chore: use semver range for axios

[Danil42Russia]

Pinning the version of your dependencies, if you are the library provider, is not the best solution to security-related issues. On the contrary, it makes it more difficult to resolve problems when your dependencies encounter issues.

For example, the current version of axios has an issue: GHSA-q8qp-cvcw-x6jj:

ton % yarn npm audit
└─ axios: 1.15.0
   ├─ ID: 1118607
   ├─ Issue: Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
   ├─ URL: https://github.com/advisories/GHSA-q8qp-cvcw-x6jj
   ├─ Severity: high
   ├─ Vulnerable Versions: >=1.0.0 <1.15.2
   ├─ Patched Versions: >=1.15.2
   ├─ Via: axios
   └─ Recommendation: Upgrade to version 1.15.2 or later

In my project, I would simply update axios and the problem would be sorted. But because the version is explicitly specified, I’ll have to use overrides

Additionally, this creates a problem with duplicate dependencies, as the version of axios required by your package will be installed separately, even if the project specifies ^1.15.0. This means that if the project uses axios version ^1.16.0, it will encounter issues when building the TypeScript project

Summary by CodeRabbit

• Chores
  • Updated dependency versioning to allow installation of compatible minor releases, enabling access to potential security patches and improvements within the same major version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 779d9aaa-dea6-4c76-a1a3-a6141a9037a2

📥 Commits

Reviewing files that changed from the base of the PR and between f4adbd0 and 9ef99a4.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The axios dependency constraint in package.json is relaxed from a pinned exact version (1.15.0) to a caret range (^1.15.0), enabling installation of compatible minor and patch releases within the 1.x version line.

Changes

Dependency Version Relaxation

Layer / File(s)	Summary
Axios version specifier update package.json	The axios dependency version is changed from pinned (1.15.0) to a caret range (^1.15.0), allowing npm to install newer 1.x releases that satisfy the compatibility constraint.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• ton-org/ton#187: Also modifies package.json to update the axios dependency version constraint.
• ton-org/ton#185: Adjusts the axios dependency version/range in package.json, affecting which release gets installed.

Suggested reviewers

• Kaladin13
• Mobyman
• blink141

Poem

🐰 A pinned dependency loosens its grip,
Now compatible versions can make the trip,
Caret ranges allow minor fixes through,
Keeping axios fresh, while staying true!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: use semver range for axios' accurately and concisely describes the main change—updating the axios dependency from a pinned version to a semantic version range.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Shvandre]

Very good