chore(deps): bump axios from 0.27.2 to 0.33.0

[dependabot]

Bumps axios from 0.27.2 to 0.33.0.

Release notes

Sourced from axios's releases.

v0.33.0 — June 13, 2026

This release hardens request config handling and form serialisation, adds Node.js 26 coverage for v0.x, and updates the v0.x release workflow.

🔒 Security Fixes

• Request Config Hardening: Uses own-property reads for nested request options affecting auth, params, proxy, and data handling; adds bounded form serialisation depth checks; normalises nullish Basic Auth credentials; and treats 0.0.0.0 as local for proxy bypass. (#11001)

🚀 New Features

• Node.js 26: Adds Node.js 26 to the v0.x CI and release/publish matrices. (#10937)

🔧 Maintenance & Chores

• Release Publishing: Adopts npm staged publishing for v0.x releases and disables npm caching in CI to make installs and publish jobs more deterministic. (#10936, #10943)
• Changelog: Backfills missing v0.x changelog entries for prior releases. (#10842)
• Release Metadata: Bumps package and internal version metadata for v0.33.0. (#11002)

Full Changelog

v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

⚠️ Breaking Changes & Deprecations

• Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

🔒 Security Fixes

• Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)
• Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)
• Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)
• Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)
• Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)
• URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)
• Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

🔧 Maintenance & Chores

• Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

Full Changelog

v0.31.1

This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed dist/ artefacts along with Bower support.

⚠️ Breaking Changes & Deprecations

• Bower & Committed dist/ Removed: dist/ bundles are no longer committed to the repo, and bower.json plus the Grunt package2bower task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)

... (truncated)

Commits

• d998cc9 chore: release v0.33.0 (#11002)
• 1417285 fix: improve request config handling (#11001)
• ff12ec1 ci: stop caching npm (#10943)
• b2a702f feat: add node 26 to matrix (#10937)
• 31b7bdf ci(publish): adopt npm staged publishing on v0.x (#10936)
• 5436976 chore: update changelog (#10842)
• 8db2d44 chore: bump version to v0.32.0 (#10840)
• 2af6116 chore: backport fixes from the v1x branch (#10838)
• a589dc5 chore: bump version to v0.31.1 (#10766)
• b0c632f fix: backport security issues (#10764)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

[cursor]

PR Summary

Medium Risk
Wide dependency alignment touches most outbound HTTP paths; axios 0.32+ includes breaking config/header merge behavior, and downgrading some packages from 1.x to 0.33.0 may surface subtle runtime differences despite no code edits.

Overview
Standardizes HTTP client dependencies by setting axios to ^0.33.0 (or ~0.33.0) in backend/package.json, multiple services/apps/*_worker packages, and shared libs (common_services, database, integrations, nango, opensearch). Several packages that previously declared axios 1.x are brought onto the same 0.33.0 line as the backend bump from 0.27.2.

The lockfile is regenerated so first-party workspaces resolve to axios@0.33.0, with related transitive updates (e.g. follow-redirects, form-data, clearbit needle git URL). Third-party packages such as @slack/web-api, @sendgrid/client, and peopledatalabs still pull axios 1.18.1 as their own dependency. No application source changes—only manifests and the lockfile.

^{Reviewed by Cursor Bugbot for commit 95a4e6c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.