[codex] fix axios dependabot alert

[szdziedzic]

Why

Dependabot reported security alert 439 for axios (GHSA-p92q-9vqr-4j8v, CVE-2026-44487). The eas-cli package pinned vulnerable axios@1.11.0, and the lockfile also contained vulnerable transitive axios@1.13.3. 1.16.0 is the patched 1.x release.

How

Updated eas-cli to depend on axios@1.16.0 and re-resolved axios with Yarn so the lockfile now uses axios@1.16.0 for the direct dependency and axios@1.18.1 for the existing transitive ^1.12.0 range. Added a main changelog chore entry for the security bump.

Test Plan

• corepack yarn fmt
• corepack yarn install --immutable
• corepack yarn why axios
• corepack yarn lint-changelog
• git diff --check

corepack yarn install --immutable still reports the same pre-existing peer dependency warnings for graphql, oxlint-tsgolint, eslint, and @types/node.

[github-actions]

✅ Thank you for adding the changelog entry!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.32%. Comparing base (4855745) to head (6f55ce5).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3964   +/-   ##
=======================================
  Coverage   59.32%   59.32%           
=======================================
  Files         936      936           
  Lines       41169    41169           
  Branches     8670     8670           
=======================================
  Hits        24421    24421           
  Misses      16654    16654           
  Partials       94       94           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Subscribed to pull request

File Patterns	Mentions
**/*	@douglowder

Generated by CodeMention

Warning: The preamble and epilogue options in commentConfiguration are deprecated. Use template instead.