deps(security): axios 1.10.0 -> 1.16.1

[luantruong6]

Security issue addressed

• Source: Aikido open-source findings for katalon-studio/katalon-agent: CVE-2026-42043, CVE-2025-62718, CVE-2026-42264, CVE-2026-42044, CVE-2026-40175, CVE-2026-42038, CVE-2026-42039, AIKIDO-2026-10823, CVE-2026-25639, CVE-2025-58754, CVE-2026-42033, CVE-2026-42035, CVE-2026-42041, CVE-2026-42042, AIKIDO-2026-10820, CVE-2026-42037, CVE-2026-42036, CVE-2026-42034, AIKIDO-2026-10509, CVE-2026-42040, AIKIDO-2026-10822, AIKIDO-2026-10819
• Type: dependency
• Severity: critical
• Affected component: axios in package.json / package-lock.json
• Summary: Aikido reports multiple vulnerable axios findings for the locked 1.10.0 version. This PR updates the direct axios dependency and lockfile to 1.16.1, the remediation target covering the current Aikido axios findings.

Tracking ticket

• KVDP/Jira: KVDP-9005
• Ticket status: existing
• Owner/queue: Unassigned

What changed

• Updated package.json direct dependency axios from ^1.6.8 to ^1.16.1.
• Updated package-lock.json to resolve axios from 1.10.0 to 1.16.1.
• Refreshed axios transitive lockfile entries, including follow-redirects, form-data, https-proxy-agent, and proxy-from-env resolution changes required by axios@1.16.1.

Expected impact

• Security impact: Removes the vulnerable locked axios@1.10.0 version identified by Aikido and resolves to the patched 1.16.1 target.
• Functional impact: No user-facing behavior expected; axios remains on the same major version.
• Operational impact: None expected.

Verification evidence

• Tests run: mise exec node@20.9.0 -- npm ci — pass; install completed from the refreshed lockfile.
• Tests run: mise exec node@20.9.0 -- npm run eslint — pass with existing warnings only (0 errors, 10 warnings).
• Tests run: mise exec node@20.9.0 -- npm run test:coverage — fail; existing Jest failures in test/service/command-executor.test.js plus timeout. The CI workflow currently runs this command with || true.
• Tests run: mise exec node@20.9.0 -- npm run build — pass; esbuild produced agent-bundle.js successfully.
• Tests run: mise exec node@20.9.0 -- npm ls axios --depth=0 — pass; reports axios@1.16.1.
• Security validation: mise exec node@20.9.0 -- npm audit --omit=dev --json — no axios entry in remaining production audit vulnerabilities; unrelated vulnerabilities remain in other packages.
• Compatibility check: CI and local runtime inspected as Node.js 20.9.0 via .nvmrc, GitHub Actions matrices, and Dockerfile; local verification used mise exec node@20.9.0.

Rollout and compatibility risk

• Risk level: low
• Compatibility notes: Same-major axios upgrade. Lockfile changes include axios transitive dependency updates expected for the patched release.
• Rollback plan: Revert this PR.

Ownership and review notes

• Suggested reviewers/owners: Repo owners
• Follow-ups: KVDP-9005 tracks this remediation. Remaining non-axios dependency findings should be handled separately.
• Human decision required: Engineering review/approval is required before merge.

Summary by Aikido

Security Issues: 0	Quality Issues: 0	✅ Resolved Issues: 19

⚡ Enhancements

• Updated axios dependency from ^1.6.8 to ^1.16.1 in package.json

^{More info}