OUT-3587: pin axios to ^1.15.2 via yarn resolutions

[SandipBajracharya]

Summary

• Resolves Dependabot alerts for axios <1.15.0 pulled transitively through intuit-oauth@4.2.3 (which pins axios@1.14.0).
• Affected advisories: GHSA-3p68-rc4w-qgx5 (NO_PROXY SSRF) and GHSA-fvcv-3m26-pcqx (cloud metadata exfiltration).
• intuit-oauth is already at its latest version (4.2.3) with no upstream fix available. The yarn resolutions override is SemVer-compatible with its declared axios: ^1.9.0 range, so no API drift.

Linear: OUT-3587

Test plan

• yarn install — axios resolves to 1.15.2 (verified via yarn why axios)
• yarn npm audit --all --recursive — both advisories no longer reported
• yarn tsc --noEmit — no new type errors introduced by the bump
• Smoke test QuickBooks OAuth flow in staging (intuit-oauth is the only consumer of axios)

🤖 Generated with Claude Code

[linear-code]

OUT-3587 Resolve Github Dependabot alert for critical Axios issues

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
quickbooks-sync	Building		Apr 22, 2026 9:34am
quickbooks-sync (dev)	Ready	Preview, Comment	Apr 22, 2026 9:34am

[greptile-apps]

Greptile Summary

This PR addresses two critical axios security advisories (SSRF via NO_PROXY bypass and cloud metadata exfiltration) that were pulled transitively through intuit-oauth@4.2.3, which hardcodes axios@1.14.0. Since no upstream fix is available in intuit-oauth, a Yarn resolutions override pinning axios to ^1.15.2 is the correct mitigation strategy. The lockfile confirms intuit-oauth's ^1.9.0 request is remapped to the single ^1.15.2 entry, and the ^1.15.2 range is fully SemVer-compatible with intuit-oauth's declared ^1.9.0 range.

Confidence Score: 5/5

Safe to merge — minimal, targeted change that resolves two CVEs with no API drift or breaking changes.

The change is a one-line addition to resolutions plus the corresponding lockfile update. The ^1.15.2 range is SemVer-compatible with intuit-oauth's ^1.9.0 declaration, the lockfile correctly remaps the transitive request, and no other consumers of axios exist in this repo. All remaining considerations are P2 or lower.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Adds "axios": "^1.15.2" to the Yarn resolutions field to force the transitive axios version above the vulnerable 1.14.0 pinned by intuit-oauth
yarn.lock	Replaces the single axios lockfile entry from ^1.9.0 / 1.14.0 to ^1.15.2 / 1.15.2 with updated checksum; intuit-oauth's ^1.9.0 request is correctly remapped to this entry by Yarn's resolution override

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["intuit-oauth@4.2.3\ndeclares axios: ^1.9.0"] --> B{Yarn resolution\noverride in package.json}
    B -- "Before PR\n(no override)" --> C["axios@1.14.0\n❌ GHSA-3p68-rc4w-qgx5\n❌ GHSA-fvcv-3m26-pcqx"]
    B -- "After PR\n(axios: ^1.15.2)" --> D["axios@1.15.2\n✅ NO_PROXY bypass fixed\n✅ metadata exfiltration fixed"]
    D --> E["yarn.lock entry key\naxios@npm:^1.15.2\nremaps intuit-oauth's ^1.9.0 request"]

Loading

_{Reviews (1): Last reviewed commit: "fix(OUT-3587): pin axios to ^1.15.2 via ..." | Re-trigger Greptile}