fix(deps): vuln axios (minor → 1.20.0) [example/package.json]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 1 package upgraded (MINOR changes included)

Manifests changed:

• example/package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
axios	1.16.0	1.20.0	minor	Direct	2 HIGH, 18 MEDIUM

---

Security Details

🚨 Critical & High Severity (2 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
axios	GHSA-gcfj-64vw-6mp9	HIGH	Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning	1.16.0	0.33.0	-
axios	CVE-2026-67320	HIGH	axios before 0.33.0 Prototype Pollution via Node HTTP adapter	1.16.0	-	-

ℹ️ Other Vulnerabilities (18)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
axios	GHSA-mmx7-hfxf-jppx	MODERATE	Axios: Prototype pollution gadgets can alter axios request construction	1.16.0	1.18.0	-
axios	CVE-2026-67316	MODERATE	axios before 1.18.0 Prototype Pollution via bodyless methods	1.16.0	-	-
axios	GHSA-f4gw-2p7v-4548	MODERATE	Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios	1.16.0	1.18.0	-
axios	CVE-2026-67315	MODERATE	axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0	1.16.0	-	-
axios	GHSA-pmv8-rq9r-6j72	MODERATE	Axios: Deep formToJSON Key Recursion Can Cause Denial of Service	1.16.0	0.33.0	-
axios	CVE-2026-67312	MODERATE	axios 0.28.0 before 0.33.0 Denial of Service via formToJSON	1.16.0	-	-
axios	GHSA-mwf2-3pr3-8698	MODERATE	Axios: HTTP/2 streamed uploads bypass maxBodyLength	1.16.0	1.18.0	-
axios	CVE-2026-67318	MODERATE	axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2	1.16.0	-	-
axios	GHSA-jqh4-m9w3-8hp9	MODERATE	Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength	1.16.0	1.18.0	-
axios	CVE-2026-67319	MODERATE	axios before 0.33.0 Prototype Pollution via nested option objects	1.16.0	-	-
axios	GHSA-7q8q-rj6j-mhjq	MODERATE	Axios: Nested axios option objects can consume polluted prototype values	1.16.0	0.33.0	-
axios	CVE-2026-67317	MODERATE	axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream	1.16.0	-	-
axios	GHSA-xj6q-8x83-jv6g	MODERATE	Axios: Prototype pollution auth subfields can inject Basic auth	1.16.0	1.18.0	-
axios	CVE-2026-67314	MODERATE	axios before 1.18.0 Prototype Pollution via auth subfields	1.16.0	-	-
axios	GHSA-hcpx-6fm6-wx23	MODERATE	Axios form serializer maxDepth bypass via {} metatoken	1.16.0	0.33.0	-
axios	CVE-2026-67321	MODERATE	axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass	1.16.0	-	-
axios	GHSA-42h9-826w-cgv3	MODERATE	Axios: Excessive recursion in formDataToJSON can cause denial of service	1.16.0	0.33.0	-
axios	CVE-2026-67313	MODERATE	axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON	1.16.0	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[Copilot]

Pull request overview

This PR aims to remediate reported axios vulnerabilities by upgrading the example/ workspace’s direct axios dependency and updating the Yarn lockfile accordingly.

Changes:

• Bump axios in example/package.json to 1.20.0.
• Update yarn.lock resolution graph (including axios and some unrelated Babel package entries).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
example/package.json	Updates the example app’s direct axios dependency version.
yarn.lock	Updates lockfile entries, including the example workspace dependency list and other resolved packages.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with develop — rebased onto 9a5e2a4.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.