@codspeed/core inlines axios 1.4.0 / follow-redirects 1.15.2 / form-data 4.0.4 (pre-fix, invisible to npm audit) #114

Hello CodSpeed team,
@codspeed/core@6.1.0 (dist/index.cjs.js and dist/index.es5.js) inlines axios 1.4.0 together with follow-redirects 1.15.2 and form-data 4.0.4. They come in through the Rollup build (@rollup/plugin-node-resolve without external), which bundles the versions pinned in pnpm-lock.yaml. The copies fall in the range of:

• axios GHSA-pf86-5x62-jrwf, GHSA-6chq-wfr3-2hj9, GHSA-w9j2-pvgh-6h63, GHSA-3w6x-2g7m-8v23, GHSA-898c-q2cr-xwhg, GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw (prototype-pollution gadgets in config merge, headers, proxy, parseReviver); GHSA-5c9x-8gcm-mpgx, GHSA-vf2m-468p-8v99 (maxBodyLength/maxContentLength bypass on streams); GHSA-445q-vr5w-6q77 (CRLF in multipart blob.type); GHSA-xhjh-pmcv-23jw (null byte via AxiosURLSearchParams); GHSA-p92q-9vqr-4j8v (Proxy-Authorization leak across redirect); GHSA-hfxv-24rg-xrqf (cookie-name ReDoS). All fixed by axios 1.16.0.
• follow-redirects GHSA-r4q5-vmmm-2653 (custom auth headers kept on cross-domain redirect; 1.16.0 adds the opt-in sensitiveHeaders).
• form-data GHSA-hmw2-7cc7-3qxx (CRLF injection via field names/filenames; fixed in 4.0.6).

package.json declares axios ^1.4.0 and form-data ^4.0.4, which resolve to fixed releases, so npm audit and SCA tools report nothing to you or to users of the vitest/tinybench/benchmark.js plugins; only the inlined copy is old. This is an existence notice: we have not assessed exploitability in your product.

Suggested fix: refresh the lockfile so the build bundles axios >= 1.16.0 (with follow-redirects >= 1.16.0) and form-data >= 4.0.6, or mark them external so the declared ranges apply, then rebuild and republish.