Bump the axios override 1.18.0 → 1.20.0 to fix GHSA-r4gj-5m52-g5wh (high): maxRedirects: 0 was not enforced by the fetch adapter → redirect-based SSRF. Affects >=1.17.0 <1.20.0.

Scope

• axios is dev-only, transitive: pulled by chromedriver (^1.6.7) and wait-on (^1.12.1, via start-server-and-test).
• Moved the existing pinned override (same idiom as chore(deps): security bumps — axios, engine.io, brace-expansion #266). Same major.
• Lockfile: only axios changed (plus its own form-data range ^4.0.5 → ^4.0.6; installed form-data is already 4.0.6, so nothing else moved).

Verification (local, Node 22.15.0)

• npm ci (main) → npm install (branch): clean. npm ls axios → 1.20.0 overridden everywhere.
• npm run build: axe.js and axe.min.js are byte-identical on main vs branch → no shipped impact.
• npm run test:tsc: same 12 errors on main and branch. These are pre-existing @types/ws typing errors, unrelated to this change.
• axios smoke on the branch against a local redirect server:
  • maxRedirects: 0 → 302 not followed on both http and fetch adapters (the fix).
  • Plain GET OK.
  • wait-on http-get OK.
• Not run: karma unit suites (test:unit:*). They need a browser download, the disk on my machine was nearly full, and axios is not used in the code under test (identical build output).

Ticket: PAAA-797

Closes:

🤖 Generated with Claude Code