Update pnpm and axios dependencies

[yosriady]

Summary

This PR updates the project's package manager and a core dependency to their latest versions, along with adding workspace configuration.

Key Changes

• Package Manager: Upgraded pnpm from 10.28.2 to 11.1.2
• Dependencies: Updated axios from ^1.7.0 to ^1.15.2
• Workspace Config: Added pnpm-workspace.yaml with esbuild allowBuilds configuration

Implementation Details

The new pnpm-workspace.yaml file enables esbuild builds within the pnpm workspace, which may be necessary for the upgraded pnpm version or to support future workspace features. The axios upgrade brings in the latest bug fixes and improvements while maintaining backward compatibility within the semver range.

https://claude.ai/code/session_016houJLoqJuTAUFhQE8AVs6

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	axios@​1.16.1

View full report

[gemini-code-assist]

Code Review

This pull request updates the pnpm package manager version and modifies project dependencies, including an update to axios and the removal of dependency overrides in the lockfile. However, the review identifies critical security concerns: the specified axios version (1.16.1) does not exist in the official registry and appears suspicious, suggesting a potential supply chain attack. Additionally, the removal of overrides has caused a security regression by downgrading serialize-javascript to a vulnerable version.

I am having trouble creating individual review comments. Click here to see my feedback.

package.json (32)

The version ^1.15.2 for axios (and the resolved 1.16.1 in the lockfiles) does not exist on the official npm registry. The current stable version of axios is 1.7.9. Furthermore, the lockfile changes show this version introducing a dependency on https-proxy-agent, which is not part of the official axios package. This is highly suspicious and could indicate a supply chain attack or dependency confusion. Please revert to the official version.

    "axios": "^1.7.9",

pnpm-lock.yaml (7-9)

The overrides section has been removed from the lockfile. This has resulted in serialize-javascript being downgraded from 7.0.5 to 6.0.2 (as seen in line 930), which violates the requirements defined in package.json and introduces a security regression. Older versions of serialize-javascript are known to have vulnerabilities.

[yosriady]

Thanks for the review. Addressing both points:

1. axios 1.16.1 — not a supply chain issue (no change needed).
This appears to be based on a stale knowledge cutoff. Verified directly against the official npm registry:

• npm view axios version → 1.16.1 is the current latest (published 2026-05-13), tarball https://registry.npmjs.org/axios/-/axios-1.16.1.tgz.
• The lockfile integrity (sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==) matches the registry's published dist.integrity exactly.
• https-proxy-agent@^5.0.1 is an officially declared dependency of axios@1.16.1 per registry metadata — not an injected dependency.
• The Socket Security check on this PR independently scored axios@1.16.1 100/100 for vulnerability and supply-chain-clean.

1.7.9 was the latest in late 2024; axios has since progressed to 1.16.x. The bump to ^1.15.2 (resolving to 1.16.1) is the intended fix for the reported axios CVEs, so I'm keeping it.

2. serialize-javascript override — valid catch, fixed.
You're right that the pnpm lockfile had dropped the serialize-javascript >=7.0.5 override and downgraded it to 6.0.2. Root cause: pnpm 11 reads overrides from pnpm-workspace.yaml, not the package.json pnpm.overrides field, so the lockfile regen lost it. Fixed in ed6098c by moving the override into pnpm-workspace.yaml. serialize-javascript is now back to 7.0.5 in both pnpm-lock.yaml and package-lock.json, and the overrides: block is restored in the lockfile.

---

Generated by Claude Code