chore(deps): bump axios from 1.12.1 to 1.13.5

[dependabot]

Bumps axios from 1.12.1 to 1.13.5.

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

• Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
• Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

• Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

• Fix/5657. (PR #7313)
• Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

• Add input validation to isAbsoluteURL. (PR #7326)
• Refactor: bump minor package versions. (PR #7356)

Documentation

• Clarify object-check comment. (PR #7323)
• Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

• Chore: fix issues with YAML. (PR #7355)
• CI: update workflow YAMLs. (PR #7372)
• CI: fix run condition. (PR #7373)
• Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
• Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

• @​sachin11063 (first contribution — PR #7323)
• @​asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

• fix: issues with version 1.13.3 (#7352) (ee90dfc)
  • Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

• http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
• interceptor: handle the error in the same interceptor (#6269) (5945e40)
• main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
• package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
• silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
• turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
• types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
• types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
• unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

• add undefined as a value in AxiosRequestConfig (#5560) (095033c)
• add automatic minor and patch upgrades to dependabot (#6053) (65a7584)
• add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)
• added copilot instructions (3f83143)
• compatibility with frozen prototypes (#6265) (860e033)
• enhance pipeFileToResponse with error handling (#7169) (88d7884)
• types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

• Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
• deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

• Ashvin Tiwari
• Nikunj Mochi
• Anchal Singh
• jasonsaayman
• Julian Dax
• Akash Dhar Dubey
• Madhumita
• Tackoil
• Justin Dhillon
• Rudransh
• WuMingDao
• codenomnom
• Nandan Acharya
• Eric Dubé
• Tibor Pilz
• Gabriel Quaresma
• Turadg Aleahmad

... (truncated)

Commits

• 29f7542 chore(release): prepare release 1.13.5 (#7379)
• 431c3a3 ci: fix run condition (#7373)
• 9ff3a78 ci: update ymls (#7372)
• 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
• 475e75a feat: add input validation to isAbsoluteURL (#7326)
• 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
• 04cf019 docs: clarify object check comment (#7323)
• 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
• 569f028 fix: added a option to choose between legacy and the new request/response int...
• 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: chore(deps): bump axios from 1.12.1 to 1.13.5
• Issue: None — the title is clear and follows conventional commit style. It indicates this is a dependency bump and includes the package and versions.
• Recommendation: Keep the title. Optionally, because this bundle includes a security fix, you may append (security) or mention security in the body to draw attention to it. Example: chore(deps): bump axios from 1.12.1 to 1.13.5 (security)

---

❌ Commit Type

• No explicit commit-type checklist selection from the repository template is present in the PR body.
• Note: The PR is generated by Dependabot and uses chore(deps) in the title which is appropriate, but the repository's PR body template requires the commit-type checkboxes to be filled in. Please ensure the PR body includes the Commit Type section and selects exactly one of the options (for this PR chore or feature/fix should not be selected — choose chore).

---

❌ Risk Level

• The PR does not include a risk label (e.g. risk:low, risk:medium, risk:high) and the PR body did not select a Risk Level in the template.
• Based on the code diff (axios bumped from 1.12.1 -> 1.13.5 across multiple packages, and lockfile updates), I advise: risk:low.
  • Rationale: This is a minor/patch style dependency upgrade that includes a security fix (Denial of Service via proto) and bug fixes. No application code changes were made. However, because axios is a widely-used HTTP client, ensure full test-suite and CI run successfully.
• Action required: Add a repository label matching the selected Risk Level (e.g. risk:low) and select the matching Risk Level checkbox in the PR body.

---

❌ What & Why

• Current: Dependabot default release notes are present, but the repository template's "What & Why" section (a short, explicit summary) is missing.
• Issue: PR body lacks a concise explanation in the required template format — we need a short "What changes and why" statement.
• Recommendation: Add a 1-2 sentence summary such as:
  • What: "Bump axios from 1.12.1 to 1.13.5 across packages and update pnpm lockfile."
  • Why: "Includes a security fix (fixes DoS via proto in mergeConfig) and bug fixes; upgrading ensures we receive these fixes and dependency updates."

---

❌ Impact of Change

• Impact section from the template is missing.
• Recommendation: Add a short impact section. Example:
  • Users: No direct UI changes; runtime HTTP behavior may be affected in edge cases fixed by the dependency update. Recommend smoke-testing user flows that trigger network calls.
  • Developers: Dependency versions updated; local install: run pnpm install and run test suite. If your CI publishes SBOM or dependency alerts, update relevant records.
  • System: Minimal. This update includes a security fix (DoS) and minor bugfixes; run integration tests that exercise network/axios usage.

---

❌ Test Plan

• Assessment: The PR does not include the repository template Test Plan checklist or an explanation of testing performed. The code diff shows only package.json and pnpm-lock.yaml changes — no unit/E2E tests were added.
• Issue: Per repository rules, if there are no unit/E2E tests added then the PR body must explain why and list manual testing steps or link to successful CI runs. That is missing.
• Recommendation (minimum): Add a Test Plan section that includes at least one of:
  • Unit tests added/updated OR E2E tests added/updated OR explicitly Manual testing completed with concrete steps.
  • Suggested manual test steps:
    1. Run pnpm install locally.
    2. Run pnpm test / full unit test suite and ensure all tests pass.
    3. Run smoke/integration flows that exercise network calls (login, API fetches) in a staging environment.
    4. Confirm CI pipeline passes on this branch.
• If you believe automated tests are not required for this dependency bump, explicitly document that and explain why (for example: no behavioral changes, only security/maintenance update; CI is authoritative and passed).

---

⚠️ Contributors

• Assessment: Dependabot PR has no Contributors section per repo template. This is optional but recommended.
• Recommendation: If others (PM, Designer, or reviewer) contributed context or validated the change, add them. If none, you may leave it blank.

---

⚠️ Screenshots/Videos

• Assessment: Not applicable. No UI changes in this PR.
• Recommendation: No screenshots necessary.

---

Summary Table

Section	Status	Recommendation
Title	✅	Title is good; optionally add (security) if you want to highlight the fix.
Commit Type	❌	Add Commit Type section to PR body and select chore.
Risk Level	❌	Add label risk:low and select Risk Level in the PR body.
What & Why	❌	Add concise "What & Why" per template (see recommendation).
Impact of Change	❌	Fill Impact of Change section with Users/Developers/System bullets.
Test Plan	❌	Add unit/E2E test updates or concrete manual test steps and confirm CI passed.
Contributors	⚠️	Optional: add contributors if applicable.
Screenshots/Videos	⚠️	Not required for this dependency bump.

---

Next steps

1. Add the repository PR template sections (Commit Type and Risk Level checkboxes) and select the appropriate values (Commit Type: chore; Risk Level: Low and add a risk:low label to the PR).
2. Fill the "What & Why" with a short summary: e.g. Bump axios to 1.13.5 to apply security and bug fixes (fixes DoS via __proto__ in mergeConfig and ensures AxiosError.status is present).
3. Add an Impact of Change section (Users / Developers / System) as recommended above.
4. Add a Test Plan section. At minimum, include steps for: running the test suite locally, running smoke tests in staging, and confirming CI passed. If CI has already passed, link to the CI run in the PR body.
5. Add risk:low label to the PR (or change advised risk if your team thinks differently). Based on the diff, I recommend risk:low.

Please update the PR body with the items above and re-submit. Once updated, I will re-evaluate and, if CI/tests pass and the template is filled out, we can approve/merge the dependency bump. Thank you for keeping dependencies up to date!

---

Last updated: Mon, 09 Feb 2026 18:22:47 GMT

[github-actions]

📊 Coverage check completed. See workflow run for details.