Remediate 9 CVEs in axios-1.16.0.tgz by bumping axios

[eng-cve-remediation-app]

This PR contains the following updates:

Package	Type	Update	Change
axios	dependencies	security	1.16.0 → 1.18.0

axios:axios-1.16.0.tgz is not declared by this repo. It arrives through axios, which is — so the fix is to bump that, not to pin axios:axios-1.16.0.tgz directly.

Carried library	Change
axios:axios-1.16.0.tgz	1.16.0 → 1.18.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	8.2	CVE-2026-67320
Medium	5.8	CVE-2026-67317
Medium	5.3	CVE-2026-67312
Medium	5.8	CVE-2026-67318
Medium	4.0	CVE-2026-67319
Medium	5.3	CVE-2026-67321
Medium	5.8	CVE-2026-67315
Medium	5.3	CVE-2026-67313
Medium	6.5	CVE-2026-67314

---

Bump strategy

axios is a direct dependency (declared in package.json's dependencies). The existing range >= 1.15.0 < 2.0.0 already permitted 1.18.0, but the lockfile had it pinned/resolved at the vulnerable 1.16.0. Ran npm install axios@1.18.0 --package-lock-only, which:

• Raised the manifest bound to ^1.18.0 (npm's normal behavior when installing an explicit version), still capped below 2.0.0.
• Re-resolved package-lock.json to axios 1.18.0.
• Pulled in a new transitive dependency axios 1.18.0 requires, https-proxy-agent@^5.0.1 (and its own dependency agent-base), which npm added as new lockfile entries.

No cohort/sibling packages were touched — axios has no same-group sibling artifacts pinned in this manifest. Verified with a follow-up npm install --package-lock-only, which reports "up to date" (no further changes), confirming the lockfile is internally consistent at the fix version.

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Report: axios 1.16.0 → 1.18.0 (CAT-2744)

Summary

Mend bumped axios from 1.16.0 to 1.18.0 to remediate 9 CVEs
(CVE-2026-67320 and 8 others, HIGH/MEDIUM severity). The diff is
lockfile-only (package-lock.json) — package.json already pins
axios with a range (">= 1.15.0 < 2.0.0", package.json:669), so no manifest edit was needed.
Reviewed release notes for axios 1.16.1, 1.17.0, and 1.18.0 (upstream
publishes no release-notes.md/CHANGELOG artifact in the Mend PR body,
so this was sourced from GitHub). No breaking changes were found in
the stable public API; all notable changes are security hardening,
bug fixes, or opt-in/additive features. Verdict: not breaking.

Upstream changes (1.16.1 → 1.18.0)

Version	Date	Notable changes
1.16.1	2026-05-13	Security: prototype-pollution defense in formDataToJSON; fixed HTTPS-over-cleartext leak to HTTP proxies. Bug fixes: RFC 2397 data-URI parsing, unicode header preservation, XHR upload progress, webpack 4 fetch-adapter compat.
1.17.0	2026-06-01/03	Security: config/adapter paths hardened to read only own properties with null-prototype objects (blocks polluted auth/baseURL/socketPath/beforeRedirect/insecureHTTPParser from prototype chain). New opt-in allowedSocketPaths config to restrict UNIX socket paths. New opt-in zstd response decompression (transitional.advertiseZstdAcceptEncoding). Bug fixes: Basic-auth restored on same-origin redirects, HTTPS-proxy TLS option preservation, RN FormData Content-Type, empty header-name handling. Minor: AxiosHeaders.toJSON() / isCancel TS type corrections, smaller published package (files allowlist).
1.18.0	2026-06-13	Security: Node HTTP adapter now strips sensitive headers on cross-origin redirects (prevents credential leakage — this is the CVE fix). URL hardening: rejects malformed http:/https: URLs missing // with ERR_INVALID_URL (previously such URLs may have been silently mis-parsed). Bug fix: new transitional.validateStatusUndefinedResolves option lets validateStatus: undefined behave as "option omitted" (opt-in; validateStatus: null remains the explicit accept-all). Plus prototype-pollution-safe config reads, stream/FormData/data-URL size limits, local-proxy-matching fixes.

No maintainer changelog entry across these three releases is flagged as
"BREAKING" — all are described as security hardening, bug fixes, or
additive/opt-in features.

Lockfile side-effect worth noting

The diff also flips agent-base@6.0.2, debug@4.3.4, https-proxy-agent@5.0.1,
and ms@2.1.2 from "dev": true to production dependencies, because
axios 1.18.0 now declares https-proxy-agent@^5.0.1 as a runtime
dependency (package-lock.json diff lines 26-29). This slightly grows
the shipped production dependency tree but doesn't change any API this
repo calls — informational only.

How we use it

axios is used in exactly two runtime call sites plus one test file, all
via the default export doing plain GET requests with a URL, params,
and headers — no advanced config:

• src/forge.ts:47-56 getPDKVersion — axios.get('https://s3.amazonaws.com/...')
• src/forge.ts:69-78 getModuleInfo — axios.get('https://forgeapi.puppet.com/v3/modules/${title}')
• src/forge.ts:118-127 getPuppetModuleCompletion — axios.get('https://forgeapi.puppet.com/private/modules?starts_with=${text}')
• src/feature/PuppetfileHoverFeature.ts:38 calls into getModuleInfo above (no direct axios usage)
• src/test/suite/links.test.ts:12,23 — test-only axios.get(link) link-checks against well-formed, hardcoded HTTPS URLs

Checked against each 1.17.0/1.18.0 change:

Change	Repo impact
Strips sensitive headers on cross-origin redirects (1.18.0)	Not affected — this repo doesn't set custom auth headers expected to survive a redirect; the only header sent is a static User-Agent/Content-Type, and none of the called URLs redirect cross-origin. Pure security improvement.
Malformed URL rejection, missing // (1.18.0)	Not affected — all URLs are hardcoded, well-formed https://... literals or simple template-string concatenations (https://forgeapi.puppet.com/v3/modules/${title}); none can produce a scheme without //.
transitional.validateStatusUndefinedResolves (1.18.0)	Not used — repo never sets validateStatus; grep for validateStatus across src/ found no matches. Default behavior unchanged unless opted in.
Own-property/null-prototype config hardening (1.17.0)	Not affected — config objects passed (params, headers) are plain object literals with only own, enumerable properties.
allowedSocketPaths, zstd decompression (1.17.0)	Both opt-in/additive; not referenced anywhere in src/ (grep for socketPath, proxy found no matches).
AxiosHeaders.toJSON() / isCancel type corrections (1.17.0)	Not used — repo never calls .toJSON() on headers or axios.isCancel.

Action items / risks

No action needed. The bump is lockfile-only, package.json's existing
range (>= 1.15.0 < 2.0.0) already permits 1.18.0, and none of the
documented changes touch how this repo calls axios. The promotion of
agent-base/debug/https-proxy-agent/ms from dev-only to production
dependencies is a minor, expected side effect of axios's own dependency
graph and requires no follow-up.

References

• axios GitHub Releases
• axios v1.18.0 release notes
• axios v1.x CHANGELOG.md

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.77%. Comparing base (0170a8c) to head (9feed93).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #948   +/-   ##
=======================================
  Coverage   77.77%   77.77%           
=======================================
  Files           1        1           
  Lines           9        9           
=======================================
  Hits            7        7           
  Misses          2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[eng-cve-remediation-app]

The fix-ci agent made no change this run while CI is red. The reconcile sweep will escalate this PR to a human rather than retry.

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog / Impact Report — axios 1.16.0 → 1.18.0

Summary

This is a lockfile-only bump of axios from 1.16.0 to 1.18.0, remediating 9 CVEs (CAT-2744), plus transitive bumps of form-data (4.0.5→4.0.6) and hasown (2.0.2→2.0.4). No manifest change was needed — package.json already declares "axios": ">= 1.15.0 < 2.0.0". Verdict: not breaking. Upstream release notes for 1.16.1/1.17.0/1.18.0 are all security hardening + additive features; nothing removed or changed in a way that affects this repo's usage (simple axios.get() calls with params/headers, no proxy/redirect/validateStatus/adapter customization).

Upstream changes, by version

Axios does not publish structured release notes for this range in a way the bump workflow could extract (/tmp/release-notes.md was empty), so this is from the project's CHANGELOG.md and GitHub release page.

Version	Date	Type	Notable changes
1.16.0 (current)	2026-05-02	baseline	Fetch adapter enforces maxBodyLength/maxContentLength; proxy Host header preservation; URL-decode Basic-auth creds in URLs; parseProtocol stricter; new QUERY HTTP method; ECONNREFUSED exposed on AxiosError; encode export from buildURL
1.16.1	2026-05-13	security patch	Defence-in-depth hardening of formDataToJSON against prototype pollution; fixed HTTPS→HTTP-proxy cleartext data leak; fromDataURI regex tightened to RFC 2397; preserved Unicode header values through interceptors; restored Webpack 4 fetch-adapter compat; reverted URL-object support as config.url (regression revert, not new break)
1.17.0	2026-06-01	security + features	Config hardening against prototype pollution via socketPath/params/paramsSerializer; npm staged publishing w/ provenance; Node zstd decompression support (opt-in via transitional.advertiseZstdAcceptEncoding); restored same-origin Basic auth on Node redirects while still stripping cross-origin; preserved user httpsAgent TLS options through proxy tunneling; fixed React Native FormData Content-Type handling; empty/whitespace header names now silently skipped instead of throwing; AxiosHeaders.toJSON() return-type fix
1.18.0 (target)	2026-06-13	security	Node HTTP adapter strips caller-specified sensitive headers on cross-origin redirects; malformed HTTP/HTTPS URLs missing // now rejected with ERR_INVALID_URL; additional prototype-pollution/stream-size/FormData-depth/data-URL-size/proxy-matching hardening; new transitional.validateStatusUndefinedResolves option (opt-in, additive — validateStatus: null still the way to accept all statuses); dependency/tooling maintenance only otherwise

No version in this range documents a breaking change to stable public API. The closest thing to a behavior change that could theoretically bite a caller is the 1.18.0 URL-hardening rejecting malformed URLs that lack // — but that only affects callers passing already-invalid URLs, and 1.16.1 already reverted an unrelated URL-parsing regression from the same area, suggesting the axios team is treating this surface carefully.

How we use it

axios is a genuine runtime dependency here, not just a transitive pull-in.

• src/forge.ts:2,47,69,118 — three call sites, all axios.get(url, { params: { exclude_fields }, headers: { 'Content-Type', 'User-Agent' } }) against s3.amazonaws.com and forgeapi.puppet.com. Plain well-formed https:// URLs, no proxy config, no custom validateStatus, no redirect/adapter/agent options, no FormData usage.
• src/test/suite/links.test.ts:2,12,23 — test-only, axios.get(link) to validate doc links resolve. Same shape: plain GET, well-formed URL, default options.
• src/feature/PuppetfileHoverFeature.ts:1 — a commented-out require('axios'), not live code.

None of the call sites touch the surfaces that changed across 1.16.0→1.18.0 (proxy tunneling, redirect header stripping, validateStatus, FormData depth, data URLs, zstd). All URLs used are well-formed, so the new ERR_INVALID_URL strictness in 1.18.0 does not apply.

Transitive lockfile churn (from the diff)

• form-data 4.0.5 → 4.0.6, hasown 2.0.2 → 2.0.4 — indirect deps of form-data/axios; patch bumps, no code in this repo references either directly.
• agent-base, debug, https-proxy-agent, ms lost their "dev": true lockfile marker because axios 1.18.0 added https-proxy-agent@^5.0.1 as a direct (non-dev) dependency — these packages already existed in the lockfile as devDependencies of something else, and npm merged them into the production dependency graph. This is expected lockfile bookkeeping from the version bump, not a code change; nothing in this repo imports https-proxy-agent/agent-base directly.

Action items / risks

No action needed. The bump is lockfile-only (no package.json change required, since the existing range >= 1.15.0 < 2.0.0 already permits 1.18.0), the repo's axios usage doesn't touch any of the changed/hardened surfaces, and no breaking change is documented across 1.16.1, 1.17.0, or 1.18.0.

References

• axios/axios CHANGELOG.md (v1.x branch)
• axios v1.18.0 release
• src/forge.ts, src/test/suite/links.test.ts (this repo's axios call sites)

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Report: axios 1.16.0 → 1.18.0

Summary

Mend bump CAT-2744 upgrades axios from 1.16.0 → 1.18.0 to remediate 9 CVEs
(1 HIGH, 8 MEDIUM — SSRF/prototype-pollution/header-leak/URL-parsing class issues,
see unit.json). The diff only touches package-lock.json (the manifest range
>= 1.15.0 < 2.0.0 in package.json:669 already permits 1.18.0). Verdict: not
breaking. Reviewed both intermediate releases (1.17.0, 1.18.0); no maintainer
"BREAKING" callouts, no public API removed/changed, and this repo's axios usage is
too simple to be touched by anything upstream changed.

Upstream changes

Upstream doesn't publish notes in a Mend-extractable form (/tmp/release-notes.md
was empty); reviewed the official GitHub changelog/releases instead.

v1.17.0 (2026-06-01)

Change	Type
Guarded socketPath, params, paramsSerializer reads against prototype pollution / SSRF	Security fix
Switched to npm staged publishing (provenance)	Infra
Node HTTP zstd response decompression (transitional.advertiseZstdAcceptEncoding)	Additive feature
Restored Basic auth on same-origin Node redirects (still stripped cross-origin)	Bug fix
Preserved httpsAgent TLS options when tunneling through HTTP CONNECT proxies	Bug fix
Cleared default Content-Type for React Native FormData	Bug fix
Skip empty/whitespace header names instead of throwing	Bug fix
Preserved enumerable symbol keys when cloning request data	Bug fix
resolveConfig changed from arrow default export to named function export	Type/interop change
Fixed AxiosHeaders.toJSON() return type, CJS isCancel typings	Type fix
Added https-proxy-agent as a new runtime dependency (^5.0.1)	Dependency addition

v1.18.0 (2026-06-13)

Change	Type
Strip caller-supplied sensitive headers (e.g. custom auth/API-key headers) on cross-origin redirects	Security fix (behavioral)
Reject malformed http:/https: URLs missing // with ERR_INVALID_URL	Security fix (stricter validation)
Tightened prototype-pollution-safe config reads, stream size limits, FormData depth handling, data-URL sizing, local NO_PROXY matching	Security hardening
New opt-in transitional.validateStatusUndefinedResolves (treat validateStatus: undefined like omitted; validateStatus: null still means "accept everything")	Additive, opt-in

No release in this range carries an explicit "BREAKING" / "⚠️" callout, no public
class/method/export was removed, and no existing API gained a new required
parameter. The two behavioral security fixes (header stripping on cross-origin
redirect, stricter URL validation) are corrective/security-motivated rather than
maintainer-flagged breaking changes, per the classification rules for this audit.

How we use it

Only one file in this repo calls axios: src/forge.ts (3 call
sites, all structurally identical):

• src/forge.ts:47 — axios.get('https://s3.amazonaws.com/puppet-pdk/pdk/LATEST', { params, headers })
• src/forge.ts:69 — axios.get(\https://forgeapi.puppet.com/v3/modules/${title}\`, { params, headers })`
• src/forge.ts:118 — axios.get(\https://forgeapi.puppet.com/private/modules?starts_with=${text}\`, { params, headers })`

All three:

• Use plain string literal HTTPS URLs (no user-controlled scheme, no malformed
  URLs) → unaffected by the stricter ERR_INVALID_URL check in 1.18.0.
• Set only Content-Type and User-Agent headers, no auth/API-key headers, and
  none of the endpoints redirect cross-origin → unaffected by the 1.18.0
  redirect-header-stripping change.
• Don't set validateStatus, don't use Basic auth in the URL, don't configure a
  proxy or custom httpsAgent, don't import resolveConfig or AxiosHeaders
  directly → unaffected by the 1.17.0 fixes/type changes.
• Run in the extension's Node.js host process (not a browser/React Native
  context) → the FormData/React-Native-specific fixes don't apply.

src/feature/PuppetfileHoverFeature.ts:1
has a commented-out require('axios') — dead code, not a real call site.

package.json:669 pins axios only as an engines-style semver range
(>= 1.15.0 < 2.0.0), not further constrained — no manifest edit was needed for
this bump, matching what's in the diff.

New transitive dependency (https-proxy-agent): axios 1.17.0+ added
https-proxy-agent@^5.0.1 as a normal (non-dev) dependency, which is why
package-lock.json also flips agent-base, debug, https-proxy-agent, and
ms from "dev": true to real dependencies — these were already present in the
lockfile (pulled in by dev tooling) and now also serve axios's production
dependency chain. Versions are consistent across the tree (agent-base@6.0.2,
debug@4.3.4, https-proxy-agent@5.0.1, ms@2.1.2) — no split cohort, no
version mismatch to flag.

Action items / risks

No action needed. This repo's axios usage is limited to simple unauthenticated
GET requests with no proxy/redirect/validateStatus customization, so none of
the 1.17.0/1.18.0 changes affect runtime behavior here. The manifest range
already covers 1.18.0, and the new transitive dependency addition
(https-proxy-agent) resolves cleanly with matching versions throughout the
lockfile.

References

• axios releases
• axios CHANGELOG.md (v1.x branch)
• Compare v1.17.0...v1.18.0
• axios 1.16.0 on npm
• axios 1.18.0 on npm

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Impact Report: axios 1.16.0 → 1.18.0

Summary

This bump upgrades axios from 1.16.0 to 1.18.0 to remediate 9 CVEs
(1 HIGH, 8 MEDIUM) tracked under Jira CAT-2744. The change is
lockfile-only — package.json already declares "axios": ">= 1.15.0 < 2.0.0", so no manifest edit was needed. Reviewing all intermediate
releases (1.16.1, 1.17.0, 1.18.0), I found no breaking changes called
out by the maintainers, and this repo's three call sites use only
basic, stable axios.get(url, config).then().catch() calls that are
unaffected. Verdict: not breaking — safe to auto-merge.

The diff

bump-diff.txt only touches package-lock.json:

• axios: 1.16.0 → 1.18.0, gaining a new direct dependency on
  https-proxy-agent@^5.0.1.
• agent-base@6.0.2, debug@4.3.4, https-proxy-agent@5.0.1, ms@2.1.2
  lose their "dev": true flag — expected side effect of npm's resolver
  now needing them for the production dependency graph (via axios's new
  https-proxy-agent dependency), not a separate change to review.
• package.json is unchanged; the existing >= 1.15.0 < 2.0.0 range
  already permits 1.18.0.

Upstream changes (1.16.0 → 1.18.0)

release-notes.md was empty for this PR, so this is from axios's
GitHub CHANGELOG.md and the v1.18.0 release notes.

Version	Date	Breaking?	Notable changes
1.16.1	2026-05-13	No	Hardened formDataToJSON against prototype pollution; fixed HTTPS request data leaking in cleartext to HTTP proxies; stricter fromDataURI RFC 2397 regex; preserved Unicode header values; guarded malformed XHR ProgressEvent payloads; reverted experimental URL-object support for config.url.
1.17.0	2026-06-01	No (explicitly)	Added zstd response decompression for the Node HTTP adapter (opt-in via transitional.advertiseZstdAcceptEncoding); HTTP/2 session handling improvements; restored Basic auth on same-origin Node redirects while still stripping creds cross-origin; fixed proxy TLS tunneling; empty/whitespace header names now skipped instead of throwing; resolveConfig's default export changed to a named export (only relevant to consumers importing resolveConfig directly — this repo does not).
1.18.0	2026-06-13	No (explicitly)	Security: Node HTTP adapter now strips sensitive headers (e.g. API keys) on cross-origin redirects; malformed http(s): URLs missing // now rejected with ERR_INVALID_URL; further prototype-pollution, stream-size, FormData-depth, and data-URL-size hardening. Bug fix: new transitional.validateStatusUndefinedResolves option to treat validateStatus: undefined as "omitted" (additive/opt-in).

None of the three releases has a maintainer-labeled "BREAKING" or
migration-guide entry. The security fixes tighten previously-insecure
behavior (credential leakage on redirect, prototype pollution, cleartext
proxy transmission) rather than changing stable public API surface —
per the breaking-change rubric, hardening fixes like this don't count
as breaking unless the changelog itself calls them out that way, which
it doesn't here.

How we use it

Three files reference axios, all runtime GET calls with plain
params/headers config and .then()/.catch() handling — none touch
any of the changed surface above:

• src/forge.ts:2,47-64,69-113,118-140 — getPDKVersion, getModuleInfo,
  getPuppetModuleCompletion each call axios.get(url, { params, headers }) against static, well-formed HTTPS URLs
  (s3.amazonaws.com, forgeapi.puppet.com). No proxy config, no
  resolveConfig import, no custom validateStatus, no redirects across
  origins.
• src/test/suite/links.test.ts:2,12,23 — test-only axios.get(link)
  calls used to validate documentation links resolve.
• src/feature/PuppetfileHoverFeature.ts:1 — a commented-out
  require('axios'); dead code, not active usage.

None of these call sites are affected by:

• The resolveConfig named-export change (not imported here).
• Cross-origin redirect header stripping (all URLs are fixed, same-origin
  per call, no redirect chains expected).
• The stricter malformed-URL rejection (all URLs are static, well-formed
  literals).
• zstd decompression / HTTP2 changes (opt-in, adapter-internal).

Action items / risks

No action needed. This is a lockfile-only security bump; package.json's
existing range already covers 1.18.0, all changed dependencies are
consistent (no split cohort — axios and its new https-proxy-agent
dependency are aligned at compatible versions), and none of the three
runtime call sites touch the changed/hardened surface.

References

• axios CHANGELOG.md (v1.x branch)
• axios v1.18.0 release
• axios v1.17.0...v1.18.0 compare

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Impact Report: axios 1.16.0 → 1.18.0

Summary

Mend flagged 9 CVEs (1 HIGH, 8 MEDIUM) in axios@1.16.0 (CAT-2744), fixed in 1.18.0. The bump diff upgrades axios in package.json/package-lock.json from a loose >= 1.15.0 < 2.0.0 range to ^1.18.0, and promotes https-proxy-agent (plus its transitive deps agent-base, debug, ms) from dev-only to a production dependency of axios. Verdict: not breaking. All upstream changes between 1.16.0 and 1.18.0 are security hardening and bug fixes; none are flagged by the maintainers as breaking, and none touch the narrow way this repo calls axios.

Upstream changes (1.16.1 → 1.18.0)

Release notes were not embedded in the PR (/tmp/release-notes.md was empty), so this is sourced from the axios GitHub changelog/releases.

Version	Type	Notable changes
1.16.1	Security + fixes	Prototype-pollution hardening in formDataToJSON; fixed HTTPS→HTTP proxy cleartext leak; RFC 2397 data-URI parsing fix; Unicode header preservation; Webpack 4 fetch adapter fix; reverted URL-object config.url support (regression fix)
1.17.0	Security + features	Own-property hardening for socketPath/params/paramsSerializer (SSRF defense); added Node zstd decompression + transitional.advertiseZstdAcceptEncoding; Basic-auth-in-URL now stripped on cross-origin redirects (kept on same-origin); preserved httpsAgent TLS options through proxy tunneling; empty/whitespace header names now silently skipped instead of throwing; resolveConfig changed from default export to named export; AxiosHeaders.toJSON() return-type correction
1.18.0	Security + fixes	Strips sensitive headers on cross-origin redirects (Node HTTP adapter); rejects malformed http(s): URLs missing // with ERR_INVALID_URL; further prototype-pollution/stream-size/FormData-depth hardening; added opt-in transitional.validateStatusUndefinedResolves config

No release in this range carries an explicit "BREAKING" callout. The only items with any theoretical compatibility edge are:

• resolveConfig export style change (default → named) — only affects code importing that internal helper directly.
• Basic-auth-in-URL stripped on cross-origin redirects — a security fix (part of the CVE set), changes behavior only for callers embedding credentials in URLs and expecting them forwarded cross-origin.
• Header-name handling changed from throw → silent skip — strictly more permissive, not breaking.

How we use it

axios usage in this repo is minimal and doesn't touch any of the above surface:

• src/forge.ts:2,47,69,118 (runtime) — three plain axios.get(url, { params, headers }) calls to Puppet Forge / S3 endpoints. No paramsSerializer, socketPath, proxy, httpsAgent, validateStatus, credentials-in-URL, or resolveConfig usage.
• src/test/suite/links.test.ts:2,12,23 (test-only) — simple axios.get(link) calls to validate links; same minimal surface.
• src/feature/PuppetfileHoverFeature.ts:1 — a commented-out require('axios'), not active code.

None of the changed/hardened config paths (params own-property checks, proxy tunneling, Basic-auth-in-URL, header-name validation, resolveConfig export) are exercised anywhere in this repo.

Lockfile side-effect: https-proxy-agent, agent-base, debug, and ms lose their "dev": true marker because axios 1.18.0 now declares https-proxy-agent as a runtime dependency (for proxy tunneling support). This only affects dependency bookkeeping/install footprint, not code behavior — the repo doesn't invoke proxy tunneling directly.

Action items / risks

• No code changes required for this bump.
• No cohort/sibling-pin inconsistency: axios is the only package whose version changed in this diff; its new transitive dep (https-proxy-agent) and existing transitive deps were already present at matching versions, just re-flagged as production (non-dev) — no split-family pins to call out.

References

• https://github.com/axios/axios/releases/tag/v1.18.0
• https://github.com/axios/axios/releases/tag/v1.18.1
• https://github.com/axios/axios/blob/v1.x/CHANGELOG.md
• https://www.mend.io/vulnerability-database/CVE-2026-67320 (and sibling CVE-2026-673{12,13,14,15,17,18,19,21} — all CAT-2744)

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Report: axios 1.16.0 → 1.18.0

Summary

Mend flagged 9 CVEs (1 HIGH, 8 MEDIUM) in axios@1.16.0; the bump moves the
manifest pin to axios@^1.18.0 (previously >= 1.15.0 < 2.0.0). Reviewing
the two intermediate releases (1.16.1, 1.17.0) plus 1.18.0 itself, all
changes are security hardening, redirect/header edge-case fixes, or additive
features — no removed APIs, no new required parameters, no minimum-runtime
bump. This repo's axios usage is three simple axios.get(url, { params, headers }) calls with well-formed https:// string URLs, no proxy config,
no credentials embedded in URLs, and no custom paramsSerializer/socketPath
— none of the changed edge-case surface applies. Verdict: not breaking.

Upstream changes (release notes fetched from GitHub, since Mend's embedded

notes file was empty)

v1.16.1 (May 13, 2026)

• Security: hardened formDataToJSON against polluted Object.prototype
  (own-properties-only walk).
• Security: fixed cleartext transmission of HTTPS request data through HTTP
  proxies.
• Fix: data URI parsing regex updated for RFC 2397 compliance.
• Fix: preserved Unicode header values through interceptors.
• Fix: guarded against malformed ProgressEvent payloads in XHR upload.
• Reverted a change that allowed passing a URL object as config.url
  (regressions) — this feature predates our 1.16.0 baseline and isn't used
  by this repo (see below), so the revert is a no-op for us.

v1.17.0 (June 1, 2026)

• Security: socketPath, params, paramsSerializer config reads now use
  own-property checks (prototype-pollution / SSRF hardening).
• New (additive): Node adapter zstd response decompression, gated behind
  transitional.advertiseZstdAcceptEncoding.
• Behavior: Basic-auth-in-URL credentials are now restored on same-origin
  Node redirects but continue to be stripped on cross-origin redirects.
• Behavior: empty/whitespace-only header names are now silently skipped
  instead of throwing.
• Fix: preserved user httpsAgent TLS options when tunneling HTTPS through
  an HTTP proxy.

v1.18.0 (June 13, 2026) — the fix version

• Security: Node adapter now strips caller-specified sensitive headers
  (e.g. Authorization, Cookie) on cross-origin redirects, addressing the
  HIGH-severity CVE-2026-67320 (credential-leak-via-redirect class).
• Security: rejects malformed http:/https: URLs that omit // with
  ERR_INVALID_URL; further prototype-pollution-safe config/stream/form
  handling.
• Bug fix: added transitional.validateStatusUndefinedResolves so
  validateStatus: undefined behaves like "omitted" (resolves per default
  status logic), while validateStatus: null explicitly means "accept all
  statuses." Opt-in transitional flag — default behavior for callers who
  don't set validateStatus at all is unchanged.

No maintainer changelog entry across these three releases is flagged
"BREAKING" — everything is scoped to security hardening, redirect/header
edge cases, or additive features.

How we use it

Axios usage in this repo, per Grep of src/**/*.ts:

• src/forge.ts:47-56 — axios.get('https://s3.amazonaws.com/puppet-pdk/pdk/LATEST', { params, headers })
• src/forge.ts:69-78 — axios.get(\https://forgeapi.puppet.com/v3/modules/${title}\`, { params, headers })`
• src/forge.ts:118-127 — axios.get(\https://forgeapi.puppet.com/private/modules?starts_with=${text}\`, { params, headers })`
• src/feature/PuppetfileHoverFeature.ts:1 — only a stale commented-out
  require('axios'); actual HTTP calls are delegated to forge.ts
  (getModuleInfo).
• src/test/suite/links.test.ts:2,12,23 — test-only axios.get(link) calls
  against extension metadata/JSON-schema URLs (no params/headers).

None of these:

• pass a URL object as config.url (all are plain template-literal
  strings) → the 1.16.1 revert doesn't affect us.
• configure proxy, socketPath, or a custom paramsSerializer → the
  1.17.0 own-property hardening is inert for us.
• embed Basic-auth credentials in the URL or rely on cross-origin redirect
  behavior → the 1.17.0/1.18.0 credential-stripping-on-redirect changes
  don't change observed behavior (we send no credentials to strip).
• construct protocol-relative or //-omitting URLs → all URLs are
  well-formed https://..., so the stricter URL parsing in 1.18.0 is a
  no-op.
• set validateStatus at all → default behavior is unchanged by the new
  transitional flag; the then/catch blocks in forge.ts just check
  response.status !== 200 themselves.

Action items / risks

No action needed. The version-range tightening in package.json
(>= 1.15.0 < 2.0.0 → ^1.18.0) is a side effect of how the bump agent
pins the dependency, not an upstream behavior change; it still permits any
future 1.x release >= 1.18.0.

The lockfile also picks up transitive bumps (form-data 4.0.5→4.0.6,
hasown 2.0.2→2.0.4, and agent-base/debug/https-proxy-agent/ms
losing their dev: true marker because axios now depends on
https-proxy-agent directly). These are patch-level, non-breaking, and
don't introduce any new runtime behavior we exercise.

References

• axios releases
• axios CHANGELOG.md (v1.x branch)
• CVE-2026-67320 (HIGH) et al. — https://www.mend.io/vulnerability-database/CVE-2026-67320

[eng-cve-remediation-app]

🚨 fix-ci circuit open — a fix attempt made no progress. The bot has stopped auto-fixing CI on this PR; it needs a human.