chore(deps): Bump axios from 1.15.1 to 1.15.2

[dependabot]

Bumps axios from 1.15.1 to 1.15.2.

Release notes

Sourced from axios's releases.

v1.15.2

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

• Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
• SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
• Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

• allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

• Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

• Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

Changelog

Sourced from axios's changelog.

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

• Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
• SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
• Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

• allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

• Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

• Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

---

Commits

• 5829343 chore(release): prepare release 1.15.2 (#10789)
• 4709a48 fix: added fix for memory leak in sockets (#10788)
• be33360 chore: update changelog (#10781)
• 4791514 fix: more header pollutions (#10779)
• 6feafcf fix: socket issue (#10777)
• 302e273 docs: update docs, add a couple actions etc (#10776)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Test Results

 11 files  ± 0   52 suites  +13   42m 12s ⏱️ - 15m 52s
202 tests  -  6  202 ✅  -  6  0 💤 ±0  0 ❌ ±0 
236 runs  +28  236 ✅ +28  0 💤 ±0  0 ❌ ±0 

Results for commit 164fdcb. ± Comparison against base commit 8ec0f16.

This pull request removes 40 and adds 34 tests. Note that renamed tests count towards both.

should airdrop 10 NFTs to multiple accounts ‑ HIP904Batch1 AirdropContract Test Suite should airdrop 10 NFTs to multiple accounts
should airdrop 10 tokens to multiple accounts ‑ HIP904Batch1 AirdropContract Test Suite should airdrop 10 tokens to multiple accounts
should airdrop a fungible token (FT) to a single account ‑ HIP904Batch1 AirdropContract Test Suite should airdrop a fungible token (FT) to a single account
should airdrop a non-fungible token (NFT) to a single account ‑ HIP904Batch1 AirdropContract Test Suite should airdrop a non-fungible token (NFT) to a single account
should airdrop fungible token (FT) to a single account using distribute ‑ HIP904Batch1 AirdropContract Test Suite should airdrop fungible token (FT) to a single account using distribute
should airdrop fungible tokens (FT) to multiple accounts ‑ HIP904Batch1 AirdropContract Test Suite should airdrop fungible tokens (FT) to multiple accounts
should airdrop non-fungible token (NFT) to a single account using distribute ‑ HIP904Batch1 AirdropContract Test Suite should airdrop non-fungible token (NFT) to a single account using distribute
should airdrop non-fungible tokens (NFT) to multiple accounts ‑ HIP904Batch1 AirdropContract Test Suite should airdrop non-fungible tokens (NFT) to multiple accounts
should cancel a single pending NFT airdrop ‑ HIP904Batch2 CancelAirdropContract Test Suite should cancel a single pending NFT airdrop
should cancel a single pending fungible token airdrop ‑ HIP904Batch2 CancelAirdropContract Test Suite should cancel a single pending fungible token airdrop
…

should NOT be able to use transferFrom on NFT tokens without approval ‑ TokenTransferContract Test Suite should NOT be able to use transferFrom on NFT tokens without approval
should NOT be able to use transferFrom on fungible tokens without approval ‑ TokenTransferContract Test Suite should NOT be able to use transferFrom on fungible tokens without approval
should be able to associate() to the token from a contract ‑ @HRC-719 Test Suite HRC719 wrapper contract should be able to associate() to the token from a contract
should be able to associate() to the token from an EOA ‑ @HRC-719 Test Suite HRC719 Token should be able to associate() to the token from an EOA
should be able to call isAssociated() after token association ‑ @HRC-719 Test Suite HRC719 wrapper contract should be able to call isAssociated() after token association
should be able to call isAssociated() after token dissociation ‑ @HRC-719 Test Suite HRC719 wrapper contract should be able to call isAssociated() after token dissociation
should be able to call isAssociated() to the token from an EOA when associated ‑ @HRC-719 Test Suite HRC719 Token should be able to call isAssociated() to the token from an EOA when associated
should be able to call isAssociated() to the token from an EOA when dissociated ‑ @HRC-719 Test Suite HRC719 Token should be able to call isAssociated() to the token from an EOA when dissociated
should be able to call isAssociated() to the token from an EOA ‑ @HRC-719 Test Suite HRC719 Token should be able to call isAssociated() to the token from an EOA
should be able to call isAssociated() ‑ @HRC-719 Test Suite HRC719 wrapper contract should be able to call isAssociated()
…