fix(deps): bump axios to 1.18.1 for Aikido CVEs (EXSC-728)

[0xDEnYO]

Which Linear task belongs to this PR?

https://linear.app/lifi-linear/issue/EXSC-728/upgrade-axios-to-1181-for-aikido-critical-cves

Why did I implement it this way?

Aikido issue 17132073 (severity 99 / critical, 28 CVEs) flags axios in this repo. Recommendation: upgrade to ≥ 1.18.0 (or ≥ 1.15.0 for critical-only).

Before: direct dep ^1.9.0 resolved to 1.11.0, while nested pins still pulled vulnerable copies (1.7.7 Ledger, 1.11.0 tronweb, 0.21.4 matic/defender, 0.24.0 uma).

Change:

1. Bump direct dependency to ^1.18.1
2. Add overrides.axios = 1.18.1 so every consumer resolves to the patched version (same pattern as the socks pin for EXSC-717)

Prior Aikido AutoFix PR #1713 incorrectly overrode to 0.31.0 (a downgrade) and was closed — this PR uses the version Aikido currently recommends.

Checklist before requesting a review

• I have performed a self-review of my code
• This pull request is as small as possible and only tackles one problem
• I have added tests that cover the functionality / test the bug
• For new facets: I have checked all points from this list: https://www.notion.so/lifi/New-Facet-Contract-Checklist-157f0ff14ac78095a2b8f999d655622e
• I have updated any required documentation

Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)

• I have checked that any arbitrary calls to external contracts are validated and or restricted
• I have checked that any privileged calls (i.e. storage modifications) are validated and or restricted
• I have ensured that any new contracts have had AT A MINIMUM 1 preliminary audit conducted on by <company/auditor>

[coderabbitai]

Warning

Review limit reached

@0xDEnYO, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 1 minute

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5c156e9e-aeb2-4291-8db2-715f6c1c56aa

📥 Commits

Reviewing files that changed from the base of the PR and between 7865078 and 2d36dd7.

📒 Files selected for processing (1)

• package.json

Walkthrough

Changes

Axios version update

Layer / File(s)	Summary
Align axios dependency versions package.json	The axios dependency override now uses 1.18.1. The direct dependency changes from ^1.9.0 to ^1.18.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: upgrading axios to 1.18.1 to address CVEs, with the Linear task reference.
Description check	✅ Passed	The description includes the Linear task link, a detailed explanation of the security rationale, implementation approach, and relevant checklist items marked appropriately.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/exsc-728-upgrade-axios-to-1181-for-aikido-critical-cves

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Around line 65-66: Update the direct axios dependency specification in
package.json to exactly match the existing axios override at 1.18.1, ensuring
npm accepts the direct dependency override. Then validate dependency resolution
with npm install --package-lock-only --ignore-scripts --dry-run.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5295b074-0f81-4503-a625-6a33fe467e35

📥 Commits

Reviewing files that changed from the base of the PR and between 9f41030 and 7865078.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• package.json

[0xDEnYO]

Re-triggering protect-critical-code — it only runs on pull_request_review and had not reported on the current head commit (branch was updated to pick up the injective targetEvmVersion fix).

[lifi-qa-agent]

🔍 QA Review — EXSC-728 — Axios CVE Remediation (Bun Overrides)

Field	Value
Ticket	EXSC-728
PR	#2160
Reviewer	lifi-qa-agent[bot] (Run #30 — 2026-07-31)
Verdict	✅ Pass

---

Summary

PR #2160 correctly remediates the Aikido-flagged CVE-2026-40175 (and related axios high/critical findings) by pinning axios to 1.18.1 in both the direct dependency and the overrides field of package.json. The bun.lock lockfile confirms all 8 previously vulnerable transitive copies have been collapsed to the pinned version.

---

Acceptance Criteria Verification

AC	Status	Notes
axios pinned in package.json dependencies	✅	Changed from "^1.9.0" → "1.18.1" (exact pin)
axios added to overrides section	✅	"axios": "1.18.1" in overrides — forces all transitive consumers
bun.lock reflects pinned version throughout	✅	All 8 transitive copies of axios now resolve to 1.18.1
No unintended dependency regressions	✅	Only package.json and bun.lock changed; no Solidity or test changes
Overrides field uses exact version (not range)	✅	"1.18.1" not "^1.18.1" — prevents future drift

---

Findings

None. The fix is minimal and correct.

Earlier concern resolved: A prior draft had a mismatch between "^1.18.1" in overrides and "1.18.1" in dependencies, which could have caused an EOVERRIDE lockfile conflict. The final commit uses "1.18.1" (exact) in both fields — this is the correct form.

---

Process Items

None required. This is a dependency-only change with no audit surface; versionControlAndAuditCheck.yml is not triggered.

---

🤖 Automated QA review by lifi-qa-agent[bot]. Methodology: Linear AC verification + diff analysis + lockfile audit.

[lifi-qa-agent]

✅ QA AI Approved (Run #30 — 2026-07-31). axios@1.18.1 pinned correctly in both dependencies and overrides; all 8 transitive vulnerable copies eliminated. No regressions.