fix(security): Use a resolution for axios to address CVE-2026-25639.

[jbocce]

Context

GHSA-43fc-jf86-j433

Changes & Results

Bumped the version of axios and used a resolution.

Testing

Run automated tests.
Check segmentation interploation.

Checklist

PR

• My Pull Request title is descriptive, accurate and follows the
  semantic-release format and guidelines.

Code

• My code has been well-documented (function documentation, inline comments,
  etc.)

Public Documentation Updates

• The documentation page has been updated as necessary for any public API
  additions or removals.

Tested Environment

System:
OS: Windows 11 10.0.26200
CPU: (20) x64 12th Gen Intel(R) Core(TM) i7-12700H
Memory: 7.25 GB / 31.68 GB
Binaries:
Node: 20.9.0 - C:\Users\joebo\AppData\Local\fnm_multishells\29608_1770221529011\node.EXE
Yarn: 1.22.22 - C:\Program Files (x86)\Yarn\bin\yarn.CMD
npm: 10.1.0 - C:\Users\joebo\AppData\Local\fnm_multishells\29608_1770221529011\npm.CMD
bun: 1.2.23 - C:\Users\joebo.bun\bin\bun.EXE
Browsers:
Chrome: 144.0.7559.110

Greptile Overview

Greptile Summary

Updates axios to 1.13.5 to address GHSA-43fc-jf86-j433, enforcing the version across the Yarn v1 workspace via a root-level resolutions entry and updating yarn.lock. The CLI workspace package (platform/cli) is also updated to match.

One notable impact is that bun.lock now includes broad workspace version bumps (e.g., 3.12.0-beta.133 → 3.13.0-beta.0) in addition to the axios change, which expands the PR’s scope beyond the stated security fix.

Confidence Score: 3/5

• This PR is likely safe to merge once the lockfile scope mismatch is confirmed intentional.
• Axios is consistently pinned to 1.13.5 via dependencies + Yarn resolutions and the lockfile reflects the new axios subtree. The main concern is that bun.lock contains many unrelated workspace version bumps/metadata changes, which increases the chance of unintended dependency drift beyond the CVE fix.
• bun.lock

Important Files Changed

Filename	Overview
package.json	Pins axios to 1.13.5 and adds a Yarn v1 resolutions entry to force that version across the workspace; no code logic changes.
platform/cli/package.json	Bumps the CLI’s direct axios dependency from 1.12.0 to 1.13.5 to match the security resolution.
yarn.lock	Updates the locked axios tree to 1.13.5 (and follow-redirects/form-data). Introduces a second follow-redirects/form-data range entry, which should be validated to ensure Yarn resolves axios to 1.13.5 everywhere.
bun.lock	Updates Bun lockfile: removes configVersion, bumps many internal workspace package versions to 3.13.0-beta.0, and updates axios to 1.13.5 in overrides; scope looks broader than the stated axios-only security fix and should be confirmed intentional.

Sequence Diagram

sequenceDiagram
  participant Dev as Developer
  participant Yarn as Yarn (install)
  participant Root as Root package.json
  participant WS as Workspace pkg.json
  participant Lock as yarn.lock

  Dev->>Yarn: yarn install
  Yarn->>Root: read dependencies/resolutions
  Root-->>Yarn: axios pinned via resolutions (1.13.5)
  Yarn->>WS: read workspace dependencies (e.g., platform/cli axios)
  WS-->>Yarn: axios@1.13.5 direct dependency
  Yarn->>Lock: resolve & lock axios tree
  Lock-->>Yarn: axios@1.13.5 + follow-redirects/form-data versions
  Yarn-->>Dev: node_modules uses axios@1.13.5

Loading

_{(5/5) You can turn off certain types of comments like style here!}

[netlify]

✅ Deploy Preview for ohif-dev ready!

Name	Link
🔨 Latest commit	55f44dd
🔍 Latest deploy log	https://app.netlify.com/projects/ohif-dev/deploys/698a4db5c8aa18000868fe6f
😎 Deploy Preview	https://deploy-preview-5793--ohif-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[greptile-apps]

_{4 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Additional Comments (1)

bun.lock
Lockfile scope drift

This security PR is described as “bump axios + use a resolution”, but bun.lock also bumps many workspace package versions (e.g., 3.12.0-beta.133 → 3.13.0-beta.0) and changes lockfile metadata (drops configVersion). That broadens the change surface beyond axios and can unintentionally pull in other dependency updates. If this wasn’t intentional, regenerate bun.lock with only the axios-related change; otherwise, please document why the workspace version bumps are expected in this PR.

[sedghi]

we shouldn't really require axios, can we replace it with native fetch? This will reduce all the axios noise long term

[jbocce]

we shouldn't really require axios, can we replace it with native fetch? This will reduce all the axios noise long term

Even if we replace it for our cli, there is still a few transitive dependencies for it. For example, itk-wasm depends on it. So it really doesn't help here.