ECHOES-1272 Update version of axios to fix CVE-2025-62718

[gregaubert]

Part of

[hashicorp-vault-sonar-prod]

ECHOES-1272

[sonar-review-alpha]

Summary

This PR pins axios to 1.15.0 via a resolutions override to address a vulnerability in the transitive dependency chain. The vulnerable version (1.13.2) is required by sonarqube-scanner 4.3.4, but version 1.15.0 is compatible with the scanner and newer versions of its dependencies (follow-redirects, form-data, proxy-from-env). The sonarqube-scanner package itself is also bumped from 4.3.4 to 4.3.5 as part of this update.

What reviewers should know

What changed:

• package.json: Added "axios": "1.15.0" to resolutions, bumped sonarqube-scanner to 4.3.5
• package.json.md: Documented the axios override and its security rationale
• yarn.lock: Locked axios to 1.15.0 and updated its dependencies and transitive deps used by sonarqube-scanner

What to check:

• Verify the vulnerability being fixed is documented (check axios changelog between 1.13.2→1.15.0)
• Confirm sonarqube-scanner 4.3.5 works with axios 1.15.0 (it should, but check for any known incompatibilities)
• Review whether any other parts of the app depend directly on axios and would be affected by the newer version

Note: This is a dependency-tree fix, not application code changes. The main risk is transitive dependency compatibility, which appears safe based on the updated sonarqube-scanner version.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[netlify]

✅ Deploy Preview for echoes-react ready!

Name	Link
🔨 Latest commit	0439da6
🔍 Latest deploy log	https://app.netlify.com/projects/echoes-react/deploys/69d8a9aa81b3ca00083f0122
😎 Deploy Preview	https://deploy-preview-667--echoes-react.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube