[Snyk] Security upgrade axios from 0.24.0 to 1.13.5

[TimCrooker]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• packages/cli/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-AXIOS-15252993	828

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[Copilot]

Pull request overview

This PR attempts to fix a high-severity Prototype Pollution vulnerability (SNYK-JS-AXIOS-15252993) by upgrading axios from version 0.24.0 to 1.13.5 in the packages/cli package. However, the upgrade is incomplete and has critical issues.

Changes:

• Upgraded axios dependency in packages/cli/package.json from ^0.24.0 to ^1.13.5

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This PR only upgrades axios in the cli package, but leaves axios at vulnerable versions in other packages. The packages/env package (line 36 of packages/env/package.json) still uses axios ^0.24.0, which is a dependency of grit-cli (line 45 here). The packages/youtill package (line 37 of packages/youtill/package.json) also uses axios ^0.24.0 and is a dependency of grit-cli (line 54 here). This creates a situation where the monorepo will still contain vulnerable versions of axios through transitive dependencies, defeating the purpose of this security upgrade.