Bump axios to 1.20.0: 12 advisories published against 1.18.0 (2026-09-30) #590

Summary

@iterable/web-sdk@2.3.3 pins axios to 1.18.0. On 2026-09-30 the GitHub Advisory Database published 12 axios advisories (7 high, 5 moderate) that affect every version below 1.20.0. As a result, 2.3.3 shows up in vulnerability scans again.

Consumers can't fix this themselves. The browser and Node builds (index.js, index.node.js) bundle their own copy of axios 1.18.0. An overrides/resolutions entry only changes the node_modules copy that scanners see, not the one the SDK runs. Only an SDK release can update the bundled copy.

Advisories (all fixed in axios 1.20.0)

High:

• GHSA-542g-h47m-68v8: DoS from an unhandled error event during HTTP/2 session setup
• GHSA-3pq3-5fj3-cg6v: the HTTP/2 adapter bypasses the configured DNS lookup and proxy
• GHSA-x97p-jq2g-jp4f: prototype-pollution gadget in toFormData options
• GHSA-mghh-pgcx-3jjj: quadratic ReDoS in shouldBypassProxy
• GHSA-c29m-xwm3-cm6r: ReDoS in the data: URL parser
• GHSA-r4gj-5m52-g5wh: the fetch adapter ignores maxRedirects: 0
• GHSA-m8m8-qj5v-23w3: prototype-pollution gadget that hijacks the Node HTTP socket

Moderate:

• GHSA-9fr6-4gfg-395g: an inherited Object.prototype.method overrides the HTTP method
• GHSA-vh66-26gq-q6x8: prototype-pollution gadget in the fetch adapter
• GHSA-44g4-m2mj-wpvx: CIDR-form NO_PROXY entries are ignored
• GHSA-4hqw-qxg8-jxx2: fetch adapter header injection via an inherited FormData getHeaders
• GHSA-j8rh-479h-cp32: header injection via inherited headers after a minimal interceptor

Request

In #585 you mentioned stopping at 1.18.0 because 1.20.0 adds a generic to AxiosResponse that breaks compilation in the auth test suite. Could that cleanup land, so the SDK can move to axios@1.20.0 or later in the next release?

Related: #528. Build-only packages under dependencies (copy-webpack-plugin, axios-mock-adapter) end up in consumers' production dependency trees and audits.

Thank you!