[rcooney-sh]

Backport to release/v2 of the axios fix for Aikido AIKIDO-2026-10823, tracked in Linear SEC-690. The v2 tag (v2.2.0) and the @release/v2 branch ref are cut from this branch, so the main-branch fix alone doesn't reach v2 consumers.

The change is the same as the main PR: axios ^1.7.2 -> ^1.20.0 (lockfile 1.15.0 -> 1.20.0, with follow-redirects 1.16.1, form-data 4.0.6, hasown 2.0.4, https-proxy-agent 5.0.1, and agent-base 6.0.2). It also removes the stale, unused package-lock.json, which still pins axios 1.13.4. This branch installs with pnpm only.

-    "axios": "^1.7.2",
+    "axios": "^1.20.0",

dist/ is intentionally not rebuilt here. dist/index.js still bundles axios 1.15.0, so a maintainer must rebuild and commit it on this branch before merge. verify-build only runs on PRs to main/master, so CI won't catch a missing rebuild here:

# Node 20 (CI: actions/setup-node node-version "20"; .npmrc pins use-node-version=20.19.4) and pnpm 10.33.0
npm config set @buf:registry https://buf.build/gen/npm/v1/
npm config set //buf.build/gen/npm/v1/:_authToken "$BUF_TOKEN"
pnpm install --frozen-lockfile
pnpm run build   # ncc build src/main.ts -o dist --source-map --minify --license licenses.txt
git add dist && git commit -m "dist: rebuild with axios 1.20.0" && git push

After merge, run the Release workflow from release/v2 with version v2.2.1 and update-major checked, which moves v2.

Promotion risk: Low. This is a minor-version bump of one HTTP client (axios 1.15.0 -> 1.20.0, same 1.x API) used in two non-critical call sites. The only behavior change Proof saw is how HTTPS goes through a proxy, and nobody has tested that on a real proxied runner.

• Runtime change: none until dist/ is rebuilt; this diff alone changes no shipped code. @release/v2 consumers get it at merge, @v2 consumers when v2.2.1 moves the tag. After that, dist/index.js bundles axios 1.20.0. axios is used for Blacksmith API/metrics reporting in src/reporter.ts (failures there only log core.warning) and the BuildKit tarball download from github.com in src/buildkit-installer.ts. The download only runs when a job sets buildkit-version to a version that isn't preinstalled.
• What could break:
  • Proxy handling (untested on a real proxied runner). With HTTPS_PROXY set, axios now tunnels HTTPS through CONNECT via the new https-proxy-agent@5.0.1 dependency. 1.15.0 sent absolute-URL GETs to the proxy; the change is the 1.16.1 "proxy cleartext leak" fix. A proxy that refuses CONNECT would make the BuildKit download fail and the setup step error with Installing BuildKit ... followed by an axios error. Reporting calls would only emit warnings.
  • Stricter request handling from 1.16-1.19: maxContentLength is enforced on streams, malformed http:/https: URLs are rejected, and NO_PROXY matching changed. None of these touch the fixed URLs this action uses.
  • axios-retry 4.5.0 is unchanged; its peer range 0.x || 1.x still matches.
• Evidence:
  • CI (test-action.yml on this branch) ran pnpm install && pnpm run build and then uses: ./ on real Blacksmith runners, all green. That is a full ncc/TypeScript compile with axios 1.20.0, plus a real builder setup. This branch has no custom-BuildKit-version CI job, so the download path was covered only by Proof.
  • Proof ran the real reporter.ts and buildkit-installer.ts on 1.15.0 vs 1.20.0: 503 retries, give-up after 5 retries, and the GitHub download behaved identically. Through a permissive test proxy the download succeeded on both versions; the only difference was CONNECT vs plain forwarding.
  • NOT exercised: a runner behind a real corporate proxy (restrictive or CONNECT-only), or the committed dist/. It isn't rebuilt yet, and verify-build doesn't run on release/v2, so nothing in CI catches a missing rebuild.
• Blast radius / rollback / watch:
  • Blast radius: every workflow on @v2 once the tag moves: customers following the README/docs default, web build_backend_docker.yml / build-and-push-ecr.yml, docker-build-lab and se-demo. @release/v2 consumers (web codesmith-deploy.yml, codesmith-bench.yml, codesmith-snapshot.yml, smoke-pr.yml) pick it up the moment this merges, before any tag. So merge only with the rebuilt dist/ committed.
  • Rollback: re-point v2 to v2.2.0 (git tag -fa v2 v2.2.0^{} && git push --force origin v2). For @release/v2 consumers, revert the merge commit on release/v2. No data or state is involved.
  • Watch: for 24-48h after the tag moves, watch BuildKit-install failures and Failed to report ... warnings in setup-docker-builder runs, especially jobs that set buildkit-version or HTTPS_PROXY.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Frozen pnpm install resolves axios 1.20.0

The frozen install now loads axios 1.20.0 with every listed transitive version, and package-lock.json is gone. The private @buf package was left out because no BUF_TOKEN is available.

Merge-base	This PR 53d75473

Also checked · 2 more claims, all matched observations

Axios client with retry still works on 1.20.0
Committed dist still bundles axios 1.15.0

_{Proof on 53d75473}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled. (Staging)}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 53d7547. Configure here.}

[cursor]

Action bundle omits axios security fix

High Severity

The axios bump does not reach action consumers because action.yml runs dist/index.js, which still embeds axios 1.15.0 and remains vulnerable to AIKIDO-2026-10823. verify-build does not run on this branch, and the action tests rebuild dist locally, so a merge without a committed rebuild leaves v2 users on the unpatched bundle.

 

^{Reviewed by Cursor Bugbot for commit 53d7547. Configure here.}

[blacksmith-staging]

Valid, but dist/ can't be rebuilt without BUF_TOKEN for the private @buf registry. A maintainer must run the rebuild steps in the PR description before merge.

[linear-code]

SEC-690