[FEEDS-1217] Upgrade axios and other dependencies to fix security vulnerabilities

[itsmeadi]

Summary

This PR upgrades critical dependencies to fix 9 security vulnerabilities in production dependencies.

Changes

Dependency Upgrades

• axios: 0.x (0.27.2) → ^1.13.5
• form-data: ^4.0.0 → ^4.0.4
• qs: ^6.10.2 → ^6.14.2
• @babel/runtime: ^7.23.2 → ^7.26.10
• jws: Added yarn resolution to ^3.2.3 (dependency of jsonwebtoken)

Security Vulnerabilities Fixed

• ✅ axios: CSRF vulnerability (moderate)
• ✅ axios: SSRF and credential leakage (high)
• ✅ axios: DoS via proto pollution (high)
• ✅ form-data: Unsafe random function (critical)
• ✅ qs: DoS via bracket notation (high)
• ✅ qs: DoS via comma parsing (low)
• ✅ @babel/runtime: RegExp complexity issue (moderate)
• ✅ jws: HMAC signature verification (high)

Code Changes

Updated TypeScript imports for axios 1.x compatibility:

• src/client.ts
• src/files.ts
• src/images.ts

Changed import AxiosProgressEvent from 'axios' to import type { AxiosProgressEvent } from 'axios'

Testing

• ✅ Build successful
• ✅ Linting passed
• ✅ Type checking passed
• ✅ Result: 9 vulnerabilities → 0 vulnerabilities in production dependencies

Note

Some devDependencies still have vulnerabilities (puppeteer, eslint, mocha), but these don't affect the published package.

[github-actions]

Size Change: 0 B

Total Size: 109 kB

ℹ️ View Unchanged

Filename	Size
dist/js_min/getstream.js	35.5 kB
dist/js/getstream.js	73.9 kB

_{compressed-size-action}