Remediate 9 CVEs in axios-1.16.0.tgz by bumping axios

[eng-cve-remediation-app]

This PR contains the following updates:

Package	Type	Update	Change
axios	dependencies	security	1.16.0 → 1.18.0

axios:axios-1.16.0.tgz is not declared by this repo. It arrives through axios, which is — so the fix is to bump that, not to pin axios:axios-1.16.0.tgz directly.

Carried library	Change
axios:axios-1.16.0.tgz	1.16.0 → 1.18.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	8.2	CVE-2026-67320
Medium	5.8	CVE-2026-67317
Medium	5.3	CVE-2026-67312
Medium	5.8	CVE-2026-67318
Medium	4.0	CVE-2026-67319
Medium	5.3	CVE-2026-67321
Medium	5.8	CVE-2026-67315
Medium	5.3	CVE-2026-67313
Medium	6.5	CVE-2026-67314

---

Bump strategy

axios 1.16.0 → 1.18.0

• Direct dependency in package.json (dependencies.axios), not transitive.
• Bumped the lower bound of the existing range from >= 1.15.0 < 2.0.0 to
  >= 1.18.0 < 2.0.0, preserving the repo's existing range-style convention
  (matches prior axios bump entries in CHANGELOG.md, e.g. CAT-2273/CAT-2021).
• Re-locked with npm install axios@1.18.0 --package-lock-only to pin the
  resolved version exactly at fix_version (not floating to any newer 1.x
  release), then a follow-up npm install --package-lock-only to sync the
  lockfile's root packages[""].dependencies.axios entry back to the
  range-style spec after npm's first install rewrote it to caret syntax.
• Verified node_modules/axios in package-lock.json now resolves to
  1.18.0.
• No changelog entry added: CHANGELOG.md here is auto-generated per release
  from merged PR metadata (PR number + author), which isn't available before
  this PR merges; adding a fabricated PR link would misrepresent the file's
  own convention.

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Report: axios 1.16.0 → 1.18.0 (CAT-2744)

Summary

Mend bumped axios from 1.16.0 to 1.18.0 to remediate 9 CVEs
(CVE-2026-67320 and 8 others, HIGH/MEDIUM severity). The diff is
lockfile-only (package-lock.json) — package.json already pins
axios with a range (">= 1.15.0 < 2.0.0", package.json:669), so no manifest edit was needed.
Reviewed release notes for axios 1.16.1, 1.17.0, and 1.18.0 (upstream
publishes no release-notes.md/CHANGELOG artifact in the Mend PR body,
so this was sourced from GitHub). No breaking changes were found in
the stable public API; all notable changes are security hardening,
bug fixes, or opt-in/additive features. Verdict: not breaking.

Upstream changes (1.16.1 → 1.18.0)

Version	Date	Notable changes
1.16.1	2026-05-13	Security: prototype-pollution defense in formDataToJSON; fixed HTTPS-over-cleartext leak to HTTP proxies. Bug fixes: RFC 2397 data-URI parsing, unicode header preservation, XHR upload progress, webpack 4 fetch-adapter compat.
1.17.0	2026-06-01/03	Security: config/adapter paths hardened to read only own properties with null-prototype objects (blocks polluted auth/baseURL/socketPath/beforeRedirect/insecureHTTPParser from prototype chain). New opt-in allowedSocketPaths config to restrict UNIX socket paths. New opt-in zstd response decompression (transitional.advertiseZstdAcceptEncoding). Bug fixes: Basic-auth restored on same-origin redirects, HTTPS-proxy TLS option preservation, RN FormData Content-Type, empty header-name handling. Minor: AxiosHeaders.toJSON() / isCancel TS type corrections, smaller published package (files allowlist).
1.18.0	2026-06-13	Security: Node HTTP adapter now strips sensitive headers on cross-origin redirects (prevents credential leakage — this is the CVE fix). URL hardening: rejects malformed http:/https: URLs missing // with ERR_INVALID_URL (previously such URLs may have been silently mis-parsed). Bug fix: new transitional.validateStatusUndefinedResolves option lets validateStatus: undefined behave as "option omitted" (opt-in; validateStatus: null remains the explicit accept-all). Plus prototype-pollution-safe config reads, stream/FormData/data-URL size limits, local-proxy-matching fixes.

No maintainer changelog entry across these three releases is flagged as
"BREAKING" — all are described as security hardening, bug fixes, or
additive/opt-in features.

Lockfile side-effect worth noting

The diff also flips agent-base@6.0.2, debug@4.3.4, https-proxy-agent@5.0.1,
and ms@2.1.2 from "dev": true to production dependencies, because
axios 1.18.0 now declares https-proxy-agent@^5.0.1 as a runtime
dependency (package-lock.json diff lines 26-29). This slightly grows
the shipped production dependency tree but doesn't change any API this
repo calls — informational only.

How we use it

axios is used in exactly two runtime call sites plus one test file, all
via the default export doing plain GET requests with a URL, params,
and headers — no advanced config:

• src/forge.ts:47-56 getPDKVersion — axios.get('https://s3.amazonaws.com/...')
• src/forge.ts:69-78 getModuleInfo — axios.get('https://forgeapi.puppet.com/v3/modules/${title}')
• src/forge.ts:118-127 getPuppetModuleCompletion — axios.get('https://forgeapi.puppet.com/private/modules?starts_with=${text}')
• src/feature/PuppetfileHoverFeature.ts:38 calls into getModuleInfo above (no direct axios usage)
• src/test/suite/links.test.ts:12,23 — test-only axios.get(link) link-checks against well-formed, hardcoded HTTPS URLs

Checked against each 1.17.0/1.18.0 change:

Change	Repo impact
Strips sensitive headers on cross-origin redirects (1.18.0)	Not affected — this repo doesn't set custom auth headers expected to survive a redirect; the only header sent is a static User-Agent/Content-Type, and none of the called URLs redirect cross-origin. Pure security improvement.
Malformed URL rejection, missing // (1.18.0)	Not affected — all URLs are hardcoded, well-formed https://... literals or simple template-string concatenations (https://forgeapi.puppet.com/v3/modules/${title}); none can produce a scheme without //.
transitional.validateStatusUndefinedResolves (1.18.0)	Not used — repo never sets validateStatus; grep for validateStatus across src/ found no matches. Default behavior unchanged unless opted in.
Own-property/null-prototype config hardening (1.17.0)	Not affected — config objects passed (params, headers) are plain object literals with only own, enumerable properties.
allowedSocketPaths, zstd decompression (1.17.0)	Both opt-in/additive; not referenced anywhere in src/ (grep for socketPath, proxy found no matches).
AxiosHeaders.toJSON() / isCancel type corrections (1.17.0)	Not used — repo never calls .toJSON() on headers or axios.isCancel.

Action items / risks

No action needed. The bump is lockfile-only, package.json's existing
range (>= 1.15.0 < 2.0.0) already permits 1.18.0, and none of the
documented changes touch how this repo calls axios. The promotion of
agent-base/debug/https-proxy-agent/ms from dev-only to production
dependencies is a minor, expected side effect of axios's own dependency
graph and requires no follow-up.

References

• axios GitHub Releases
• axios v1.18.0 release notes
• axios v1.x CHANGELOG.md

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.77%. Comparing base (0170a8c) to head (5d8b661).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #948   +/-   ##
=======================================
  Coverage   77.77%   77.77%           
=======================================
  Files           1        1           
  Lines           9        9           
=======================================
  Hits            7        7           
  Misses          2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[eng-cve-remediation-app]

The fix-ci agent made no change this run while CI is red. The reconcile sweep will escalate this PR to a human rather than retry.

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog / Impact Report — axios 1.16.0 → 1.18.0

Summary

This is a lockfile-only bump of axios from 1.16.0 to 1.18.0, remediating 9 CVEs (CAT-2744), plus transitive bumps of form-data (4.0.5→4.0.6) and hasown (2.0.2→2.0.4). No manifest change was needed — package.json already declares "axios": ">= 1.15.0 < 2.0.0". Verdict: not breaking. Upstream release notes for 1.16.1/1.17.0/1.18.0 are all security hardening + additive features; nothing removed or changed in a way that affects this repo's usage (simple axios.get() calls with params/headers, no proxy/redirect/validateStatus/adapter customization).

Upstream changes, by version

Axios does not publish structured release notes for this range in a way the bump workflow could extract (/tmp/release-notes.md was empty), so this is from the project's CHANGELOG.md and GitHub release page.

Version	Date	Type	Notable changes
1.16.0 (current)	2026-05-02	baseline	Fetch adapter enforces maxBodyLength/maxContentLength; proxy Host header preservation; URL-decode Basic-auth creds in URLs; parseProtocol stricter; new QUERY HTTP method; ECONNREFUSED exposed on AxiosError; encode export from buildURL
1.16.1	2026-05-13	security patch	Defence-in-depth hardening of formDataToJSON against prototype pollution; fixed HTTPS→HTTP-proxy cleartext data leak; fromDataURI regex tightened to RFC 2397; preserved Unicode header values through interceptors; restored Webpack 4 fetch-adapter compat; reverted URL-object support as config.url (regression revert, not new break)
1.17.0	2026-06-01	security + features	Config hardening against prototype pollution via socketPath/params/paramsSerializer; npm staged publishing w/ provenance; Node zstd decompression support (opt-in via transitional.advertiseZstdAcceptEncoding); restored same-origin Basic auth on Node redirects while still stripping cross-origin; preserved user httpsAgent TLS options through proxy tunneling; fixed React Native FormData Content-Type handling; empty/whitespace header names now silently skipped instead of throwing; AxiosHeaders.toJSON() return-type fix
1.18.0 (target)	2026-06-13	security	Node HTTP adapter strips caller-specified sensitive headers on cross-origin redirects; malformed HTTP/HTTPS URLs missing // now rejected with ERR_INVALID_URL; additional prototype-pollution/stream-size/FormData-depth/data-URL-size/proxy-matching hardening; new transitional.validateStatusUndefinedResolves option (opt-in, additive — validateStatus: null still the way to accept all statuses); dependency/tooling maintenance only otherwise

No version in this range documents a breaking change to stable public API. The closest thing to a behavior change that could theoretically bite a caller is the 1.18.0 URL-hardening rejecting malformed URLs that lack // — but that only affects callers passing already-invalid URLs, and 1.16.1 already reverted an unrelated URL-parsing regression from the same area, suggesting the axios team is treating this surface carefully.

How we use it

axios is a genuine runtime dependency here, not just a transitive pull-in.

• src/forge.ts:2,47,69,118 — three call sites, all axios.get(url, { params: { exclude_fields }, headers: { 'Content-Type', 'User-Agent' } }) against s3.amazonaws.com and forgeapi.puppet.com. Plain well-formed https:// URLs, no proxy config, no custom validateStatus, no redirect/adapter/agent options, no FormData usage.
• src/test/suite/links.test.ts:2,12,23 — test-only, axios.get(link) to validate doc links resolve. Same shape: plain GET, well-formed URL, default options.
• src/feature/PuppetfileHoverFeature.ts:1 — a commented-out require('axios'), not live code.

None of the call sites touch the surfaces that changed across 1.16.0→1.18.0 (proxy tunneling, redirect header stripping, validateStatus, FormData depth, data URLs, zstd). All URLs used are well-formed, so the new ERR_INVALID_URL strictness in 1.18.0 does not apply.

Transitive lockfile churn (from the diff)

• form-data 4.0.5 → 4.0.6, hasown 2.0.2 → 2.0.4 — indirect deps of form-data/axios; patch bumps, no code in this repo references either directly.
• agent-base, debug, https-proxy-agent, ms lost their "dev": true lockfile marker because axios 1.18.0 added https-proxy-agent@^5.0.1 as a direct (non-dev) dependency — these packages already existed in the lockfile as devDependencies of something else, and npm merged them into the production dependency graph. This is expected lockfile bookkeeping from the version bump, not a code change; nothing in this repo imports https-proxy-agent/agent-base directly.

Action items / risks

No action needed. The bump is lockfile-only (no package.json change required, since the existing range >= 1.15.0 < 2.0.0 already permits 1.18.0), the repo's axios usage doesn't touch any of the changed/hardened surfaces, and no breaking change is documented across 1.16.1, 1.17.0, or 1.18.0.

References

• axios/axios CHANGELOG.md (v1.x branch)
• axios v1.18.0 release
• src/forge.ts, src/test/suite/links.test.ts (this repo's axios call sites)

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Report: axios 1.16.0 → 1.18.0

Summary

Mend bump CAT-2744 upgrades axios from 1.16.0 → 1.18.0 to remediate 9 CVEs
(1 HIGH, 8 MEDIUM — SSRF/prototype-pollution/header-leak/URL-parsing class issues,
see unit.json). The diff only touches package-lock.json (the manifest range
>= 1.15.0 < 2.0.0 in package.json:669 already permits 1.18.0). Verdict: not
breaking. Reviewed both intermediate releases (1.17.0, 1.18.0); no maintainer
"BREAKING" callouts, no public API removed/changed, and this repo's axios usage is
too simple to be touched by anything upstream changed.

Upstream changes

Upstream doesn't publish notes in a Mend-extractable form (/tmp/release-notes.md
was empty); reviewed the official GitHub changelog/releases instead.

v1.17.0 (2026-06-01)

Change	Type
Guarded socketPath, params, paramsSerializer reads against prototype pollution / SSRF	Security fix
Switched to npm staged publishing (provenance)	Infra
Node HTTP zstd response decompression (transitional.advertiseZstdAcceptEncoding)	Additive feature
Restored Basic auth on same-origin Node redirects (still stripped cross-origin)	Bug fix
Preserved httpsAgent TLS options when tunneling through HTTP CONNECT proxies	Bug fix
Cleared default Content-Type for React Native FormData	Bug fix
Skip empty/whitespace header names instead of throwing	Bug fix
Preserved enumerable symbol keys when cloning request data	Bug fix
resolveConfig changed from arrow default export to named function export	Type/interop change
Fixed AxiosHeaders.toJSON() return type, CJS isCancel typings	Type fix
Added https-proxy-agent as a new runtime dependency (^5.0.1)	Dependency addition

v1.18.0 (2026-06-13)

Change	Type
Strip caller-supplied sensitive headers (e.g. custom auth/API-key headers) on cross-origin redirects	Security fix (behavioral)
Reject malformed http:/https: URLs missing // with ERR_INVALID_URL	Security fix (stricter validation)
Tightened prototype-pollution-safe config reads, stream size limits, FormData depth handling, data-URL sizing, local NO_PROXY matching	Security hardening
New opt-in transitional.validateStatusUndefinedResolves (treat validateStatus: undefined like omitted; validateStatus: null still means "accept everything")	Additive, opt-in

No release in this range carries an explicit "BREAKING" / "⚠️" callout, no public
class/method/export was removed, and no existing API gained a new required
parameter. The two behavioral security fixes (header stripping on cross-origin
redirect, stricter URL validation) are corrective/security-motivated rather than
maintainer-flagged breaking changes, per the classification rules for this audit.

How we use it

Only one file in this repo calls axios: src/forge.ts (3 call
sites, all structurally identical):

• src/forge.ts:47 — axios.get('https://s3.amazonaws.com/puppet-pdk/pdk/LATEST', { params, headers })
• src/forge.ts:69 — axios.get(\https://forgeapi.puppet.com/v3/modules/${title}\`, { params, headers })`
• src/forge.ts:118 — axios.get(\https://forgeapi.puppet.com/private/modules?starts_with=${text}\`, { params, headers })`

All three:

• Use plain string literal HTTPS URLs (no user-controlled scheme, no malformed
  URLs) → unaffected by the stricter ERR_INVALID_URL check in 1.18.0.
• Set only Content-Type and User-Agent headers, no auth/API-key headers, and
  none of the endpoints redirect cross-origin → unaffected by the 1.18.0
  redirect-header-stripping change.
• Don't set validateStatus, don't use Basic auth in the URL, don't configure a
  proxy or custom httpsAgent, don't import resolveConfig or AxiosHeaders
  directly → unaffected by the 1.17.0 fixes/type changes.
• Run in the extension's Node.js host process (not a browser/React Native
  context) → the FormData/React-Native-specific fixes don't apply.

src/feature/PuppetfileHoverFeature.ts:1
has a commented-out require('axios') — dead code, not a real call site.

package.json:669 pins axios only as an engines-style semver range
(>= 1.15.0 < 2.0.0), not further constrained — no manifest edit was needed for
this bump, matching what's in the diff.

New transitive dependency (https-proxy-agent): axios 1.17.0+ added
https-proxy-agent@^5.0.1 as a normal (non-dev) dependency, which is why
package-lock.json also flips agent-base, debug, https-proxy-agent, and
ms from "dev": true to real dependencies — these were already present in the
lockfile (pulled in by dev tooling) and now also serve axios's production
dependency chain. Versions are consistent across the tree (agent-base@6.0.2,
debug@4.3.4, https-proxy-agent@5.0.1, ms@2.1.2) — no split cohort, no
version mismatch to flag.

Action items / risks

No action needed. This repo's axios usage is limited to simple unauthenticated
GET requests with no proxy/redirect/validateStatus customization, so none of
the 1.17.0/1.18.0 changes affect runtime behavior here. The manifest range
already covers 1.18.0, and the new transitive dependency addition
(https-proxy-agent) resolves cleanly with matching versions throughout the
lockfile.

References

• axios releases
• axios CHANGELOG.md (v1.x branch)
• Compare v1.17.0...v1.18.0
• axios 1.16.0 on npm
• axios 1.18.0 on npm

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Impact Report: axios 1.16.0 → 1.18.0

Summary

This bump upgrades axios from 1.16.0 to 1.18.0 to remediate 9 CVEs
(1 HIGH, 8 MEDIUM) tracked under Jira CAT-2744. The change is
lockfile-only — package.json already declares "axios": ">= 1.15.0 < 2.0.0", so no manifest edit was needed. Reviewing all intermediate
releases (1.16.1, 1.17.0, 1.18.0), I found no breaking changes called
out by the maintainers, and this repo's three call sites use only
basic, stable axios.get(url, config).then().catch() calls that are
unaffected. Verdict: not breaking — safe to auto-merge.

The diff

bump-diff.txt only touches package-lock.json:

• axios: 1.16.0 → 1.18.0, gaining a new direct dependency on
  https-proxy-agent@^5.0.1.
• agent-base@6.0.2, debug@4.3.4, https-proxy-agent@5.0.1, ms@2.1.2
  lose their "dev": true flag — expected side effect of npm's resolver
  now needing them for the production dependency graph (via axios's new
  https-proxy-agent dependency), not a separate change to review.
• package.json is unchanged; the existing >= 1.15.0 < 2.0.0 range
  already permits 1.18.0.

Upstream changes (1.16.0 → 1.18.0)

release-notes.md was empty for this PR, so this is from axios's
GitHub CHANGELOG.md and the v1.18.0 release notes.

Version	Date	Breaking?	Notable changes
1.16.1	2026-05-13	No	Hardened formDataToJSON against prototype pollution; fixed HTTPS request data leaking in cleartext to HTTP proxies; stricter fromDataURI RFC 2397 regex; preserved Unicode header values; guarded malformed XHR ProgressEvent payloads; reverted experimental URL-object support for config.url.
1.17.0	2026-06-01	No (explicitly)	Added zstd response decompression for the Node HTTP adapter (opt-in via transitional.advertiseZstdAcceptEncoding); HTTP/2 session handling improvements; restored Basic auth on same-origin Node redirects while still stripping creds cross-origin; fixed proxy TLS tunneling; empty/whitespace header names now skipped instead of throwing; resolveConfig's default export changed to a named export (only relevant to consumers importing resolveConfig directly — this repo does not).
1.18.0	2026-06-13	No (explicitly)	Security: Node HTTP adapter now strips sensitive headers (e.g. API keys) on cross-origin redirects; malformed http(s): URLs missing // now rejected with ERR_INVALID_URL; further prototype-pollution, stream-size, FormData-depth, and data-URL-size hardening. Bug fix: new transitional.validateStatusUndefinedResolves option to treat validateStatus: undefined as "omitted" (additive/opt-in).

None of the three releases has a maintainer-labeled "BREAKING" or
migration-guide entry. The security fixes tighten previously-insecure
behavior (credential leakage on redirect, prototype pollution, cleartext
proxy transmission) rather than changing stable public API surface —
per the breaking-change rubric, hardening fixes like this don't count
as breaking unless the changelog itself calls them out that way, which
it doesn't here.

How we use it

Three files reference axios, all runtime GET calls with plain
params/headers config and .then()/.catch() handling — none touch
any of the changed surface above:

• src/forge.ts:2,47-64,69-113,118-140 — getPDKVersion, getModuleInfo,
  getPuppetModuleCompletion each call axios.get(url, { params, headers }) against static, well-formed HTTPS URLs
  (s3.amazonaws.com, forgeapi.puppet.com). No proxy config, no
  resolveConfig import, no custom validateStatus, no redirects across
  origins.
• src/test/suite/links.test.ts:2,12,23 — test-only axios.get(link)
  calls used to validate documentation links resolve.
• src/feature/PuppetfileHoverFeature.ts:1 — a commented-out
  require('axios'); dead code, not active usage.

None of these call sites are affected by:

• The resolveConfig named-export change (not imported here).
• Cross-origin redirect header stripping (all URLs are fixed, same-origin
  per call, no redirect chains expected).
• The stricter malformed-URL rejection (all URLs are static, well-formed
  literals).
• zstd decompression / HTTP2 changes (opt-in, adapter-internal).

Action items / risks

No action needed. This is a lockfile-only security bump; package.json's
existing range already covers 1.18.0, all changed dependencies are
consistent (no split cohort — axios and its new https-proxy-agent
dependency are aligned at compatible versions), and none of the three
runtime call sites touch the changed/hardened surface.

References

• axios CHANGELOG.md (v1.x branch)
• axios v1.18.0 release
• axios v1.17.0...v1.18.0 compare

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Impact Report: axios 1.16.0 → 1.18.0

Summary

Mend flagged 9 CVEs (1 HIGH, 8 MEDIUM) in axios@1.16.0 (CAT-2744), fixed in 1.18.0. The bump diff upgrades axios in package.json/package-lock.json from a loose >= 1.15.0 < 2.0.0 range to ^1.18.0, and promotes https-proxy-agent (plus its transitive deps agent-base, debug, ms) from dev-only to a production dependency of axios. Verdict: not breaking. All upstream changes between 1.16.0 and 1.18.0 are security hardening and bug fixes; none are flagged by the maintainers as breaking, and none touch the narrow way this repo calls axios.

Upstream changes (1.16.1 → 1.18.0)

Release notes were not embedded in the PR (/tmp/release-notes.md was empty), so this is sourced from the axios GitHub changelog/releases.

Version	Type	Notable changes
1.16.1	Security + fixes	Prototype-pollution hardening in formDataToJSON; fixed HTTPS→HTTP proxy cleartext leak; RFC 2397 data-URI parsing fix; Unicode header preservation; Webpack 4 fetch adapter fix; reverted URL-object config.url support (regression fix)
1.17.0	Security + features	Own-property hardening for socketPath/params/paramsSerializer (SSRF defense); added Node zstd decompression + transitional.advertiseZstdAcceptEncoding; Basic-auth-in-URL now stripped on cross-origin redirects (kept on same-origin); preserved httpsAgent TLS options through proxy tunneling; empty/whitespace header names now silently skipped instead of throwing; resolveConfig changed from default export to named export; AxiosHeaders.toJSON() return-type correction
1.18.0	Security + fixes	Strips sensitive headers on cross-origin redirects (Node HTTP adapter); rejects malformed http(s): URLs missing // with ERR_INVALID_URL; further prototype-pollution/stream-size/FormData-depth hardening; added opt-in transitional.validateStatusUndefinedResolves config

No release in this range carries an explicit "BREAKING" callout. The only items with any theoretical compatibility edge are:

• resolveConfig export style change (default → named) — only affects code importing that internal helper directly.
• Basic-auth-in-URL stripped on cross-origin redirects — a security fix (part of the CVE set), changes behavior only for callers embedding credentials in URLs and expecting them forwarded cross-origin.
• Header-name handling changed from throw → silent skip — strictly more permissive, not breaking.

How we use it

axios usage in this repo is minimal and doesn't touch any of the above surface:

• src/forge.ts:2,47,69,118 (runtime) — three plain axios.get(url, { params, headers }) calls to Puppet Forge / S3 endpoints. No paramsSerializer, socketPath, proxy, httpsAgent, validateStatus, credentials-in-URL, or resolveConfig usage.
• src/test/suite/links.test.ts:2,12,23 (test-only) — simple axios.get(link) calls to validate links; same minimal surface.
• src/feature/PuppetfileHoverFeature.ts:1 — a commented-out require('axios'), not active code.

None of the changed/hardened config paths (params own-property checks, proxy tunneling, Basic-auth-in-URL, header-name validation, resolveConfig export) are exercised anywhere in this repo.

Lockfile side-effect: https-proxy-agent, agent-base, debug, and ms lose their "dev": true marker because axios 1.18.0 now declares https-proxy-agent as a runtime dependency (for proxy tunneling support). This only affects dependency bookkeeping/install footprint, not code behavior — the repo doesn't invoke proxy tunneling directly.

Action items / risks

• No code changes required for this bump.
• No cohort/sibling-pin inconsistency: axios is the only package whose version changed in this diff; its new transitive dep (https-proxy-agent) and existing transitive deps were already present at matching versions, just re-flagged as production (non-dev) — no split-family pins to call out.

References

• https://github.com/axios/axios/releases/tag/v1.18.0
• https://github.com/axios/axios/releases/tag/v1.18.1
• https://github.com/axios/axios/blob/v1.x/CHANGELOG.md
• https://www.mend.io/vulnerability-database/CVE-2026-67320 (and sibling CVE-2026-673{12,13,14,15,17,18,19,21} — all CAT-2744)

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Impact Report — axios 1.16.0 → 1.18.0

Summary

This PR bumps axios from 1.16.0 to 1.18.0 in both package.json
(range >= 1.15.0 < 2.0.0 → >= 1.18.0 < 2.0.0) and package-lock.json,
fixing 9 CVEs (CAT-2744, highest CVE-2026-67320 / HIGH 8.2). No breaking
changes were found in the intermediate releases (1.16.1, 1.17.0, 1.18.0).
This repo's axios usage (src/forge.ts, src/test/suite/links.test.ts) is
limited to plain axios.get(url, { params, headers }) calls against static,
well-formed HTTPS URLs with no custom auth headers or non-default
validateStatus — none of the hardening changes in this range touch our
call sites. Verdict: not breaking; safe to auto-merge on green CI.

Upstream doesn't publish notes in a format Mend embeds (release notes file
was empty), so this assessment is built from axios/CHANGELOG.md (v1.x
branch) and the GitHub Releases pages for each intermediate version.

Upstream changes (1.16.0 → 1.18.0)

Version	Type	Highlights
1.16.1	patch	Prototype-pollution defense in formDataToJSON; proxy cleartext-leak prevention for HTTPS; RFC 2397 data-URI parsing fix; Unicode header preservation through interceptors; reverted support for passing a URL object as config.url (was added earlier, caused regressions)
1.17.0	minor	Config hardening: socketPath/params/paramsSerializer reads now use own-property checks (SSRF-hardening, internal); Node HTTP adapter zstd decompression support (additive, opt-in via transitional.advertiseZstdAcceptEncoding); fixed Basic-auth on same-origin redirects, proxy TLS option preservation through CONNECT tunnels, React Native FormData Content-Type handling, header-name validation, AxiosHeaders.toJSON() typings
1.18.0	minor	Security: Node HTTP adapter now strips caller-set sensitive headers (e.g. Authorization) on cross-origin redirects; rejects malformed http:/https: URLs missing // with ERR_INVALID_URL; tightened prototype-pollution-safe config reads, stream size limits, FormData depth, data-URL size, local NO_PROXY matching. New (opt-in): transitional.validateStatusUndefinedResolves config flag

No release in this range carries an explicit "BREAKING"/⚠️ callout from the
maintainers. I specifically checked for a widely-repeated claim (surfaced by
one search summary) that 1.17.0 made merged config/header objects
null-prototype as a breaking change — verified against the raw CHANGELOG
that this null-prototype hardening actually shipped in 1.15.2, which is
before our current_version (1.16.0), so it's not part of this diff and
is a non-issue either way.

The two security-relevant behavioral changes worth reviewer awareness even
though they don't require code changes here:

• 1.18.0 cross-origin redirect header stripping — if any caller relied
  on custom sensitive headers surviving a cross-origin redirect, that now
  stops working (this is the fix, not a regression).
• 1.18.0 malformed-URL rejection — a URL like https:/example.com
  (single slash) that previously "worked" now throws ERR_INVALID_URL.

How we use it

Axios usage in this repo, from Grep:

File	Scope	Usage
src/forge.ts:47-64 (getPDKVersion)	runtime	axios.get('https://s3.amazonaws.com/puppet-pdk/pdk/LATEST', { params, headers }) — static well-formed URL, headers are Content-Type/User-Agent only
src/forge.ts:69-113 (getModuleInfo)	runtime	axios.get('https://forgeapi.puppet.com/v3/modules/${title}', { params, headers }) — same pattern
src/forge.ts:118-147 (getPuppetModuleCompletion)	runtime	axios.get('https://forgeapi.puppet.com/private/modules?...', { params, headers }) — same pattern
src/feature/PuppetfileHoverFeature.ts:1	runtime	commented-out require('axios'); actual axios calls go through forge.ts
src/test/suite/links.test.ts:2,12	test-only	axios.get(link) against static extension metadata links (PDK download, release notes, troubleshooting), asserts response.status === 200

None of these:

• pass a URL object as config.url (all string literals/template strings)
• set Authorization/cookie-style sensitive headers that would be affected
  by the 1.18.0 cross-origin redirect stripping
• use malformed URLs missing //
• set validateStatus explicitly (default behavior is unaffected by the
  new opt-in transitional.validateStatusUndefinedResolves flag)

So none of the 1.16.1/1.17.0/1.18.0 changes touch this repo's call sites.

Dependency-tree note (not breaking, but worth flagging)

The lockfile diff shows axios 1.18.0 adds https-proxy-agent@^5.0.1 as a
new direct dependency (it wasn't a dependency of axios 1.16.0 at all).
As a side effect, agent-base@6.0.2, https-proxy-agent@5.0.1, debug@4.3.4,
and ms@2.1.2 flip from "dev": true to production dependencies in
package-lock.json. This is normal npm install lockfile bookkeeping (they
were already present as dev-only deps and are now also required at runtime
via axios's proxy support) — not an API break, just a slightly larger
production dependency graph.

Action items / risks

• No code changes required. Safe to proceed on green CI.
• Nothing to flag re: cohort/matched-set siblings — this diff only touches
  the single axios package (manifest + lockfile), no sibling packages in
  the same family were left behind.
• Reviewers relying on custom auth headers surviving redirects to another
  origin (not the case here) should re-test after upgrading past 1.18.0.

References

• axios CHANGELOG.md (v1.x branch)
• axios v1.17.0 release
• axios v1.18.0 release
• CVE-2026-67320 advisory

[eng-cve-remediation-app]

🚨 fix-ci circuit open — a fix attempt made no progress. The bot has stopped auto-fixing CI on this PR; it needs a human.