chore: resolve open Dependabot security alerts (axios, brace-expansion, morgan)

[sriramveeraghanta]

Description

Closes all 7 open Dependabot security alerts on the repo by bumping three pins in pnpm-workspace.yaml. Only axios had an automated PR (#9447); brace-expansion and morgan had none, so they were quietly sitting unpatched.

Package	Change	Alerts closed
axios	catalog 1.16.0 → 1.18.1	5 (1 high, 4 moderate)
brace-expansion	override 5.0.6 → 5.0.7	1 high
morgan	new override → 1.11.0	1 moderate

Advisories resolved

• axios — GHSA-gcfj-64vw-6mp9 (high, Node HTTP adapter can use an inherited proxy after interceptor config cloning), GHSA-hcpx-6fm6-wx23 (form serializer maxDepth bypass via {} metatoken), GHSA-mwf2-3pr3-8698 (HTTP/2 streamed uploads bypass maxBodyLength), GHSA-f4gw-2p7v-4548 (NO_PROXY bypass for 0.0.0.0 local addresses), GHSA-xj6q-8x83-jv6g (prototype pollution — auth subfields can inject Basic auth)
• brace-expansion — GHSA-3jxr-9vmj-r5cp (high, DoS via exponential-time expansion of consecutive non-expanding {} groups)
• morgan — GHSA-4vj7-5mj6-jm8m (log forging via unneutralized control characters in :remote-user)

Implementation notes

• axios is pinned to 1.18.1, not the 1.18.0 Dependabot proposed. 1.18.1 is a pure bugfix release on top of 1.18.0 with an identical dependency set, and additionally fixes runtime crashes, type-definition mismatches, and AxiosError#cause circular-JSON serialisation failures. It satisfies all five advisories, so there was no reason to land the strictly worse version.
• morgan needed a new override rather than a direct bump — it is not a direct dependency anywhere in the workspace. It arrives transitively through @react-router/serve@7.15.0, so an override is the only lever available without waiting upstream.
• This PR supersedes chore(deps): bump axios from 1.16.0 to 1.18.0 in the npm_and_yarn group across 1 directory #9447. That PR bumps axios to 1.18.0 only. Once this merges, Dependabot will auto-close it since the underlying alerts resolve.

The lockfile resolves to exactly one copy of each package — no vulnerable duplicates remain:

axios@1.18.1
brace-expansion@5.0.7
morgan@1.11.0

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Improvement (change that would cause existing functionality to not work as expected)
• Code refactoring
• Performance improvements
• Documentation update

Screenshots and Media (if applicable)

N/A — dependency-only change, no user-facing UI surface.

Test Scenarios

Verified locally against the new lockfile:

• pnpm check:types — 28/28 tasks pass
• pnpm check:lint — 16/16 tasks pass
• pnpm build — 16/16 tasks pass
• Lockfile contains a single, patched version of each of the three packages

Worth exercising in review, since axios 1.17/1.18 changed runtime behaviour:

• Any flow issuing an authenticated API request — 1.18.0 strips caller-specified sensitive headers on cross-origin redirects. Same-origin Basic auth on redirects is preserved.
• File/attachment upload paths (FormData multipart) — maxDepth handling and the metatoken fix changed serialisation of deeply nested payloads.
• Any request relying on validateStatus: undefined — 1.18.0 adds transitional.validateStatusUndefinedResolves; validateStatus: null remains the explicit "accept every status" form.
• Requests built from hand-assembled base URLs — malformed http:/https: URLs that omit // now reject with ERR_INVALID_URL instead of being coerced.
• apps/admin request logging via @react-router/serve — confirm morgan output is unchanged aside from control-character neutralisation in :remote-user.

References

• Dependabot alerts: https://github.com/makeplane/plane/security/dependabot
• Supersedes chore(deps): bump axios from 1.16.0 to 1.18.0 in the npm_and_yarn group across 1 directory #9447

---

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated underlying components to newer versions for improved maintenance and compatibility.
  • Added a version constraint to ensure consistent behavior across supported environments.
  • No user-facing feature or interface changes are included in this update.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 162d239b-ee62-408f-b562-7b92e9ae488c

📥 Commits

Reviewing files that changed from the base of the PR and between 7cef741 and 55031fe.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

Updated dependency version pins for axios and brace-expansion in pnpm-workspace.yaml, and added an morgan override.

Changes

Dependency catalog updates

Layer / File(s)	Summary
Catalog pins and override pnpm-workspace.yaml	axios was updated to 1.18.1, brace-expansion to 5.0.7, and morgan was added as a 1.11.0 override.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• makeplane/plane#9153: Updates related dependency catalog entries in pnpm-workspace.yaml.
• makeplane/plane#9191: Updates dependency pins and related Axios integration code.

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the dependency-security-alert fix.
Description check	✅ Passed	The PR description matches the template and fills all required sections, including change details, type, tests, screenshots, and references.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-security-bumps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}