chore(deps): bump axios from 0.27.2 to 0.33.0

[dependabot]

Bumps axios from 0.27.2 to 0.33.0.

Release notes

Sourced from axios's releases.

v0.33.0 — June 13, 2026

This release hardens request config handling and form serialisation, adds Node.js 26 coverage for v0.x, and updates the v0.x release workflow.

🔒 Security Fixes

• Request Config Hardening: Uses own-property reads for nested request options affecting auth, params, proxy, and data handling; adds bounded form serialisation depth checks; normalises nullish Basic Auth credentials; and treats 0.0.0.0 as local for proxy bypass. (#11001)

🚀 New Features

• Node.js 26: Adds Node.js 26 to the v0.x CI and release/publish matrices. (#10937)

🔧 Maintenance & Chores

• Release Publishing: Adopts npm staged publishing for v0.x releases and disables npm caching in CI to make installs and publish jobs more deterministic. (#10936, #10943)
• Changelog: Backfills missing v0.x changelog entries for prior releases. (#10842)
• Release Metadata: Bumps package and internal version metadata for v0.33.0. (#11002)

Full Changelog

v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

⚠️ Breaking Changes & Deprecations

• Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

🔒 Security Fixes

• Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)
• Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)
• Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)
• Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)
• Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)
• URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)
• Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

🔧 Maintenance & Chores

• Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

Full Changelog

v0.31.1

This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed dist/ artefacts along with Bower support.

⚠️ Breaking Changes & Deprecations

• Bower & Committed dist/ Removed: dist/ bundles are no longer committed to the repo, and bower.json plus the Grunt package2bower task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)

... (truncated)

Commits

• d998cc9 chore: release v0.33.0 (#11002)
• 1417285 fix: improve request config handling (#11001)
• ff12ec1 ci: stop caching npm (#10943)
• b2a702f feat: add node 26 to matrix (#10937)
• 31b7bdf ci(publish): adopt npm staged publishing on v0.x (#10936)
• 5436976 chore: update changelog (#10842)
• 8db2d44 chore: bump version to v0.32.0 (#10840)
• 2af6116 chore: backport fixes from the v1x branch (#10838)
• a589dc5 chore: bump version to v0.31.1 (#10766)
• b0c632f fix: backport security issues (#10764)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

[cursor]

PR Summary

Medium Risk
Wide change to the shared HTTP client across API, integrations, enrichment, and package-registry workers; axios 0.32+ includes breaking merge/config behavior that could affect edge cases even though typical axios.get/create usage is unchanged.

Overview
Aligns the monorepo on a single direct axios version (^0.33.0 / ~0.33.0) in backend, multiple Temporal workers, and shared libs (common_services, database, integrations, nango, opensearch). Several packages that previously pinned axios 1.x (e.g. ^1.6.8, ^1.13.1, ^1.16.1) are moved onto the same 0.33.0 line as the backend’s prior 0.27.2 bump.

The pnpm-lock.yaml update resolves those workspace dependencies to axios@0.33.0 and drops the scattered 1.6–1.16 lock entries for first-party packages. Transitive consumers (e.g. @sendgrid/client, @slack/web-api, peopledatalabs) still pull axios@1.18.1 where their own manifests require it—the frontend’s axios@^1.15.0 is untouched.

No application source changes; behavior shifts come from 0.33’s security/config hardening (and 0.32 breaking changes around null-prototype merged config/headers) wherever code imports the workspace axios instance.

^{Reviewed by Cursor Bugbot for commit 1a9db72. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[cursor]

Clearbit needle needs SSH install

High Severity

Regenerating the lockfile replaced Clearbit’s needle dependency from an HTTPS tarball with a git resolution using git@github.com. Fresh pnpm install for backend (which depends on clearbit) may fail in environments that only allow HTTPS dependency fetch and lack SSH keys for GitHub.

Additional Locations (1)

• pnpm-lock.yaml#L15613-L15614

 

^{Reviewed by Cursor Bugbot for commit e89678b. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1a9db72. Configure here.}

[cursor]

Axios 1.x downgraded to 0.x

High Severity

This change replaces axios 1.x with 0.33.0 across many workers and libs, while the PR only intends a 0.27.2 → 0.33.0 bump. Axios still maintains separate 0.x and 1.x lines, so those packages are being major-downgraded, not upgraded, which can break HTTP clients that depend on 1.x behavior and APIs.

Additional Locations (2)

• services/apps/integration_run_worker/package.json#L29-L30
• services/libs/common_services/package.json#L28-L29

 

^{Reviewed by Cursor Bugbot for commit 1a9db72. Configure here.}