fix(deps): bump axios to 1.19.0 to resolve GHSA-35jp-ww65-95wh

[katsugtgz]

Summary

Bumps axios from 1.13.6 (resolved) to 1.19.0.

Cleared advisories (28)

All of the following were detected by osv-scanner before the patch and resolved after:

• GHSA-35jp-ww65-95wh (CVSS 8.7) — Prototype Pollution gadget: MITM via config.proxy
• GHSA-3g43-6gmg-66jw (CVSS 7.0) — Credential theft via Prototype Pollution gadget in transformResponse
• GHSA-p92q-9vqr-4j8v (CVSS 8.2) — Prototype Pollution in headers
• GHSA-62hf-57xw-28j9 (CVSS 7.5) — Server-Side Request Forgery
• GHSA-777c-7fjr-54vf (CVSS 7.5) — Redirect to file URL
• GHSA-hfxv-24rg-xrqf (CVSS 7.5) — CSRF via cookie leakage
• GHSA-j5f8-grm9-p9fc (CVSS 7.5) — Authorization header exposure on redirect
• GHSA-fvcv-3m26-pcqx (CVSS 4.8) — Header injection via PP
• GHSA-6chq-wfr3-2hj9 (CVSS 7.4) — Open redirect
• GHSA-pf86-5x62-jrwf (CVSS 7.4) — Response splitting
• GHSA-pmwg-cvhr-8vh7 (CVSS 7.2) — Unsafe file descriptor
• GHSA-m7pr-hjqh-92cm (CVSS 6.8) — Dangling promise
• GHSA-3w6x-2g7m-8v23 (CVSS 6.5)
• GHSA-3p68-rc4w-qgx5 (CVSS 6.3), GHSA-42h9-826w-cgv3, GHSA-445q-vr5w-6q77, GHSA-5c9x-8gcm-mpgx, GHSA-7q8q-rj6j-mhjq, GHSA-jqh4-m9w3-8hp9, GHSA-mmx7-hfxf-jppx, GHSA-mwf2-3pr3-8698, GHSA-pmv8-rq9r-6j72, GHSA-vf2m-468p-8v99
• GHSA-xx6v-rp6x-q39c (CVSS 5.4)
• GHSA-898c-q2cr-xwhg, GHSA-w9j2-pvgh-6h63 (CVSS 4.8)
• GHSA-xhjh-pmcv-23jw (CVSS 3.7)

Remaining advisories (41, unrelated to axios)

osv-scanner still reports vulnerabilities in other packages: immutable, brace-expansion, echarts, flatted, js-yaml, mockjs, picomatch, postcss, react-router, shell-quote, socket.io-parser, vite, ws, yaml, and babel-related dev dependencies. These are outside the scope of this patch.

Changes

• package.json: "axios": "^1.7.9" → "axios": "^1.19.0"
• package-lock.json: resolved axios 1.19.0

Verification

• osv-scanner before: 28 axios advisories detected
• osv-scanner after: 0 axios advisories
• Diff scope: package manifest and lockfile only