fix(deps): bump axios to 1.20.0 to clear four advisories

[kaseywright]

Clears the four open axios advisories, all fixed in 1.18.0:

Advisory	Severity	Summary
GHSA-mmx7-hfxf-jppx	medium	Prototype pollution gadgets can alter axios request construction
GHSA-7q8q-rj6j-mhjq	medium	Nested axios option objects can consume polluted prototype values
GHSA-42h9-826w-cgv3	medium	Excessive recursion in formDataToJSON can cause denial of service
GHSA-pmv8-rq9r-6j72	medium	Deep formToJSON key recursion can cause denial of service

Why this is manual

Dependabot cannot raise it. PR #227 proposed the same bump and was closed on 2026-07-27, which registers the release as declined — Dependabot then stops offering that fix, which is why four alerts have sat open with no PR for a month. Reopening #227 is not viable either: that branch is from July, and npm PRs in this repo cannot be rebased (see #290).

Scope

axios is transitive under mailgun.js@12.0.3, which allows ^1.10.0. 1.20.0 satisfies that, so this is lockfile-only — no package.json edit, and no mailgun.js bump (14.0.0 is a major and is not needed here).

Four entries change, nothing else:

axios:          1.16.1 -> 1.20.0
es-object-atoms: 1.1.1 -> 1.1.2
form-data:       4.0.5 -> 4.0.6
hasown:          2.0.2 -> 2.0.4

The latter three are axios's own dependencies moving within their existing ranges. Zero entries added, zero removed, zero metadata-only changes.

Verified on node 24.14.0: tsc --noEmit clean, 473 tests pass across 53 files.

One thing worth knowing, beyond this PR

The lock was regenerated without --legacy-peer-deps, deliberately. That flag makes npm ignore peerDependencies entirely, so regenerating the lock with it prunes 10 peer-only vite entries (@vue/compiler-*, @babel/*, entities, estree-walker) and flips 187 devOptional→dev flags — 409 lines of churn instead of 30.

CI runs npm install --legacy-peer-deps in all five install steps. I reproduced this directly: running that command rewrote this branch's clean lockfile into the 409-line version. Because CI uses npm install rather than npm ci, it silently rewrites the lock on every run instead of failing on a mismatch — the difference just never gets committed. Not addressed here; flagging it as a separate issue.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JrPR3vYA5DwEwTiE4E2aJn

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 295e1b98-8a96-4c8a-8e6f-a7ae72989637

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}