[rcooney-sh]

Clears Aikido AIKIDO-2026-10823 (axios, patched in 1.16.1) for setup-docker-builder, tracked in Linear SEC-690. Aikido flagged axios 1.15.0 in pnpm-lock.yaml and 1.13.4 in package-lock.json.

axios is a direct dependency (used in src/reporter.ts and src/buildkit-installer.ts), so it's bumped directly instead of through an override. 1.20.0 is the latest 1.x and covers the rest of the axios advisories in the vulnagent batch (the ticket asks for >=1.18.0):

-    "axios": "^1.7.2",
+    "axios": "^1.20.0",

The lockfile moves axios 1.15.0 -> 1.20.0. It also pulls in axios's new transitive deps: follow-redirects 1.15.11 -> 1.16.1, form-data 4.0.5 -> 4.0.6, hasown 2.0.4, https-proxy-agent 5.0.1, and agent-base 6.0.2. axios-retry 4.5.0 is unchanged; its peer range axios: 0.x || 1.x still matches.

Why package-lock.json is removed: the repo uses pnpm. engines.pnpm is 10.33.0, there's a pnpm-workspace.yaml, every workflow (build, lint, verify-build, release) runs pnpm install, and the lefthook pre-commit hook only diffs pnpm-lock.yaml. package-lock.json was last touched in #91 and has drifted. It still pins @buf/blacksmith_vm-agent.bufbuild_es 1.9.0, @connectrpc/connect ^1.6.1, and a connectrpc_es package that package.json no longer declares. Nothing reads it except scanners, so it's deleted instead of being regenerated as a second source of truth.

dist/ is intentionally not rebuilt here. dist/index.js still bundles axios 1.15.0, so verify-build will fail until a maintainer rebuilds and commits dist on this branch:

# Node 20 (CI: actions/setup-node node-version "20"; .npmrc pins use-node-version=20.19.4) and pnpm 10.33.0
npm config set @buf:registry https://buf.build/gen/npm/v1/
npm config set //buf.build/gen/npm/v1/:_authToken "$BUF_TOKEN"
pnpm install --frozen-lockfile
pnpm run build   # ncc build src/main.ts -o dist --source-map --minify --license licenses.txt
git add dist && git commit -m "dist: rebuild with axios 1.20.0" && git push

After merge, the running artifact only changes once a release is cut: run the Release workflow from main with version v1.14.0 and update-major checked, which moves v1. v2 lives on release/v2 and has its own backport PR.

Promotion risk: Low. This is a minor-version bump of one HTTP client (axios 1.15.0 -> 1.20.0, same 1.x API) used in two non-critical call sites. The only behavior change Proof saw is how HTTPS goes through a proxy, and nobody has tested that on a real proxied runner.

• Runtime change: none until dist/ is rebuilt; this diff alone changes no shipped code. @main consumers get it at merge, @v1 consumers when v1.14.0 moves the tag. After that, dist/index.js bundles axios 1.20.0. axios is used for Blacksmith API/metrics reporting in src/reporter.ts (failures there only log core.warning) and the BuildKit tarball download from github.com in src/buildkit-installer.ts. The download only runs when a job sets buildkit-version to a version that isn't preinstalled. The v1.14.0 release also ships the unreleased discard the sticky disk's resolv-host.conf before buildkitd starts #140 (resolv-host.conf), which is not part of this risk call.
• What could break:
  • Proxy handling (untested on a real proxied runner). With HTTPS_PROXY set, axios now tunnels HTTPS through CONNECT via the new https-proxy-agent@5.0.1 dependency. 1.15.0 sent absolute-URL GETs to the proxy; the change is the 1.16.1 "proxy cleartext leak" fix. A proxy that refuses CONNECT would make the BuildKit download fail and the setup step error with Installing BuildKit ... followed by an axios error. Reporting calls would only emit warnings.
  • Stricter request handling from 1.16-1.19: maxContentLength is enforced on streams, malformed http:/https: URLs are rejected, and NO_PROXY matching changed. None of these touch the fixed URLs this action uses.
  • axios-retry 4.5.0 is unchanged; its peer range 0.x || 1.x still matches.
• Evidence:
  • CI (test-action.yml, test-buildkit-version.yml) ran pnpm install && pnpm run build and then uses: ./ on real Blacksmith runners, all green. That is a full ncc/TypeScript compile with axios 1.20.0, plus a real builder setup that includes the custom-BuildKit download path.
  • Proof ran the real reporter.ts and buildkit-installer.ts on 1.15.0 vs 1.20.0: 503 retries, give-up after 5 retries, and the GitHub download behaved identically. Through a permissive test proxy the download succeeded on both versions; the only difference was CONNECT vs plain forwarding.
  • NOT exercised: a runner behind a real corporate proxy (restrictive or CONNECT-only), or the committed dist/ (not rebuilt yet, so verify-build fails).
• Blast radius / rollback / watch:
  • Blast radius: every workflow on @v1 once the v1 tag moves. That includes customers whose workflows Blacksmith's migration tool rewrote to @v1, and FastActions/fa image builds. @main consumers (fa docker_cron.yaml, test-buildx-caching.yml) pick it up at merge. SHA pins (fa build-push-heimdall.yaml, kubernetes, dns) are unaffected until bumped.
  • Rollback: re-point v1 to v1.13.0 (git tag -fa v1 v1.13.0^{} && git push --force origin v1). No data or state is involved.
  • Watch: for 24-48h after the tag moves, watch BuildKit-install failures and Failed to report ... warnings in setup-docker-builder runs, especially jobs that set buildkit-version or HTTPS_PROXY.

Action HTTP calls work on axios 1.20.0

Retries, give-up after 5 retries, and the BuildKit download from GitHub behave identically on 1.15.0 and 1.20.0

_Merge-base

_{This PR a3ef3d6c}

Also checked · 3 more claims, all matched observations

Frozen pnpm install accepts lockfile
dist still bundles axios 1.15.0
BuildKit download through HTTPS_PROXY

_{Proof on a3ef3d6c}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled. (Staging)}

[linear-code]

SEC-690