[Snyk] Fix for 9 vulnerabilities

[nicholas-lockhart]

Snyk has created this PR to fix 9 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	HTTP Response Splitting SNYK-JS-AXIOS-16298058	848
	Uncontrolled Recursion SNYK-JS-AXIOS-16299923	828
	Prototype Pollution SNYK-JS-AXIOS-16299904	741
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-16298130	738
	Improper Encoding or Escaping of Output SNYK-JS-AXIOS-16298055	708
	Prototype Pollution SNYK-JS-AXIOS-16299925	708
	Insertion of Sensitive Information Into Sent Data SNYK-JS-AXIOS-16299478	658
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-16298095	631
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-16298162	631

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Encoding or Escaping of Output
🦉 Server-side Request Forgery (SSRF)
🦉 Allocation of Resources Without Limits or Throttling
🦉 More lessons are available in Snyk Learn

---

Note

Medium Risk
Upgrades axios and @azure/ms-rest-js (including a major-version bump) which can subtly change HTTP/request handling and impact generated Azure REST plumbing at runtime.

Overview
Updates runtime dependencies to remediate reported Snyk issues by upgrading axios to 0.31.1 and @azure/ms-rest-js to 2.0.0.

The lockfile is refreshed accordingly, pulling in new transitive packages (e.g., node-fetch/abort-controller for @azure/ms-rest-js and proxy-from-env for axios) and updating several low-level utility deps.

^{Reviewed by Cursor Bugbot for commit 7f44123. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7f44123. Configure here.}

[cursor]

Major version bump flagged as breaking change

Medium Severity

The Snyk metadata for this PR explicitly flags "isBreakingChange":true. The @azure/ms-rest-js upgrade is a major version bump (v1 → v2) which internally switches its HTTP transport from axios to node-fetch. The project heavily uses @azure/ms-rest-js APIs (URLBuilder, OperationSpec, Serializer, DictionaryMapper) across generated code in src/blob/generated/ and handler files. While these specific APIs appear to still exist in v2, has this been validated against the project's build and test suite? It would be helpful to confirm no subtle behavioral regressions exist before merging.

Additional Locations (1)

• package.json#L25-L26

 

^{Triggered by team rule: Ask Clarifying Questions}

^{Reviewed by Cursor Bugbot for commit 7f44123. Configure here.}

[cursor]

Deep internal import path may break with v2

High Severity

src/table/TableRequestListenerFactory.ts imports from a deep internal path: @azure/ms-rest-js/es/lib/operationSpec. This references the package's internal ES module build structure, not a public API surface. Upgrading @azure/ms-rest-js from v1 to v2 may change the internal file layout within the es/lib/ directory, causing this import to fail at build or runtime. All other usages in the codebase use the safe top-level import * as msRest from "@azure/ms-rest-js" pattern.

Additional Locations (1)

• package-lock.json#L496-L497

 

^{Triggered by team rule: Ask Clarifying Questions}

^{Reviewed by Cursor Bugbot for commit 7f44123. Configure here.}