UITEST-144: Bump axios from 1.16.1 to 1.18.1 fixing vulns

[julianladisch]

https://folio-org.atlassian.net/browse/UITEST-144

The axios version pinned in the yarn.lock file of the repo should be in sync with the version used in FOLIO flower releases to get reproducible test results when working with a check-out of the stripes-testing repo.

Bumping axios from 1.16.1 to 1.18.1 will fix 10 security vulnerabilities, see https://github.com/axios/axios/security:

• Deep formToJSON Key Recursion Can Cause Denial of Service – GHSA-pmv8-rq9r-6j72 – Moderate
• Excessive recursion in formDataToJSON can cause denial of service – GHSA-42h9-826w-cgv3 – Moderate
• Prototype pollution auth subfields can inject Basic auth – GHSA-xj6q-8x83-jv6g – Moderate
• NO_PROXY bypass for 0.0.0.0 local addresses in axios – GHSA-f4gw-2p7v-4548 – Moderate
• Prototype pollution gadgets can alter axios request construction – GHSA-mmx7-hfxf-jppx – Moderate
• Fetch adapter ReadableStream uploads bypass maxBodyLength – GHSA-jqh4-m9w3-8hp9 – Moderate
• HTTP/2 streamed uploads bypass maxBodyLength – GHSA-mwf2-3pr3-8698 – Moderate
• Nested axios option objects can consume polluted prototype values – GHSA-7q8q-rj6j-mhjq – Moderate
• Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning – GHSA-gcfj-64vw-6mp9 – High
• Axios form serializer maxDepth bypass via {} metatoken – GHSA-hcpx-6fm6-wx23 – moderate

The effort to make a detailed check how stripes-testing might be affected by the vulnerabilities is much higher than bumping the axios version just to be sure.

[zburke]

The axios version pinned in the yarn.lock file of the repo should be in sync with the version used in FOLIO flower releases to get reproducible test results when working with a check-out of the stripes-testing repo.

Sorry, @julianladisch, I don't understand what this statement is trying to convey. Where is "the version used in FOLIO flower releases" defined and who chose it and when? When that version changes, how are folks notified?

The effort to make a detailed check how stripes-testing might be affected by the vulnerabilities is much higher than bumping the axios version just to be sure.

This statement is so shockingly short-sighted, I can only assume it's ragebait. If the effort to test things is too high, let's just save you a bunch of future work and delete this entire repository.