chore: bump axios 16.1#30815
Conversation
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
🔍 Smart E2E Test Selection
click to see 🤖 AI reasoning detailsE2E Test Selection: No application code was changed — this is purely a dependency update. Axios is used in the following areas of the app:
Since this is a minor version bump (semver-compatible), the risk of behavioral regression is low. However, to validate that the HTTP client still works correctly in the most affected user-facing flows (Card/Ramp and network checking), SmokeMoney and SmokeNetworkAbstractions are selected as targeted coverage. No performance tests are needed as this is a library version bump with no UI or rendering changes. Performance Test Selection: |
Description
Fix audit issue: GHSA-35jp-ww65-95wh
Changelog
CHANGELOG entry:
Related issues
Fixes:
Manual testing steps
Screenshots/Recordings
Before
After
Pre-merge author checklist
Performance checks (if applicable)
trace()for usage andaddTokenfor an exampleFor performance guidelines and tooling, see the Performance Guide.
Pre-merge reviewer checklist
Note
Low Risk
Dependency-only security patch with no app code changes; standard patch-level HTTP client upgrade.
Overview
Bumps axios from
^1.15.xto^1.16.0inpackage.json(direct dependency and Yarn resolutions) and refreshesyarn.lockso the tree resolves to axios 1.16.1, addressing advisory GHSA-35jp-ww65-95wh.The lockfile also picks up follow-redirects
1.16.0and axios’s updated transitive deps (e.g. https-proxy-agent). No application source changes.Reviewed by Cursor Bugbot for commit e4f36bb. Bugbot is set up for automated code reviews on this repo. Configure here.