[GuillaumeLagrange]

Bump axios to ^1.21.0 and form-data to ^4.0.6 in @codspeed/core and refresh the lockfile.

The Rollup build bundles these dependencies into dist/ from the versions pinned in pnpm-lock.yaml, which still held axios 1.4.0, follow-redirects 1.15.2 and form-data 4.0.4. The declared ranges already allowed fixed releases, so npm audit reported nothing for users while the inlined copies stayed vulnerable (axios advisories fixed in 1.16.0, follow-redirects GHSA-r4q5-vmmm-2653, form-data GHSA-hmw2-7cc7-3qxx).

The lockfile now resolves axios 1.21.0, follow-redirects 1.16.0 and form-data 4.0.6. The rebuilt dist/index.cjs.js reports axios VERSION = "1.21.0". nx's axios is deduplicated to the same version.

Marking these packages external in Rollup would also fix it, but it changes how the package is built, which is a larger change than this fix needs. A republish of core and the plugins is needed for users to pick up the fix.

Closes #114
Closes COD-4066

[codspeed]

Merging this PR will degrade performance by 15.85%

3 warnings, 1 note

⚠️ Walltime results may be unreliable

Some benchmarks used the Walltime instrument outside CodSpeed Macro Runners, which can make the results inconsistent.

Learn more about Macro Runners

See affected benchmarks

⚠️ 14 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

⚠️ Base and head ran on different runner types

Some benchmarks with significant performance changes were compared across different runner types, so the changes might not come from the code. Run base and head on the same runner type, or use CodSpeed Macro Runners for more stable results.

Learn more about Macro Runners

Open the report in CodSpeed to investigate

ℹ️ 16 benchmarks have no flamegraph

The flamegraph wasn't generated: most of the time was spent in runtime internals, which would leave nothing useful to analyze.

See affected benchmarks

⚡ 5 improved benchmarks
❌ 10 regressed benchmarks
✅ 249 untouched benchmarks
⏩ 56 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	CPU Simulation	switch 1	306.7 µs	665.6 µs	-53.92%
❌	CPU Simulation	recursive fibo 10	334.6 µs	690.3 µs	-51.53%
❌	CPU Simulation	test_recursive_fibo_10	336.8 µs	685.6 µs	-50.88%
❌	CPU Simulation	switch 1	242.5 µs	418 µs	-41.99%
❌	CPU Simulation	wait 500ms	38.7 ms	50.7 ms	-23.68%
❌	CPU Simulation	wait 1sec	72.9 ms	88.7 ms	-17.84%
❌	Walltime	switch 1	72 ns	84 ns	-14.29%
❌	Walltime	switch 1	72 ns	84 ns	-14.29%
❌	Walltime	switch 1	72 ns	84 ns	-14.29%
❌	Walltime	switch 2	108 ns	120 ns	-10%
⚡	Walltime	fibo darwin	8.2 ms	5.2 ms	+59.12%
⚡	Memory	one	2 KB	1.5 KB	+35.48%
⚡	Walltime	test sync baz 10	144 ns	120 ns	+20%
⚡	Walltime	test sync baz 100	252 ns	216 ns	+16.67%
⚡	Walltime	test_iterative_fibo_10	132 ns	120 ns	+10%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing cod-4066-codspeedcore-inlines-axios-140-follow-redirects-1152-form (7f08f46) with main (727b808)}

Footnotes

1. 56 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates the dependencies bundled into @codspeed/core.

• Rebuilt core packages use newer Axios and form-data releases.

_{Reviews (1) · Last reviewed commit: "build(core): bump bundled axios and form..." · Reviewed by Greptile}