Update Axios to remove security warning

[xiehan]

Fixes https://github.com/hashicorp/js-releases/security/dependabot/10

I have no idea why Dependabot can't seem to generate an update for this itself, but whatever.

Please ping me when this gets released so I can update terraform-cdk-action which is also getting this warning (https://github.com/hashicorp/terraform-cdk-action/security/dependabot/15)

[radeksimko]

I have no idea why Dependabot can't seem to generate an update for this itself, but whatever.

I believe it's because it's configured to only update as long as the update involves the lock file only. Our package.json assumes compatibility constraints between major and minor versions.

js-releases/.github/dependabot.yml

Line 4 in 78e5913

versioning-strategy: lockfile-only

Whether that's right or wrong I don't know but it "works as intended" if the intention is what's written in the config file. 😁

We already use v1.4.0 in vscode-terraform and so I'm assuming this was simply forgotten about and we aren't stuck with that old version because of any compatibility reasons.

@jpogran do you have any more context here, before we ship it?

[jpogran]

We used "axios": "^0.25.0" which uses the caret symbol. That means include any version that does not increment major, or the first non zero part. Since we had 0, and the fix was in 1, it wasn't automatically bumped because its considered a possible breaking change.

[jpogran]

Tested locally since the tests mock axios and all seems to work