chore: bump axios to 1.15.0 to resolve dependabot alerts

[jonathannorris]

Summary

• Bumps axios from 1.13.6 to 1.15.0 and updates resolutions to match
• Fixes alerts 191 (NO_PROXY hostname normalization bypass / SSRF) and 193 (header injection chain / cloud metadata exfiltration, CVSS 10)
• 1.15.0 is confirmed clean — it's the release that addressed the 1.14.x supply chain issue we previously avoided

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	69ca6ec	Apr 13 2026, 02:32 PM

[Copilot]

Pull request overview

This PR updates the project’s HTTP client dependency to address Dependabot security alerts by bumping axios to a patched release and aligning the Yarn lockfile.

Changes:

• Bump axios from 1.13.6 to 1.15.0 in package.json.
• Update Yarn resolutions to force axios to 1.15.0 where applicable.
• Regenerate yarn.lock entries for axios and its updated transitive dependency proxy-from-env.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates the direct axios dependency and adjusts resolutions to force 1.15.0.
yarn.lock	Updates the lockfile to axios@1.15.0 and proxy-from-env@2.1.0 with new checksums.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The resolutions entry "axios@npm:^1.13.6": "1.15.0" no longer appears to match any dependency descriptor in the current yarn.lock (there are no axios: "npm:^1.13.6" entries). Consider removing this unused selector or updating it to the range(s) that actually exist (e.g. keep only the ^1.6.0 selector) to avoid confusion about which installs are being forced.

Suggested change

"axios@npm:^1.13.6": "1.15.0",