fix(security): upgrade axios to 1.15.0 for GHSA-3p68-rc4w-qgx5

[subrata71]

Summary

• Upgrade axios to ^1.15.0 in app/client/package.json and app/client/packages/rts/package.json to remediate GHSA-3p68-rc4w-qgx5 / CVE-2025-62718.
• Regenerate app/client/yarn.lock so all client workspace consumers (including wait-on) resolve to axios@1.15.0.
• Add RTS regression coverage in app/client/packages/rts/src/__tests__/axiosNoProxyNormalization.test.ts to verify loopback host variants are not proxied when NO_PROXY is set.

Test plan

• yarn install --mode=skip-build (from app/client)
• yarn why axios shows axios@1.15.0 for appsmith, appsmith-rts, and wait-on
• yarn test:unit (from app/client/packages/rts)
• yarn lint (from app/client/packages/rts)
• yarn build (from app/client)
• npx prettier --write ./src ./cypress (from app/client)
• npx eslint --fix -c ./cypress/.eslintrc.json --cache ./cypress (from app/client) - command was run multiple times but hangs in this local environment without producing completion output.
• yarn g:jest src/api/__tests__/apiRequestInterceptors.test.ts src/api/__tests__/apiFailureResponseInterceptors.test.ts src/api/__tests__/apiSucessResponseInterceptors.test.ts (from app/client) - fails in this environment due missing canvas binary (Cannot find module '../build/Release/canvas.node').

Fixes https://linear.app/appsmith/issue/APP-15127/security-critical-dependabot-alert-580-axios-no-proxy-hostname

Summary by CodeRabbit

• Chores

  • Updated HTTP client library dependencies across packages to the latest compatible version for improved stability and performance.

• Tests

  • Added test coverage for proxy configuration normalization behavior to ensure reliable network connectivity.

Automation

/ok-to-test tags="@tag.All"

Tip

🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/24443669428
Commit: ce5b569
Cypress dashboard.
Tags: @tag.All
Spec:

---

Wed, 15 Apr 2026 09:39:49 UTC

[coderabbitai]

Walkthrough

Updated axios dependency from ^1.12.0 to ^1.15.0 across multiple package.json files and added a new Jest test validating axios NO_PROXY normalization behavior for loopback host variants with environment variable restoration and proxy request verification.

Changes

Cohort / File(s)	Summary
Axios Dependency Updates app/client/package.json, app/client/packages/rts/package.json	Upgraded axios from ^1.12.0 to ^1.15.0 across main and RTS package configurations, including resolutions section.
Test Suite app/client/packages/rts/src/__tests__/axiosNoProxyNormalization.test.ts	Added Jest test validating axios NO_PROXY normalization for loopback variants with environment variable capture/restore and zero proxy request assertions.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• fix: CVE-2025-58754 by upgrading axios dependency #41295: Modifies identical axios dependency entries in the same package.json files for version upgrades.

Suggested labels

Bug, ok-to-test

Suggested reviewers

• riodeuno
• ashit-rath

Poem

🚀 Axios climbs from one-two to one-five,
NO_PROXY normalization comes alive,
Loopback hosts verified with care,
Proxy attempts? None sneak through there! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly describes the main security fix: upgrading axios to address a specific CVE vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	PR description includes objectives, test plan with detailed status, and Cypress results, but lacks explicit issue reference and DevRel communication checkbox.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/axios-ghsa-3p68-rc4w-qgx5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[linear]

APP-15127 [Security] [CRITICAL] Dependabot alert #580: Axios NO_PROXY hostname normalization bypass (SSRF)