (from the diff)

• form-data 4.0.5 → 4.0.6, hasown 2.0.2 → 2.0.4 — indirect deps of form-data/axios; patch bumps, no code in this repo references either directly.
• agent-base, debug, https-proxy-agent, ms lost their "dev": true lockfile marker because axios 1.18.0 added https-proxy-agent@^5.0.1 as a direct (non-dev) dependency — these packages already existed in the lockfile as devDependencies of something else, and npm merged them into the production dependency graph. This is expected lockfile bookkeeping from the version bump, not a code change; nothing in this repo imports https-proxy-agent/agent-base directly.

Action items / risks

No action needed. The bump is lockfile-only (no package.json change required, since the existing range >= 1.15.0 < 2.0.0 already permits 1.18.0), the repo's axios usage doesn't touch any of the changed/hardened surfaces, and no breaking change is documented across 1.16.1, 1.17.0, or 1.18.0.

References

• axios/axios CHANGELOG.md (v1.x branch)
• axios v1.18.0 release
• src/forge.ts, src/test/suite/links.test.ts (this repo's axios call sites)

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Report: axios 1.16.0 → 1.18.0

Summary

Mend bump CAT-2744 upgrades axios from 1.16.0 → 1.18.0 to remediate 9 CVEs
(1 HIGH, 8 MEDIUM — SSRF/prototype-pollution/header-leak/URL-parsing class issues,
see unit.json). The diff only touches package-lock.json (the manifest range
>= 1.15.0 < 2.0.0 in package.json:669 already permits 1.18.0). Verdict: not
breaking. Reviewed both intermediate releases (1.17.0, 1.18.0); no maintainer
"BREAKING" callouts, no public API removed/changed, and this repo's axios usage is
too simple to be touched by anything upstream changed.

Upstream changes

Upstream doesn't publish notes in a Mend-extractable form (/tmp/release-notes.md
was empty); reviewed the official GitHub changelog/releases instead.

v1.17.0 (2026-06-01)

Change	Type
Guarded socketPath, params, paramsSerializer reads against prototype pollution / SSRF	Security fix
Switched to npm staged publishing (provenance)	Infra
Node HTTP zstd response decompression (transitional.advertiseZstdAcceptEncoding)	Additive feature
Restored Basic auth on same-origin Node redirects (still stripped cross-origin)	Bug fix
Preserved httpsAgent TLS options when tunneling through HTTP CONNECT proxies	Bug fix
Cleared default Content-Type for React Native FormData	Bug fix
Skip empty/whitespace header names instead of throwing	Bug fix
Preserved enumerable symbol keys when cloning request data	Bug fix
resolveConfig changed from arrow default export to named function export	Type/interop change
Fixed AxiosHeaders.toJSON() return type, CJS isCancel typings	Type fix
Added https-proxy-agent as a new runtime dependency (^5.0.1)	Dependency addition

v1.18.0 (2026-06-13)

Change	Type
Strip caller-supplied sensitive headers (e.g. custom auth/API-key headers) on cross-origin redirects	Security fix (behavioral)
Reject malformed http:/https: URLs missing // with ERR_INVALID_URL	Security fix (stricter validation)
Tightened prototype-pollution-safe config reads, stream size limits, FormData depth handling, data-URL sizing, local NO_PROXY matching	Security hardening
New opt-in transitional.validateStatusUndefinedResolves (treat validateStatus: undefined like omitted; validateStatus: null still means "accept everything")	Additive, opt-in

No release in this range carries an explicit "BREAKING" / "⚠️" callout, no public
class/method/export was removed, and no existing API gained a new required
parameter. The two behavioral security fixes (header stripping on cross-origin
redirect, stricter URL validation) are corrective/security-motivated rather than
maintainer-flagged breaking changes, per the classification rules for this audit.

How we use it

Only one file in this repo calls axios: src/forge.ts (3 call
sites, all structurally identical):

• src/forge.ts:47 — axios.get('https://s3.amazonaws.com/puppet-pdk/pdk/LATEST', { params, headers })
• src/forge.ts:69 — axios.get(\https://forgeapi.puppet.com/v3/modules/${title}\`, { params, headers })`
• src/forge.ts:118 — axios.get(\https://forgeapi.puppet.com/private/modules?starts_with=${text}\`, { params, headers })`

All three:

• Use plain string literal HTTPS URLs (no user-controlled scheme, no malformed
  URLs) → unaffected by the stricter ERR_INVALID_URL check in 1.18.0.
• Set only Content-Type and User-Agent headers, no auth/API-key headers, and
  none of the endpoints redirect cross-origin → unaffected by the 1.18.0
  redirect-header-stripping change.
• Don't set validateStatus, don't use Basic auth in the URL, don't configure a
  proxy or custom httpsAgent, don't import resolveConfig or AxiosHeaders
  directly → unaffected by the 1.17.0 fixes/type changes.
• Run in the extension's Node.js host process (not a browser/React Native
  context) → the FormData/React-Native-specific fixes don't apply.

src/feature/PuppetfileHoverFeature.ts:1
has a commented-out require('axios') — dead code, not a real call site.

package.json:669 pins axios only as an engines-style semver range
(>= 1.15.0 < 2.0.0), not further constrained — no manifest edit was needed for
this bump, matching what's in the diff.

New transitive dependency (https-proxy-agent): axios 1.17.0+ added
https-proxy-agent@^5.0.1 as a normal (non-dev) dependency, which is why
package-lock.json also flips agent-base, debug, https-proxy-agent, and
ms from "dev": true to real dependencies — these were already present in the
lockfile (pulled in by dev tooling) and now also serve axios's production
dependency chain. Versions are consistent across the tree (agent-base@6.0.2,
debug@4.3.4, https-proxy-agent@5.0.1, ms@2.1.2) — no split cohort, no
version mismatch to flag.

Action items / risks

No action needed. This repo's axios usage is limited to simple unauthenticated
GET requests with no proxy/redirect/validateStatus customization, so none of
the 1.17.0/1.18.0 changes affect runtime behavior here. The manifest range
already covers 1.18.0, and the new transitive dependency addition
(https-proxy-agent) resolves cleanly with matching versions throughout the
lockfile.

References

• axios releases
• axios CHANGELOG.md (v1.x branch)
• Compare v1.17.0...v1.18.0
• axios 1.16.0 on npm
• axios 1.18.0 on npm

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Impact Report: axios 1.16.0 → 1.18.0

Summary

This bump upgrades axios from 1.16.0 to 1.18.0 to remediate 9 CVEs
(1 HIGH, 8 MEDIUM) tracked under Jira CAT-2744. The change is
lockfile-only — package.json already declares "axios": ">= 1.15.0 < 2.0.0", so no manifest edit was needed. Reviewing all intermediate
releases (1.16.1, 1.17.0, 1.18.0), I found no breaking changes called
out by the maintainers, and this repo's three call sites use only
basic, stable axios.get(url, config).then().catch() calls that are
unaffected. Verdict: not breaking — safe to auto-merge.

The diff

bump-diff.txt only touches package-lock.json:

• axios: 1.16.0 → 1.18.0, gaining a new direct dependency on
  https-proxy-agent@^5.0.1.
• agent-base@6.0.2, debug@4.3.4, https-proxy-agent@5.0.1, ms@2.1.2
  lose their "dev": true flag — expected side effect of npm's resolver
  now needing them for the production dependency graph (via axios's new
  https-proxy-agent dependency), not a separate change to review.
• package.json is unchanged; the existing >= 1.15.0 < 2.0.0 range
  already permits 1.18.0.

Upstream changes (1.16.0 → 1.18.0)

release-notes.md was empty for this PR, so this is from axios's
GitHub CHANGELOG.md and the v1.18.0 release notes.

Version	Date	Breaking?	Notable changes
1.16.1	2026-05-13	No	Hardened formDataToJSON against prototype pollution; fixed HTTPS request data leaking in cleartext to HTTP proxies; stricter fromDataURI RFC 2397 regex; preserved Unicode header values; guarded malformed XHR ProgressEvent payloads; reverted experimental URL-object support for config.url.
1.17.0	2026-06-01	No (explicitly)	Added zstd response decompression for the Node HTTP adapter (opt-in via transitional.advertiseZstdAcceptEncoding); HTTP/2 session handling improvements; restored Basic auth on same-origin Node redirects while still stripping creds cross-origin; fixed proxy TLS tunneling; empty/whitespace header names now skipped instead of throwing; resolveConfig's default export changed to a named export (only relevant to consumers importing resolveConfig directly — this repo does not).
1.18.0	2026-06-13	No (explicitly)	Security: Node HTTP adapter now strips sensitive headers (e.g. API keys) on cross-origin redirects; malformed http(s): URLs missing // now rejected with ERR_INVALID_URL; further prototype-pollution, stream-size, FormData-depth, and data-URL-size hardening. Bug fix: new transitional.validateStatusUndefinedResolves option to treat validateStatus: undefined as "omitted" (additive/opt-in).

None of the three releases has a maintainer-labeled "BREAKING" or
migration-guide entry. The security fixes tighten previously-insecure
behavior (credential leakage on redirect, prototype pollution, cleartext
proxy transmission) rather than changing stable public API surface —
per the breaking-change rubric, hardening fixes like this don't count
as breaking unless the changelog itself calls them out that way, which
it doesn't here.

How we use it

Three files reference axios, all runtime GET calls with plain
params/headers config and .then()/.catch() handling — none touch
any of the changed surface above:

• src/forge.ts:2,47-64,69-113,118-140 — getPDKVersion, getModuleInfo,
  getPuppetModuleCompletion each call axios.get(url, { params, headers }) against static, well-formed HTTPS URLs
  (s3.amazonaws.com, forgeapi.puppet.com). No proxy config, no
  resolveConfig import, no custom validateStatus, no redirects across
  origins.
• src/test/suite/links.test.ts:2,12,23 — test-only axios.get(link)
  calls used to validate documentation links resolve.
• src/feature/PuppetfileHoverFeature.ts:1 — a commented-out
  require('axios'); dead code, not active usage.

None of these call sites are affected by:

• The resolveConfig named-export change (not imported here).
• Cross-origin redirect header stripping (all URLs are fixed, same-origin
  per call, no redirect chains expected).
• The stricter malformed-URL rejection (all URLs are static, well-formed
  literals).
• zstd decompression / HTTP2 changes (opt-in, adapter-internal).

Action items / risks

No action needed. This is a lockfile-only security bump; package.json's
existing range already covers 1.18.0, all changed dependencies are
consistent (no split cohort — axios and its new https-proxy-agent
dependency are aligned at compatible versions), and none of the three
runtime call sites touch the changed/hardened surface.

References

• axios CHANGELOG.md (v1.x branch)
• axios v1.18.0 release
• axios v1.17.0...v1.18.0 compare

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Impact Report: axios 1.16.0 → 1.18.0

Summary

Mend flagged 9 CVEs (1 HIGH, 8 MEDIUM) in axios@1.16.0 (CAT-2744), fixed in 1.18.0. The bump diff upgrades axios in package.json/package-lock.json from a loose >= 1.15.0 < 2.0.0 range to ^1.18.0, and promotes https-proxy-agent (plus its transitive deps agent-base, debug, ms) from dev-only to a production dependency of axios. Verdict: not breaking. All upstream changes between 1.16.0 and 1.18.0 are security hardening and bug fixes; none are flagged by the maintainers as breaking, and none touch the narrow way this repo calls axios.

Upstream changes (1.16.1 → 1.18.0)

Release notes were not embedded in the PR (/tmp/release-notes.md was empty), so this is sourced from the axios GitHub changelog/releases.

Version	Type	Notable changes
1.16.1	Security + fixes	Prototype-pollution hardening in formDataToJSON; fixed HTTPS→HTTP proxy cleartext leak; RFC 2397 data-URI parsing fix; Unicode header preservation; Webpack 4 fetch adapter fix; reverted URL-object config.url support (regression fix)
1.17.0	Security + features	Own-property hardening for socketPath/params/paramsSerializer (SSRF defense); added Node zstd decompression + transitional.advertiseZstdAcceptEncoding; Basic-auth-in-URL now stripped on cross-origin redirects (kept on same-origin); preserved httpsAgent TLS options through proxy tunneling; empty/whitespace header names now silently skipped instead of throwing; resolveConfig changed from default export to named export; AxiosHeaders.toJSON() return-type correction
1.18.0	Security + fixes	Strips sensitive headers on cross-origin redirects (Node HTTP adapter); rejects malformed http(s): URLs missing // with ERR_INVALID_URL; further prototype-pollution/stream-size/FormData-depth hardening; added opt-in transitional.validateStatusUndefinedResolves config

No release in this range carries an explicit "BREAKING" callout. The only items with any theoretical compatibility edge are:

• resolveConfig export style change (default → named) — only affects code importing that internal helper directly.
• Basic-auth-in-URL stripped on cross-origin redirects — a security fix (part of the CVE set), changes behavior only for callers embedding credentials in URLs and expecting them forwarded cross-origin.
• Header-name handling changed from throw → silent skip — strictly more permissive, not breaking.

How we use it

axios usage in this repo is minimal and doesn't touch any of the above surface:

• src/forge.ts:2,47,69,118 (runtime) — three plain axios.get(url, { params, headers }) calls to Puppet Forge / S3 endpoints. No paramsSerializer, socketPath, proxy, httpsAgent, validateStatus, credentials-in-URL, or resolveConfig usage.
• src/test/suite/links.test.ts:2,12,23 (test-only) — simple axios.get(link) calls to validate links; same minimal surface.
• src/feature/PuppetfileHoverFeature.ts:1 — a commented-out require('axios'), not active code.

None of the changed/hardened config paths (params own-property checks, proxy tunneling, Basic-auth-in-URL, header-name validation, resolveConfig export) are exercised anywhere in this repo.

Lockfile side-effect: https-proxy-agent, agent-base, debug, and ms lose their "dev": true marker because axios 1.18.0 now declares https-proxy-agent as a runtime dependency (for proxy tunneling support). This only affects dependency bookkeeping/install footprint, not code behavior — the repo doesn't invoke proxy tunneling directly.

Action items / risks

• No code changes required for this bump.
• No cohort/sibling-pin inconsistency: axios is the only package whose version changed in this diff; its new transitive dep (https-proxy-agent) and existing transitive deps were already present at matching versions, just re-flagged as production (non-dev) — no split-family pins to call out.

References

• https://github.com/axios/axios/releases/tag/v1.18.0
• https://github.com/axios/axios/releases/tag/v1.18.1
• https://github.com/axios/axios/blob/v1.x/CHANGELOG.md
• https://www.mend.io/vulnerability-database/CVE-2026-67320 (and sibling CVE-2026-673{12,13,14,15,17,18,19,21} — all CAT-2744)

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog / Impact Report — axios 1.16.0 → 1.18.0

Summary

Mend flagged 9 CVEs (1 HIGH, 8 MEDIUM) against axios@1.16.0 (ticket
CAT-2744); the bump moves axios to 1.18.0 in package-lock.json
only (the package.json range >= 1.15.0 < 2.0.0 already permits this).
No public API was removed or changed in a way callers must adapt to.
Verdict: not breaking — safe to auto-merge on green CI.

What actually changed in the diff

bump-diff.txt touches only package-lock.json:

Package	Before	After	Note
axios	1.16.0	1.18.0	the CVE'd library
agent-base, debug, https-proxy-agent, ms	present as "dev": true transitive deps	same versions, "dev": true flag removed	these become runtime transitive deps of axios because axios now declares https-proxy-agent@^5.0.1 as a direct dependency (proxy support). No version bump on these — just re-classified from dev-only to prod in the lockfile graph.

package.json itself is unchanged — the existing axios semver range already
covers 1.18.0, so this is a lockfile-only bump.

Upstream changes, by version

Release notes were not embedded in the PR body (/tmp/release-notes.md was
empty), so this is sourced from axios's GitHub releases
(v1.17.0, v1.18.0) and its CHANGELOG.md.

v1.17.0 (2026-06-01)

• Security hardening: guarded socketPath, params, and paramsSerializer
  config reads with own-property checks, closing a prototype-pollution
  vector where a poisoned Object.prototype could influence request
  behavior.
• New feature (additive, opt-in): Node HTTP adapter now supports zstd
  response decompression (transitional.advertiseZstdAcceptEncoding).
• Bug fixes: basic-auth-on-redirect regression fixed, proxy TLS option
  preservation, React Native FormData handling, header sanitization.
• No maintainer "BREAKING" callouts.

v1.18.0 (2026-06-13) — the target version

• Security fix: Node HTTP adapter now strips caller-set sensitive
  headers (e.g. custom Authorization/API-key headers) when a redirect
  crosses origin, to stop credential leakage to a third-party host. This
  changes prior behavior (headers used to follow the redirect), but it is
  presented as a vulnerability fix, not flagged "BREAKING" by the
  maintainer.
• Security fix: malformed http:/https: URLs missing // are now
  rejected with ERR_INVALID_URL instead of being silently accepted.
• New feature (additive, opt-in): transitional.validateStatusUndefinedResolves
  option.
• Various prototype-pollution-safe reads extended to stream-size limits,
  FormData depth, data-URL sizing, local NO_PROXY matching.
• No maintainer "BREAKING" callouts; CHANGELOG lists these under fixes.

v1.18.1 (2026-06-21, not part of this bump's target but reviewed for completeness)

• Maintenance only (AxiosError serialization, socket/proxy handling,
  type fixes). No breaking changes.

No removed exports, no changed function signatures, no new required
parameters, and no minimum-runtime bump were found across 1.16.0 → 1.18.0.

How we use it

Axios usage in this repo is limited to plain GET requests with a static
params object and two static headers — no proxy config, no custom
Authorization header, no redirects to a different origin, no
paramsSerializer, no malformed URLs:

File	Call	Notes
src/forge.ts:47	axios.get('https://s3.amazonaws.com/puppet-pdk/pdk/LATEST', {...})	runtime — PDK version check. Well-formed URL, no auth header, same-origin (no redirect expected).
src/forge.ts:69	axios.get('https://forgeapi.puppet.com/v3/modules/${title}', {...})	runtime — Forge module info lookup. Same pattern.
src/forge.ts:118	axios.get('https://forgeapi.puppet.com/private/modules?starts_with=${text}', {...})	runtime — Forge module-name completion. Same pattern.
src/feature/PuppetfileHoverFeature.ts:1	// const axios = require('axios');	commented out — no live usage; imports getModuleInfo from forge.ts instead.
src/test/suite/links.test.ts:2,12,23	axios.get(link)	test-only — validates that URLs listed in package.json (jsonValidation, extension metadata) return HTTP 200. Plain GETs, no headers/auth.

None of these call sites:

• send a custom Authorization/API-key header that the v1.18.0 redirect
  hardening would strip (they send only Content-Type and User-Agent,
  which are not treated as sensitive by that change),
• rely on the previously-lax malformed-URL parsing (all URLs are
  well-formed literals or simple template-interpolated paths/query
  strings),
• configure a proxy or custom paramsSerializer that the prototype-
  pollution-guard changes in 1.17.0/1.18.0 could affect (params is
  always a plain literal object).

Action items / risks

• No action needed. The bump is lockfile-only, within the existing
  package.json semver range, and none of the hardened/changed behavior
  in 1.17.0–1.18.0 touches how this repo calls axios.
• No dependency-cohort issue: the only sibling packages touched
  (agent-base, debug, https-proxy-agent, ms) keep their existing
  versions and are just reclassified from dev-only to prod in the lock
  graph (a side effect of axios now depending on https-proxy-agent
  directly) — nothing left "behind" at a stale version.

References

• https://github.com/axios/axios/releases/tag/v1.17.0
• https://github.com/axios/axios/releases/tag/v1.18.0
• https://github.com/axios/axios/blob/v1.x/CHANGELOG.md

[eng-cve-remediation-app]

🚨 fix-ci circuit open — a fix attempt made no progress. The bot has stopped auto-fixing CI on this PR; it needs a human.