[JeremyLoy]

Change the axios dependency from the exact version 1.20.0 to the range ^1.20.0.

Description

What problem is being solved?

The SDK pins axios to an exact version. Many applications that use the SDK also use axios directly. The exact pin causes these problems for those applications:

1. Two copies of axios. The package manager cannot deduplicate axios. If the application resolves a different axios version, two copies are installed.
2. Incompatible types. The public types of the SDK use axios types: AxiosInstance in dist/base.d.ts and AxiosError in dist/errors.d.ts. With two copies, an AxiosInstance that the application creates is not assignable to the SDK type. Also, the AxiosError from the SDK is not the same type as the AxiosError in the application.
3. Security fixes need an SDK release. The latest release (v0.9.7) pins axios@1.19.0, which has 9 published advisories. main pins 1.20.0 (chore(deps): bump the dependencies group with 4 updates #477), but that change is not released yet. Applications cannot get an axios patch release until the SDK publishes a new version. To work around this, applications must add resolutions / overrides entries.

How is it being solved?

#363 added the exact pin as a temporary response to the axios@1.14.1 supply chain attack. The "Follow-up" section of #363 says:

Once the Axios maintainers publish a verified clean release post-1.14.0, the pin can be relaxed back to a range.

axios@1.20.0 is a clean release after 1.14.0, so this PR does that follow-up.

The caret range ^1.20.0 keeps 1.20.0 as the minimum, so no consumer gets a version below that. Applications control which version they install. They do this with their lockfiles and with release-age policies such as Yarn npmMinimalAgeGate or pnpm minimumReleaseAge. An application can make that decision. A library cannot make it for all of its consumers.

I did not change axios to a peerDependency. That change requires all consumers to install axios themselves, which is a breaking change. A caret range fixes the problems above and is not a breaking change.

What changes are made to solve it?

• package.json: "axios": "1.20.0" → "axios": "^1.20.0".
• package-lock.json: The root dependency entry is updated. The resolved version is still axios@1.20.0.

References

• followup fix(deps): pin axios to 1.14.0 and fix brace-expansion audit vulnerability #363
• related chore(deps): bump the dependencies group with 4 updates #477

Request: after this PR is merged, please publish a release. Then consumers can get the axios fix from #477 without a resolutions / overrides entry.

Review Checklist

• I have clicked on "allow edits by maintainers".
• I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]: Not applicable. This change has no effect on the API.
• The correct base branch is being used, if not main
• I have added tests to validate that the change in functionality is working as expected: Not applicable. This is a dependency range change only. npm ci, npm run build, npm run lint (0 errors), and npm test (251 passed, 0 failed) pass on Node 24.

Summary by CodeRabbit

• Chores
  • Updated internal package configuration. No changes to app features or behavior are included in this release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 864c3672-9246-478d-b774-056eeddac85b

📥 Commits

Reviewing files that changed from the base of the PR and between d6d4035 and 72be63d.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The axios dependency declaration changes from the exact version 1.20.0 to the compatible range ^1.20.0.

Changes

Axios Dependency Range

Layer / File(s)	Summary
Update Axios version range package.json	The axios dependency changes from the exact version 1.20.0 to the compatible range ^1.20.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: rhamzeh

Merge Risk: ⚪ Minimal · up to 72be6

Consumers can resolve compatible Axios 1.x versions starting at 1.20.0, while the supplied lockfile remains at 1.20.0. No actionable merge-blocking risk is evidenced.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: relaxing the Axios dependency from an exact version pin to the compatible ^1.20.0 range.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed: dependency version conflict. Check your lock file or package.json.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}