Remediate CVE-2026-67320, CVE-2026-67317, CVE-2026-67312, CVE-2026-67318, CVE-2026-67319, CVE-2026-67321, CVE-2026-67315, CVE-2026-67313, CVE-2026-67314 (axios)

[eng-cve-remediation-app]

This PR contains the following updates:

Package	Type	Update	Change
axios:axios-1.16.0.tgz	dependencies	security	1.16.0 → 1.18.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	8.2	CVE-2026-67320
Medium	5.8	CVE-2026-67317
Medium	5.3	CVE-2026-67312
Medium	5.8	CVE-2026-67318
Medium	4.0	CVE-2026-67319
Medium	5.3	CVE-2026-67321
Medium	5.8	CVE-2026-67315
Medium	5.3	CVE-2026-67313
Medium	6.5	CVE-2026-67314

---

Bump strategy

Bump strategy: axios 1.16.0 -> 1.18.0

• Direct dependency. axios is declared in package.json under
  dependencies with the range ">= 1.15.0 < 2.0.0", which already
  permits 1.18.0 — no manifest change was required.
• Only package-lock.json needed updating: the resolved
  node_modules/axios entry was bumped from 1.16.0 to 1.18.0
  (new integrity hash, new resolved URL).
• Axios 1.18.0 added https-proxy-agent as a runtime dependency. Its
  transitive chain (https-proxy-agent, agent-base, debug, ms)
  was already present in the lockfile as dev-only transitives (pulled
  in elsewhere); bumping axios promotes them to non-dev in the lock,
  which is an expected side effect of the resolve, not a separate change.
• No sibling/cohort packages pinned at axios's version exist in this
  manifest, so nothing else was touched.
• Verified via npm ls axios (resolves to 1.18.0) and a second
  npm install --package-lock-only producing no further diff.

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Report: axios 1.16.0 → 1.18.0 (CAT-2744)

Summary

Mend bumped axios from 1.16.0 to 1.18.0 to remediate 9 CVEs
(CVE-2026-67320 and 8 others, HIGH/MEDIUM severity). The diff is
lockfile-only (package-lock.json) — package.json already pins
axios with a range (">= 1.15.0 < 2.0.0", package.json:669), so no manifest edit was needed.
Reviewed release notes for axios 1.16.1, 1.17.0, and 1.18.0 (upstream
publishes no release-notes.md/CHANGELOG artifact in the Mend PR body,
so this was sourced from GitHub). No breaking changes were found in
the stable public API; all notable changes are security hardening,
bug fixes, or opt-in/additive features. Verdict: not breaking.

Upstream changes (1.16.1 → 1.18.0)

Version	Date	Notable changes
1.16.1	2026-05-13	Security: prototype-pollution defense in formDataToJSON; fixed HTTPS-over-cleartext leak to HTTP proxies. Bug fixes: RFC 2397 data-URI parsing, unicode header preservation, XHR upload progress, webpack 4 fetch-adapter compat.
1.17.0	2026-06-01/03	Security: config/adapter paths hardened to read only own properties with null-prototype objects (blocks polluted auth/baseURL/socketPath/beforeRedirect/insecureHTTPParser from prototype chain). New opt-in allowedSocketPaths config to restrict UNIX socket paths. New opt-in zstd response decompression (transitional.advertiseZstdAcceptEncoding). Bug fixes: Basic-auth restored on same-origin redirects, HTTPS-proxy TLS option preservation, RN FormData Content-Type, empty header-name handling. Minor: AxiosHeaders.toJSON() / isCancel TS type corrections, smaller published package (files allowlist).
1.18.0	2026-06-13	Security: Node HTTP adapter now strips sensitive headers on cross-origin redirects (prevents credential leakage — this is the CVE fix). URL hardening: rejects malformed http:/https: URLs missing // with ERR_INVALID_URL (previously such URLs may have been silently mis-parsed). Bug fix: new transitional.validateStatusUndefinedResolves option lets validateStatus: undefined behave as "option omitted" (opt-in; validateStatus: null remains the explicit accept-all). Plus prototype-pollution-safe config reads, stream/FormData/data-URL size limits, local-proxy-matching fixes.

No maintainer changelog entry across these three releases is flagged as
"BREAKING" — all are described as security hardening, bug fixes, or
additive/opt-in features.

Lockfile side-effect worth noting

The diff also flips agent-base@6.0.2, debug@4.3.4, https-proxy-agent@5.0.1,
and ms@2.1.2 from "dev": true to production dependencies, because
axios 1.18.0 now declares https-proxy-agent@^5.0.1 as a runtime
dependency (package-lock.json diff lines 26-29). This slightly grows
the shipped production dependency tree but doesn't change any API this
repo calls — informational only.

How we use it

axios is used in exactly two runtime call sites plus one test file, all
via the default export doing plain GET requests with a URL, params,
and headers — no advanced config:

• src/forge.ts:47-56 getPDKVersion — axios.get('https://s3.amazonaws.com/...')
• src/forge.ts:69-78 getModuleInfo — axios.get('https://forgeapi.puppet.com/v3/modules/${title}')
• src/forge.ts:118-127 getPuppetModuleCompletion — axios.get('https://forgeapi.puppet.com/private/modules?starts_with=${text}')
• src/feature/PuppetfileHoverFeature.ts:38 calls into getModuleInfo above (no direct axios usage)
• src/test/suite/links.test.ts:12,23 — test-only axios.get(link) link-checks against well-formed, hardcoded HTTPS URLs

Checked against each 1.17.0/1.18.0 change:

Change	Repo impact
Strips sensitive headers on cross-origin redirects (1.18.0)	Not affected — this repo doesn't set custom auth headers expected to survive a redirect; the only header sent is a static User-Agent/Content-Type, and none of the called URLs redirect cross-origin. Pure security improvement.
Malformed URL rejection, missing // (1.18.0)	Not affected — all URLs are hardcoded, well-formed https://... literals or simple template-string concatenations (https://forgeapi.puppet.com/v3/modules/${title}); none can produce a scheme without //.
transitional.validateStatusUndefinedResolves (1.18.0)	Not used — repo never sets validateStatus; grep for validateStatus across src/ found no matches. Default behavior unchanged unless opted in.
Own-property/null-prototype config hardening (1.17.0)	Not affected — config objects passed (params, headers) are plain object literals with only own, enumerable properties.
allowedSocketPaths, zstd decompression (1.17.0)	Both opt-in/additive; not referenced anywhere in src/ (grep for socketPath, proxy found no matches).
AxiosHeaders.toJSON() / isCancel type corrections (1.17.0)	Not used — repo never calls .toJSON() on headers or axios.isCancel.

Action items / risks

No action needed. The bump is lockfile-only, package.json's existing
range (>= 1.15.0 < 2.0.0) already permits 1.18.0, and none of the
documented changes touch how this repo calls axios. The promotion of
agent-base/debug/https-proxy-agent/ms from dev-only to production
dependencies is a minor, expected side effect of axios's own dependency
graph and requires no follow-up.

References

• axios GitHub Releases
• axios v1.18.0 release notes
• axios v1.x CHANGELOG.md

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.77%. Comparing base (0170a8c) to head (4cc529d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #948   +/-   ##
=======================================
  Coverage   77.77%   77.77%           
=======================================
  Files           1        1           
  Lines           9        9           
=======================================
  Hits            7        7           
  Misses          2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[eng-cve-remediation-app]

The fix-ci agent made no change this run while CI is red. The reconcile sweep will escalate this PR to a human rather than retry.

[eng-cve-remediation-app]

🚨 fix-ci circuit open — a fix attempt made no progress. The bot has stopped auto-fixing CI on this PR; it needs a human.