[Snyk] Security upgrade axios from 1.8.3 to 1.16.0

[andrewsetterfield]

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Insertion of Sensitive Information Into Sent Data SNYK-JS-AXIOS-17172681	828
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-17172532	738
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-17172751	738

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Allocation of Resources Without Limits or Throttling

[andrewsetterfield]

This upgrade from axios v1.8.3 to v1.16.0 spans numerous minor versions and includes several notable changes and security-related fixes that require verification.

Notable Changes in v1.16.0:

• Behavioral Change: The fetch adapter now correctly enforces maxBodyLength and maxContentLength, which were previously ignored. This could affect applications that were unintentionally sending large payloads.
• Stricter Parsing: parseProtocol now requires a colon (:) in the protocol separator, making its parsing stricter.
• Proxy Header Handling: User-supplied Host headers are now preserved in proxy requests, which corrects virtual-host style routing behavior.
• Encoding: The deprecated unescape() function has been replaced with modern UTF-8 encoding, which may alter the output for non-ASCII URLs.

Security Incidents in Range:
It is critical to note that version 1.14.1 was compromised in a supply-chain attack in March 2026. While the target version 1.16.0 is not malicious, this highlights the importance of ensuring a direct and clean upgrade path.

Recommendation:
The changes are primarily behavioral fixes and security hardening rather than direct API removals. However, due to the number of changes and their potential to affect edge cases (especially around proxies, payload limits, and URL parsing), this upgrade is classified as medium risk. Developers should verify that application behavior remains consistent after the upgrade, particularly in areas related to file uploads, proxy usage, and handling of unusual URLs.

Source: Release notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.