[PLAT-9529] - Vulnerability: api-client-node to axios v1.20.0

[sksizer]

Author	Host	When
Agent:(claude-opus-5-5)	Cursor on SKs-MacBook-Pro.local	2026-10-08 14:02 CDT

Summary

This moves the SDK from axios 1.18.0 to 1.20.0, clearing the critical and high axios findings a customer reported against @vertexvis/api-client-node 0.44.0. It also bumps the package to 0.44.1 so the publish workflow releases it.

• package.json: "axios": "1.20.0" (still pinned exactly) and version 0.44.1.
• yarn.lock: only the axios entry and its form-data ^4.0.6 range change. form-data still resolves to 4.0.6 through the existing resolution.
• client/version.ts: 0.44.1, synced by scripts/version.sh through yarn version --no-git-tag-version. No v0.44.1 tag was created, so detect_publish.sh will publish on merge.
• common.ts: adds as Promise<R> on axios.request. axios 1.20.0's types made tsc fail here with TS2527 (an inferred type references an unexported unique symbol). The same fix is added to scripts/generate.sh as a post-generation sed, alongside the existing ones, so regenerating the client keeps it. The published declarations match 0.44.0, apart from axios's own new defaulted fourth type parameter on AxiosResponse.

Test Plan

• yarn install --frozen-lockfile: passed.
• yarn lint: passed.
• yarn verify: passed. This covers the CJS and ESM builds, jest (10/10) and verify.js.
• yarn audit --groups dependencies: before, 12 axios advisories (7 high, 5 moderate, all patched in >=1.20.0); after, 0 vulnerabilities.
• npm pack: the tarball is 0.44.1, and its package.json declares axios 1.20.0.
• Declarations: diffed dist/cjs/*.d.ts against the 0.44.0 tarball from npm. The only change is axios's defaulted type parameter.
• Smoke test against a local mock API, with axios 1.20.0 loaded from this branch: 41/41 assertions passed.
  • Covered: the OAuth client-credentials request (Basic auth and form body), Bearer and user-agent: vertex-api-client-node/0.44.1 headers, timeout and a keep-alive httpAgent through axiosOptions, createFile plus an application/octet-stream upload with a byte-identical body, getFile, deleteFile, and a 404 surfaced through the response interceptor.
  • Eight broken-server modes all reported FAIL or INCONCLUSIVE rather than PASS.
• Not run: the same smoke script against platdev, because no platdev API client credentials were available to the agent. It is ready for a person to run.

Release Notes

@vertexvis/api-client-node 0.44.1 updates its HTTP client dependency, axios, to 1.20.0, resolving the critical and high security advisories reported against axios 1.18.0. There are no API changes: upgrade the dependency and refresh your lockfile.

Possible Regressions

• axios 1.19 and 1.20 harden how config options are read, how errors for bad option values are reported, NO_PROXY matching, and keep-alive socket handling. The SDK uses a plain axios.create instance, one response interceptor, basic and Bearer auth, and octet-stream uploads. None of these touch the changed behavior; this is inferred from the release notes and was exercised against the mock.
• The deprecated CancelToken, used by queued-job polling, still exists in 1.20.0.

Dependencies

• vertex-api-client-node#182 also bumps the package version, to 0.45.0. Whichever lands second has to rebase. Landing this one first ships the security fix as a patch release, without the spec changes.

Related

• PLAT-9529
• The earlier axios bump: vertex-api-client-node#178

---

Note

Medium Risk
Upgrading axios affects all HTTP traffic through the SDK; risk is moderated by a patch-level dependency bump and a type-only workaround, but runtime behavior could still shift with axios 1.19–1.20 hardening.

Overview
Patches @vertexvis/api-client-node to 0.44.1 and upgrades the pinned axios dependency from 1.18.0 to 1.20.0, addressing reported critical/high advisories on the prior version (lockfile updates include axios’s form-data range).

axios 1.20.0’s typings break compilation in createRequestFunction (common.ts); the PR adds as Promise<R> on axios.request and mirrors that in scripts/generate.sh so regenerated clients keep the fix. No public API surface changes beyond the version bump.

^{Reviewed by Cursor Bugbot for commit fb7dc2f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.