[mkaand]

Security finding

axios was locked at 1.18.1, within the advisory-affected <1.20.0 range reported by npm audit (including high-severity ReDoS, SSRF/proxy-control, and prototype-pollution advisories). Although declared as a development dependency, it is imported by resources/js/bootstrap.js and bundled into the production Vite asset.

Change

• Update direct Axios constraint and lockfile to 1.20.0.
• Accept only the package-required transitive form-data range update (^4.0.5 → ^4.0.6).
• No application code, framework, provider, Share/Save, OPFS, Docker base image, or runtime behavior change.
• No major upgrade.

Audit status

• Before: npm audit reported 1 direct Axios vulnerability group (high overall); production-only audit was clean.
• After: npm audit reports 0 vulnerabilities.
• Composer audit and pip-audit are clean.

Validation

• 102 JavaScript tests
• npm audit
• Vite build and icon validation
• Composer validate/audit
• pip-audit

No production deployment is included.