fix: PE-70936 Pin axios to 1.11.0 to prevent supply chain attack

[romulofranca-ls]

Summary

• Pins axios from ^1.11.0 to 1.11.0 in backend/package.json
• Prevents automatic upgrades to axios@1.14.1 which contains a malicious supply chain payload (plain-crypto-js@4.2.1)

Jira: PE-70936

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated dependency version pinning for improved internal consistency and stability.

Walkthrough

The axios dependency version specification in backend/package.json is changed from a caret-pinned range (^1.11.0) to an exact version pin (1.11.0), removing flexibility for patch and minor version updates.

Changes

Cohort / File(s)	Summary
Dependency Version Pinning backend/package.json	Axios version specifier updated from caret range (^1.11.0) to exact version (1.11.0).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: pinning axios to a specific version to prevent a supply chain attack, which directly matches the changeset.
Description check	✅ Passed	The description is directly related to the changeset, clearly explaining the axios version pin change and its security rationale against supply chain attacks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch PE-70936

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@backend/package.json`:
- Line 11: Move the "axios" entry out of devDependencies into the top-level
"dependencies" section of backend/package.json and update its version to 1.12.0
or later to address known vulnerabilities; specifically, remove the "axios":
"1.11.0" line from devDependencies and add "axios": "^1.12.0" (or newer) under
dependencies, then run your package manager to regenerate the lockfile.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 404e5b0c-f65d-4c8f-bcbf-5a6aa01b8a43

📥 Commits

Reviewing files that changed from the base of the PR and between a419e48 and bf71711.

📒 Files selected for processing (1)

• backend/package.json

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify lockfile consistency with the package.json pin (read-only).
fd -i 'package-lock.json|npm-shrinkwrap.json|yarn.lock|pnpm-lock.yaml'
rg -n -C2 '"axios"\s*:\s*"1\.11\.0"|axios@1\.11\.0|axios:\s*1\.11\.0'

Repository: lawnstarter/engineer-assessment

Length of output: 378

---

🏁 Script executed:

#!/bin/bash
# Check full backend/package.json structure and lockfile status
echo "=== Checking backend/package.json structure ==="
cat -n backend/package.json | head -30

echo -e "\n=== Searching for any lockfiles in backend directory ==="
find backend -maxdepth 2 -type f \( -name "package-lock.json" -o -name "yarn.lock" -o -name "pnpm-lock.yaml" -o -name "npm-shrinkwrap.json" \)

echo -e "\n=== Checking if lockfiles are gitignored ==="
if [ -f .gitignore ]; then
  echo "Checking .gitignore for lockfile patterns:"
  grep -i "lock\|shrinkwrap" .gitignore || echo "No lockfile gitignore patterns found"
fi

Repository: lawnstarter/engineer-assessment

Length of output: 838

---

🌐 Web query:

axios 1.11.0 security vulnerabilities CVE

💡 Result:

Axios version 1.11.0 fixes CVE-2025-58754 (DoS via unbounded memory allocation on large data: URIs in Node.js, ignoring maxContentLength/maxBodyLength; CVSS 7.5 High; fixed in 1.11.0 for 1.x branch, also 0.30.2 for 0.x). However, it remains vulnerable to later issues including CVE-2026-25639 (Prototype Pollution DoS via proto in mergeConfig; fixed in 1.13.5), CVE-2025-27152 (SSRF/credential leakage via absolute URLs; fixed in 1.8.2/1.8.3), and older CVEs like CVE-2023-45857 if applicable to range. No other CVEs are explicitly fixed at exactly 1.11.0; it patches the data: URI issue but inherits prior vulns and is affected by subsequent ones until 1.12.0+.

Citations:

• 1: https://nvd.nist.gov/vuln/detail/CVE-2025-58754
• 2: https://zeropath.com/blog/cve-2025-58754-axios-memory-exhaustion-summary
• 3: https://security.snyk.io/package/npm/axios/1.11.0
• 4: https://www.versioneye.com/NodeJS/axios/1.11.0?sort=released
• 5: https://github.com/axios/axios/security
• 6: https://www.cvedetails.com/vulnerability-list/vendor_id-19831/Axios.html
• 7: https://app.opencve.io/cve/?vendor=axios

---

Move axios to dependencies, not devDependencies.

axios is an HTTP client library and should be a runtime dependency, not a development dependency. It should be moved to the dependencies section of backend/package.json.

Additionally, axios 1.11.0 fixes CVE-2025-58754 but remains vulnerable to CVE-2026-25639 (Prototype Pollution DoS) and CVE-2025-27152 (SSRF/credential leakage). Consider upgrading to 1.12.0 or later for more comprehensive security coverage.

Note: No backend lockfile (package-lock.json, yarn.lock, etc.) exists in the repository, so lockfile consistency verification is not applicable.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@backend/package.json` at line 11, Move the "axios" entry out of
devDependencies into the top-level "dependencies" section of
backend/package.json and update its version to 1.12.0 or later to address known
vulnerabilities; specifically, remove the "axios": "1.11.0" line from
devDependencies and add "axios": "^1.12.0" (or newer) under dependencies, then
run your package manager to regenerate the lockfile.

[romulofranca-ls]

Closing — npm removed the malicious axios@1.14.1 from the registry. Will implement a proper security solution instead.