fix(deps): vuln axios (minor → 1.19.0) [example]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 1 package upgraded (MINOR changes included)

Manifests changed:

• example (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
axios	1.16.0	1.19.0	minor	Direct	2 HIGH, 18 MEDIUM

---

Security Details

🚨 Critical & High Severity (2 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
axios	GHSA-gcfj-64vw-6mp9	HIGH	Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning	1.16.0	0.33.0	-
axios	CVE-2026-67320	HIGH	axios before 0.33.0 Prototype Pollution via Node HTTP adapter	1.16.0	-	-

ℹ️ Other Vulnerabilities (18)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
axios	GHSA-jqh4-m9w3-8hp9	MODERATE	Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength	1.16.0	1.18.0	-
axios	CVE-2026-67317	MODERATE	axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream	1.16.0	-	-
axios	GHSA-mmx7-hfxf-jppx	MODERATE	Axios: Prototype pollution gadgets can alter axios request construction	1.16.0	1.18.0	-
axios	CVE-2026-67316	MODERATE	axios before 1.18.0 Prototype Pollution via bodyless methods	1.16.0	-	-
axios	GHSA-hcpx-6fm6-wx23	MODERATE	Axios form serializer maxDepth bypass via {} metatoken	1.16.0	0.33.0	-
axios	CVE-2026-67313	MODERATE	axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON	1.16.0	-	-
axios	GHSA-pmv8-rq9r-6j72	MODERATE	Axios: Deep formToJSON Key Recursion Can Cause Denial of Service	1.16.0	0.33.0	-
axios	CVE-2026-67312	MODERATE	axios 0.28.0 before 0.33.0 Denial of Service via formToJSON	1.16.0	-	-
axios	GHSA-42h9-826w-cgv3	MODERATE	Axios: Excessive recursion in formDataToJSON can cause denial of service	1.16.0	0.33.0	-
axios	CVE-2026-67321	MODERATE	axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass	1.16.0	-	-
axios	GHSA-xj6q-8x83-jv6g	MODERATE	Axios: Prototype pollution auth subfields can inject Basic auth	1.16.0	1.18.0	-
axios	CVE-2026-67314	MODERATE	axios before 1.18.0 Prototype Pollution via auth subfields	1.16.0	-	-
axios	GHSA-mwf2-3pr3-8698	MODERATE	Axios: HTTP/2 streamed uploads bypass maxBodyLength	1.16.0	1.18.0	-
axios	CVE-2026-67318	MODERATE	axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2	1.16.0	-	-
axios	GHSA-f4gw-2p7v-4548	MODERATE	Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios	1.16.0	1.18.0	-
axios	CVE-2026-67315	MODERATE	axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0	1.16.0	-	-
axios	GHSA-7q8q-rj6j-mhjq	MODERATE	Axios: Nested axios option objects can consume polluted prototype values	1.16.0	0.33.0	-
axios	CVE-2026-67319	MODERATE	axios before 0.33.0 Prototype Pollution via nested option objects	1.16.0	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates JavaScript dependencies by bumping Axios in the example app and refreshing yarn.lock to reflect updated/merged transitive resolutions.

Changes:

• Bump axios in example/package.json from 1.15.1 to 1.19.0
• Regenerate yarn.lock, updating/deduping various transitive dependencies (notably Babel-related packages and npm CLI internals)

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
yarn.lock	Lockfile refresh to capture updated dependency graph and deduped resolutions after dependency bumps.
example/package.json	Updates the example app’s direct axios version to 1.19.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with develop — rebased onto df00559.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.