[Bug] @mendable/firecrawl-js@4.42.4 still installs vulnerable axios@1.18.0 through an unused firecrawl@4.30.1 dependency #4927

Describe the Bug
@mendable/firecrawl-js@4.42.4 pins axios@1.20.0 (thanks for #4875). It also depends on firecrawl@4.30.1, which pins axios@1.18.0, so every install of @mendable/firecrawl-js still includes a vulnerable axios. Dependabot and npm audit flag 12 axios advisories that are fixed in 1.20.0.

The firecrawl package is the same SDK published under another name. .github/workflows/publish-js-sdk.yml deletes this line before it publishes the firecrawl name (sed -i '/"firecrawl":/d' package.json). We compared the 4.42.4 tarballs: the dist/ files are identical, and "firecrawl" appears in the bundle only in the inlined keywords array. Nothing imports or requires it, so the dependency seems to have no runtime purpose. Your audit automation still bumps it, for example 4.16.0 → 4.30.1 in #4092.

Why does @mendable/firecrawl-js depend on firecrawl?

To Reproduce

1. Create an empty project: mkdir repro && cd repro && npm init -y
2. Run npm install @mendable/firecrawl-js@4.42.4
3. Run npm ls axios and npm audit
4. axios@1.18.0 is installed under firecrawl@4.30.1, and npm audit reports 3 high severity vulnerabilities (see Logs)

Expected Behavior
Installing @mendable/firecrawl-js@4.42.4 installs only axios@1.20.0. Either:

• remove the firecrawl dependency from apps/js-sdk/firecrawl/package.json (preferred, if it is unused), or
• bump it to firecrawl@4.42.4, which uses axios@1.20.0, and release a new @mendable/firecrawl-js.

Screenshots
N/A (see Logs)

Environment (please complete the following information):

• OS: macOS 26.6.2
• Deployment Type: Cloud (firecrawl.dev)
• Firecrawl Version: @mendable/firecrawl-js 4.42.4
• Node.js Version: v26.9.0 (npm 11.19.1)

Logs

$ npm ls axios
fc-repro@1.0.0
└─┬ @mendable/firecrawl-js@4.42.4
  ├── axios@1.20.0
  └─┬ firecrawl@4.30.1
    └── axios@1.18.0

$ npm audit
# npm audit report

axios  1.0.0 - 1.19.0
Severity: high
(12 advisories: GHSA-vh66-26gq-q6x8, GHSA-9fr6-4gfg-395g, GHSA-c29m-xwm3-cm6r,
GHSA-mghh-pgcx-3jjj, GHSA-x97p-jq2g-jp4f, GHSA-3pq3-5fj3-cg6v, GHSA-542g-h47m-68v8,
GHSA-j8rh-479h-cp32, GHSA-4hqw-qxg8-jxx2, GHSA-m8m8-qj5v-23w3, GHSA-44g4-m2mj-wpvx,
GHSA-r4gj-5m52-g5wh)
fix available via `npm audit fix --force`
Will install @mendable/firecrawl-js@4.30.1, which is a breaking change
node_modules/firecrawl/node_modules/axios
  firecrawl  4.22.0 - 4.42.1
  Depends on vulnerable versions of axios
  node_modules/firecrawl
    @mendable/firecrawl-js  >=4.31.0
    Depends on vulnerable versions of firecrawl
    node_modules/@mendable/firecrawl-js

3 high severity vulnerabilities

Additional Context

• npm audit fix --force suggests a downgrade to @mendable/firecrawl-js@4.30.1. Users who follow that advice end up on an older SDK.
• The README tells users to npm install firecrawl. Is firecrawl now the recommended name, and will @mendable/firecrawl-js remain supported?