chore(deps): bump the npm-minor-patch group across 1 directory with 5 updates

[dependabot]

Bumps the npm-minor-patch group with 5 updates in the /web-ui directory:

Package	From	To
axios	1.18.1	1.19.0
@types/node	26.1.1	26.1.2
@types/react	19.2.17	19.2.18
@types/react-dom	19.2.3	19.2.4
postcss	8.5.24	8.5.25

Updates axios from 1.18.1 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)
• @​Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)

... (truncated)

Commits

• 311fcc5 chore(release): prepare release 1.19.0 (#11095)
• cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
• 004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
• 122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
• c44f8d0 ci: use bundled npm for v1 publish (#11083)
• 878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
• a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
• 3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
• 58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
• 3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
• Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

• See full diff in compare view

Updates postcss from 8.5.24 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

Changelog

Sourced from postcss's changelog.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

Commits

• 08c989c Release 8.5.25 version
• 24f6814 Fix 8.5.17 visitor regression
• f2fa53f Add supply chain security requirement to PostCSS plugin guide
• 10edf0b fix: return empty array for empty string in list.split (#2121)
• See full diff in compare view

[frankbria]

Dependabot Triage — PR #1105: npm-minor-patch group (5 updates)

Classification

• Update type: Routine low-impact (grouped minor/patch)
• Security urgency: Low
• Supply-chain risk: Low

Key observations

• Contents: axios 1.18.1 → 1.19.0, @types/node 26.1.1 → 26.1.2, @types/react 19.2.17 → 19.2.18, @types/react-dom 19.2.3 → 19.2.4, postcss 8.5.23 → 8.5.25.
• The PR body cites GHSA-hmw2-7cc7-3qxx (high, form-data CRLF injection, patched >= 4.0.6). Already satisfied — the lockfile pins form-data 4.0.6 today, so this carries no outstanding fix. The reference comes through the axios changelog, not a live exposure here.
• Likewise the postcss move 8.5.23 → 8.5.25 is past the newest advisory (GHSA-fxqj-rqcc-2cmp, patched 8.5.23). No open postcss advisory applies to the top-level copy. The genuinely vulnerable nested postcss under next is not touched by this PR — that is chore(deps): bump postcss and next in /web-ui #1087.
• Three of five entries are @types/*, which are compile-time only. Diff is 2 files / 136 lines, no new packages, no lifecycle scripts added.

Recommendation

Merge now (batched with the rest of this sweep)

Genuinely routine: type-definition patches plus one axios minor, with no live advisory riding on it once the form-data claim is checked against the actual lockfile. Low value and low risk, so it goes in with the batch rather than earning its own CI cycle.

Follow-up actions

• Do not read this PR's GHSA reference as the form-data fix — that was already in place before the PR was opened.

---

_{Supply-chain triage per the reviewing-dependabot-prs skill. Advisories verified via gh api /advisories/; action SHA pins verified by dereferencing the annotated tag to its commit. Green CI is a functional gate, not a supply-chain signal — a malicious lifecycle script passes CI happily, so the diff was scanned for one separately.}

[frankbria]

@dependabot rebase

[github-actions]

Claude finished @frankbria's task in 2m 17s —— View job

---

GLM Bug-Hunt Review — PR #1105 (npm minor/patch group)

• Pull PR diff + context (gh pr view, gh pr diff)
• Check existing comments to avoid repeats
• Inspect changed hunks against real code context
• Post summary (no inline findings — nothing to report)

Scope: concrete defects only — logic errors, null/unhandled crashes, security, data loss, contract breaks, resource leaks, unbounded growth. Style/architecture/coverage is handled by a separate reviewer.

What changed: web-ui/package.json and web-ui/package-lock.json only — manifest files. Bumps are axios 1.18.1→1.19.0 (incl. sub-dep form-data ^4.0.5 → ^4.0.6), @types/node 26.1.1→26.1.2, @types/react 19.2.17→19.2.18, @types/react-dom 19.2.3→19.2.4, postcss 8.5.24→8.5.25. Every hunk is a version string, resolved URL, integrity hash, or dependency-range string.

Verdict: No application or source code is touched — there is no logic surface to evaluate (no conditions, null paths, serialization, or runtime contracts in the diff), so no concrete failure scenario can be stated for any hunk. Nothing to escalate.

✅ GLM review: no defects found.

severity	file:line	finding
—	—	no defects found

This is consistent with the prior supply-chain triage (merge now) and the general review comment. No files modified, no build/test run per review guardrails.

[claude]

Review

This is a scoped dependency bump limited to web-ui/package.json and web-ui/package-lock.json — no application code touched. Confirms the supply-chain triage already posted above: axios 1.18.1→1.19.0 (pulls in form-data ^4.0.6, closing GHSA-hmw2-7cc7-3qxx), postcss 8.5.24→8.5.25, and three @types/* dev-only patch bumps. All are semver-minor/patch, no new packages, no lifecycle scripts introduced.

Code quality / bugs / security: nothing to flag — this is a mechanical lockfile + manifest change generated by Dependabot, not hand-written code.

Test coverage: N/A for this diff itself, but per CLAUDE.md the gate that matters here is CI's frontend-tests job (npm test && npm run build in web-ui/) passing on the bumped versions before merge — that's the functional check for a dependency bump like this, distinct from the supply-chain review already done.

No concerns. Consistent with the existing triage comment's "merge now" recommendation.

[github-actions]

Claude finished @frankbria's task in 1m 43s —— View job

---

GLM Bug-Hunt Review — PR #1105 (npm minor/patch group, post-rebase)

• Pull PR diff + context (gh pr view, gh pr diff)
• Check existing comments to avoid repeats
• Inspect changed hunks against real code context
• Post summary (no inline findings — nothing to report)

Scope: concrete defects only — logic errors, null/unhandled crashes, security, data loss, contract breaks, resource leaks, unbounded growth. Style/architecture/coverage is handled by a separate reviewer.

What changed: web-ui/package.json and web-ui/package-lock.json only — manifest files (26+/26−, 2 files, confirmed via git diff origin/main...HEAD --stat). Bumps are axios 1.18.1→1.19.0 (sub-dep form-data ^4.0.5 → ^4.0.6), @types/node 26.1.1→26.1.2, @types/react 19.2.17→19.2.18, @types/react-dom 19.2.3→19.2.4, postcss 8.5.24→8.5.25. Every hunk is a version string, resolved URL, integrity hash, or dependency-range string. All resolved URLs point at the official https://registry.npmjs.org/ registry with well-formed sha512- integrity; no new packages, no scripts/lifecycle additions.

Ruled out: the one axios 1.19.0 behavioral change worth checking — the synchronous-request-interceptor fix (#11071, "prevent dispatch after a synchronous interceptor fails unless its rejection handler resolves") — was verified against the actual interceptor at web-ui/src/lib/api.ts:135-141. Its fulfilled handler (getToken() → guarded config.headers.set('Authorization', …) → return config) cannot throw under any input, so the fix has no effect on this codebase and no rejection handler is required. No failure scenario.

Verdict: No application or source code is touched — there is no logic surface to evaluate (no conditions, null paths, serialization, or runtime contracts in the diff), so no concrete failure scenario can be stated for any hunk. Nothing to escalate.

✅ GLM review: no defects found.

severity	file:line	finding
—	—	no defects found

Consistent with the prior (pre-rebase) review and the supply-chain triage's "merge now." No files modified, no build/test run per review guardrails.

[claude]

Review

Diff is unchanged in substance since the prior reviews on this thread (the two intervening commits are just main merges to keep the branch rebased) — still limited to web-ui/package.json and web-ui/package-lock.json, no application code.

Bumps: axios 1.18.1→1.19.0 (raises the form-data floor to ^4.0.6, closing GHSA-hmw2-7cc7-3qxx — as the earlier triage noted, this repo's lockfile already had 4.0.6 so there's no live exposure being newly fixed), postcss 8.5.24→8.5.25, and three dev-only @types/* patch bumps (node, react, react-dom). All semver-minor/patch, no new packages, no lifecycle scripts added, package.json ranges and lockfile resolved versions match.

Code quality / bugs / performance / security: nothing to flag — mechanical Dependabot manifest+lockfile change, no logic surface to review.

Test coverage: N/A for the diff itself; per CLAUDE.md the relevant gate is CI's frontend-tests job (npm test && npm run build) passing on the bumped versions before merge.

No concerns. Consistent with the existing triage and prior review comments — merge is fine once CI is green.

[github-actions]

Claude finished @frankbria's task in 1m 13s —— View job

---

GLM Bug-Hunt Review — PR #1105 (npm minor/patch group, post-synchronize)

• Pull PR diff + context (gh pr view, gh pr diff)
• Check existing comments to avoid repeats
• Inspect changed hunks against real code context
• Post summary (no inline findings — nothing to report)

Scope: concrete defects only — logic errors, null/unhandled crashes, security, data loss, contract breaks, resource leaks, unbounded growth. Style/architecture/coverage is handled by a separate reviewer.

What changed: web-ui/package.json and web-ui/package-lock.json only — manifest files (26+/26−, 2 files, confirmed via git diff origin/main...HEAD --stat). Bumps are axios 1.18.1→1.19.0 (sub-dep form-data ^4.0.5 → ^4.0.6), @types/node 26.1.1→26.1.2, @types/react 19.2.17→19.2.18, @types/react-dom 19.2.3→19.2.4, postcss 8.5.24→8.5.25. Every hunk is a version string, resolved URL, integrity hash, or dependency-range string. All resolved URLs point at the official https://registry.npmjs.org/ registry with well-formed sha512- integrity; no new top-level packages, no scripts/lifecycle/platform additions (verified by scanning the lockfile diff).

Ruled out: the one axios 1.19.0 behavioral change worth checking — the synchronous-request-interceptor fix (#11071, "prevent dispatch after a synchronous interceptor fails unless its rejection handler resolves") — was verified against the actual interceptor at web-ui/src/lib/api.ts:135-141. This is the only request interceptor in the codebase (grep for interceptors.request.use / interceptors.response.use returns exactly two, both in this file). Its fulfilled handler (getToken() → guarded config.headers.set('Authorization', …) → return config) cannot throw under any input, so the fix has no effect on this codebase and no rejection handler is required. No failure scenario.

Verdict: No application or source code is touched — there is no logic surface to evaluate (no conditions, null paths, serialization, or runtime contracts in the diff), so no concrete failure scenario can be stated for any hunk. Nothing to escalate.

✅ GLM review: no defects found.

severity	file:line	finding
—	—	no defects found

Consistent with the prior (pre- and post-rebase) reviews and the supply-chain triage's "merge now." No files modified, no build/test run per review guardrails.

[claude]

Review

Confirming the consensus already established in this thread across the triage comment and two prior review passes: this diff is limited to web-ui/package.json and web-ui/package-lock.json, with no application code touched.

Changes: axios 1.18.1→1.19.0 (bumps its form-data sub-dependency floor to ^4.0.6, closing GHSA-hmw2-7cc7-3qxx — already satisfied in the lockfile pre-PR per the earlier triage), postcss 8.5.24→8.5.25, and three dev-only @types/* patch bumps (node, react, react-dom). All semver-minor/patch, no new packages, no lifecycle scripts, all resolved against the official npm registry with valid integrity hashes.

Code quality / bugs / performance / security: nothing to flag — there's no logic surface in a lockfile+manifest diff.

Test coverage: N/A for the diff itself; per CLAUDE.md the relevant gate is CI's frontend-tests job (npm test && npm run build) passing against the bumped versions before merge.

No concerns — agrees with the existing "merge now" recommendation.