[DWS] Update axios to 1.19.0 and form-data to 4.0.6 (30 advisories)

[nickwinder]

Why

axios@1.13.2 and form-data@4.0.5 are runtime dependencies, so every consumer of this SDK inherits them. Between them they carry 30 open advisories, several rated high, and the affected code paths are the ones this library uses on every single request.

npm audit --omit=dev reported 15 vulnerabilities before this change and reports 0 after.

Both fixes were already inside the declared semver ranges (^1.13.2 → 1.19.0, ^4.0.5 → 4.0.6). They had simply never been installed — this is a lockfile refresh, not a version-range change.

What changed

• axios 1.13.2 → 1.19.0 — clears 29 advisories.
• form-data 4.0.5 → 4.0.6 — clears CRLF injection via unescaped multipart field names and filenames (GHSA-hmw2-7cc7-3qxx).
• CHANGELOG.md — ### Security entry under 3.0.0.

No source change. No API change.

Why this is reachable, not theoretical

src/http.ts builds every file upload with form-data and dispatches every request through axios. The advisories below sit directly on that path:

Advisory	Impact
GHSA-445q-vr5w-6q77	CRLF injection in multipart/form-data bodies
GHSA-hmw2-7cc7-3qxx	CRLF injection via multipart field names/filenames
GHSA-6chq-wfr3-2hj9	Header injection via prototype pollution
GHSA-w9j2-pvgh-6h63	Authentication bypass via validateStatus merge gadget
GHSA-3p68-rc4w-qgx5, GHSA-m7pr-hjqh-92cm	SSRF via NO_PROXY hostname / IP-alias bypass
GHSA-p92q-9vqr-4j8v	Proxy-Authorization leak across HTTP→HTTPS redirect

Design notes worth a look

• Kept deliberately separate from the toolchain refresh. This PR is releasable on its own and is safe to fast-track; it touches two lines of package.json plus the lockfile. The dependency/tooling work is stacked on top in a follow-up PR.
• Changelog entries land under 3.0.0, not a new version. 3.0.0 is prepared in-repo but was never published — npm latest is 2.1.0 — so this folds into the pending release rather than needing its own.
• 3.0.0 is where these fixes first reach users. Anyone still on 2.1.0 remains exposed; 2.1.0 pins axios@^1.13.2 and form-data@^4.0.5.

Verification

All commands run on the branch head.

Production dependency tree is clean (was 15 vulnerabilities):

$ npm audit --omit=dev
found 0 vulnerabilities

$ npm ls axios form-data --depth=0
├── axios@1.19.0
└── form-data@4.0.6

Definition of done (AGENTS.md) — all pass:

$ npm run typecheck        # tsc --noEmit — exit 0
$ npm run lint             # eslint — exit 0, 0 problems
$ npm run test:unit
Test Suites: 11 passed, 11 total
Tests:       315 passed, 315 total

The unit suite is the relevant regression signal: src/__tests__/unit/http.test.ts covers request construction, multipart assembly, and error mapping across the axios boundary. 315/315 pass, unchanged from the pre-upgrade baseline on main.

Build:

$ npm run build
ESM dist/index.js   114.05 KB  ⚡️ Build success
CJS dist/index.cjs  114.91 KB  ⚡️ Build success
# dist/index.js, dist/index.cjs, dist/index.d.ts all present

Integration tests (npm run test:integration) were not run here — they require a live API key.