[skyflow-himanshupal]

Summary

Upgrades the dependencies flagged by Endor Labs on the v1 branch under the policy "High outdated packages, having fix and is potentially reachable from Skyflow's code".

Jira: https://skyflow.atlassian.net/browse/SK-2906

Vulnerabilities resolved

Advisory	Package	Issue	Before	After
GHSA-mghh-pgcx-3jjj	axios	ReDoS in shouldBypassProxy host normalization	1.15.0	1.20.0
GHSA-542g-h47m-68v8	axios	DoS via unhandled error event in HTTP/2 session init	1.15.0	1.20.0
GHSA-hmw2-7cc7-3qxx	form-data	CRLF injection via unescaped multipart field names/filenames	4.0.4	4.0.6
GHSA-869p-cjfg-cm3x	jws (via jsonwebtoken)	Improper HMAC signature verification	3.2.2	4.0.1

Changes

• package.json
  • axios: 1.15.0 → 1.20.0
  • form-data: ^4.0.4 → ^4.0.6
  • jsonwebtoken: ^9.0.0 → ^9.0.3 (pulls in jws@4.0.1)
• package-lock.json: regenerated. Only these resolved versions changed:
  • axios 1.15.0 → 1.20.0
  • form-data 4.0.4 → 4.0.6 (axios's nested form-data@4.0.5 copy is removed)
  • jsonwebtoken 9.0.2 → 9.0.3
  • jws 3.2.2 → 4.0.1
  • jwa 1.4.1 → 2.0.1
  • follow-redirects 1.16.0 → 1.16.1
  • The lockfile stays at lockfileVersion: 1 to keep the diff small.

Testing

• npm run build (tsc) passes.
• npm test: 193 passed, 6 failed. The same 6 tests in test/GenerateToken.test.js also fail on the original lockfile, so this change doesn't introduce them.

Notes

• No source code changes. jsonwebtoken's public API is unchanged in 9.0.3.

[github-actions]

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.