chore: Update axios to version 1.12.0 and add data URL rejection in API client

- Upgraded axios dependency in package.json and package-lock.json to version 1.12.0 for improved functionality.
- Implemented a check in the API client to proactively reject requests to data: URLs, enhancing security and preventing potential issues with large payloads.

Author: 0xdevcollins

lib/api/api.ts

@@ -79,6 +79,21 @@ const createClientApi = (): AxiosInstance => {
     config => {
       config.withCredentials = true;
 
+      // Reject data: URLs proactively to avoid Node adapter decoding large payloads
+      try {
+        const base = config.baseURL || API_BASE_URL;
+        const rawUrl = config.url || '';
+        // If absolute URL provided, use as-is; else resolve against base
+        const fullUrl = /^https?:|^data:|^\/\//.test(rawUrl)
+          ? rawUrl
+          : `${base?.replace(/\/$/, '')}/${String(rawUrl).replace(/^\//, '')}`;
+        if (fullUrl.startsWith('data:')) {
+          throw new Error('Blocked request to data: URL');
+        }
+      } catch (e) {
+        return Promise.reject(e);
+      }
+
       // Only access cookies on client side
       if (typeof window !== 'undefined') {
         const accessToken = Cookies.get('accessToken');

package-lock.json

@@ -54,7 +54,7 @@
     "@radix-ui/react-tooltip": "^1.2.7",
     "@stellar/freighter-api": "^4.1.0",
     "@stellar/stellar-sdk": "^13.3.0",
-    "axios": "^1.11.0",
+    "axios": "^1.12.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",