chore: upgrade axios to 1.18.0

[joaodordio]

Description

Supersedes #577 from @vincent-tock, who reported that the pinned axios@1.14.0 fails Squarespace's vulnerability scan. Thanks for raising it and for the detailed report.

We couldn't take that PR directly for two reasons:

1. Its yarn.lock resolved axios and follow-redirects from artifactory.squarespace.net, a private mirror our CI and contributors can't reach.
2. It targeted 1.16.0, which is now itself affected by ten open advisories, including the high severity GHSA-gcfj-64vw-6mp9 (Node HTTP adapter can use an inherited proxy after interceptor config cloning). Every one of those is patched in 1.18.0.

This PR bumps the dependencies pin and the matching resolutions entry to 1.18.0, with a lockfile regenerated against the public registry.

Sample apps move too

react-example and example install their own copy of axios and were pinned to 1.14.0 alongside the root, same as the last bump in SDK-405. Moving only the root pin left tsc comparing two structurally different AxiosResponse types across the two node_modules trees, which broke the react-example build and took the e2e job down with it. Both pins now move in lockstep with the SDK, which restores the green build.

Why 1.18.0 and not the latest 1.20.0

1.20.0 adds a fourth generic P to AxiosResponse, which types config.params and config.data instead of leaving them any. That breaks compilation of src/authorization/authorization.test.ts in several places, e.g. JSON.parse(response.config.data) and response.config.params.email. Worth doing, but as its own change rather than folded into a security bump.

Note on the dependency tree

axios@1.18.0 adds https-proxy-agent@^5.0.1 as a runtime dependency. It's Node only and does not end up in the browser bundle (verified against the built index.js), but npm consumers will pick up one extra transitive dep. It already existed in the tree via http-proxy, so the lockfile just widens the existing range.

Test Steps

Run locally against main:

• yarn typecheck passes
• yarn test passes, 26/26 suites, 392 tests
• yarn build and yarn build:node compile cleanly
• yarn lint reports 0 errors
• react-example yarn build compiles cleanly
• All three yarn.lock diffs resolve entirely from registry.yarnpkg.com

CI is green, including e2e on chromium, firefox and webkit.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.43%. Comparing base (33e6f8e) to head (bd304ca).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #585   +/-   ##
=======================================
  Coverage   74.43%   74.43%           
=======================================
  Files          57       57           
  Lines        2742     2742           
  Branches      821      820    -1     
=======================================
  Hits         2041     2041           
  Misses        660      660           
  Partials       41       41           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.