chore(deps): bump axios from 0.33.0 to 0.34.0 (GHSA-x97p-jq2g-jp4f)

[Kolahzary]

Closes #342

Summary

Bumps the exact axios pin from 0.33.0 to 0.34.0 to resolve GHSA-x97p-jq2g-jp4f (high severity, a prototype-pollution gadget in axios toFormData). The fix is in 0.34.0, on the same 0.x line, so this stays on 0.x and does not move to axios 1.x.

Because the dependency is pinned exactly, users of @craftgate/craftgate can't pick up the fix until the pin changes. Security scanners (npm audit, Dependabot, Snyk) currently flag every project that installs this package.

Changes

• package.json: "axios": "0.33.0" → "axios": "0.34.0". It is still an exact pin, and no other dependencies changed.

Impact

axios is the only runtime dependency. It is used in one place, src/lib/HttpClient.ts (axios.create({ baseURL })). The client never builds FormData or multipart bodies, so the bump doesn't change behaviour.

Testing

• npm run build: passes
• npm test: 77 passed, 0 failed
• npm run lint:check: passes
• npm ls axios: resolves only axios@0.34.0, including the copy that axios-mock-adapter uses

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[kadirtaskiran]

@Kolahzary Thank you for your support. We handled the security issue on here: #344