.Net: Bump axios to 1.16.0 and form-data to 4.0.6 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR

[dependabot]

Motivation and Context

This update is required to resolve the current Dependabot security alerts for the sample npm manifest in dotnet/samples/Demos/ProcessFrameworkWithSignalR.

Description

Updates the sample manifest to require axios ^1.16.0 and regenerates the lockfile so the resolved dependency set includes:

• axios 1.16.0
• form-data 4.0.6
• compatible transitive updates such as follow-redirects 1.16.0

These changes keep the scope limited to the sample's package.json and package-lock.json while clearing the reported npm audit findings for this manifest.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Automated Code Review

Reviewers: 4 | Confidence: 95%

✓ Correctness

This PR is a straightforward dependency version bump of axios from ^1.12.0 to ^1.15.0 in a demo sample's root package.json and its corresponding package-lock.json. The lockfile is internally consistent: resolved versions, integrity hashes, and transitive dependency ranges (follow-redirects ^1.15.11, form-data ^4.0.5, proxy-from-env ^2.1.0) all match what axios 1.15.0 declares. The proxy-from-env jump from 1.1.0 to 2.1.0 is a major-version change in a transitive dependency, but it is driven by axios's own updated peer spec and the API surface used by axios is unchanged. No correctness issues found.

✓ Security Reliability

This PR bumps axios from 1.12.0 to 1.15.0 in a sample demo project, along with updated transitive dependencies (follow-redirects, form-data, proxy-from-env). All integrity hashes are present in the lockfile and the versions are consistent between package.json and package-lock.json. No security or reliability concerns identified.

✓ Test Coverage

This PR is a straightforward npm dependency version bump (axios 1.12.0 → 1.15.0) in a dotnet sample demo project (ProcessFrameworkWithSignalR). Only package.json and package-lock.json are modified. No application logic, no new features, and no behavioral changes are introduced, so there is no new or changed behavior that requires test coverage. The transitive dependencies (follow-redirects, form-data, proxy-from-env) are also updated to compatible versions. No test coverage concerns apply here.

✓ Design Approach

This PR bumps axios from ^1.12.0 to ^1.15.0 in a demo project, pulling in updated transitive dependencies: follow-redirects 1.15.9→1.15.11 (security patches), form-data 4.0.4→4.0.5, and proxy-from-env 1.1.0→2.1.0. The major version jump in proxy-from-env (v1→v2) is driven by axios 1.15.0's own dependency requirement (^2.1.0) and is not a concern at this layer — axios controls that boundary. The lock file accurately reflects the resolved dependency graph for the new version range. There are no design-level problems: the change is a straightforward, justified dependency update with no leaky abstractions, fragile assumptions, or symptom-masking.

Suggestions

• The inner React frontend at src/ProcessFramework.Aspire.SignalR.ReactFrontend/package.json still lists axios at ^1.7.9. Consider updating it in the same PR for consistency.

---

Automated review by dependabot[bot]'s agents

[moonbox3]

@copilot: update this PR to bump axios to 1.16.0 instead of 1.15.0 in dotnet/samples/Demos/ProcessFrameworkWithSignalR/package-lock.json. Also bump form-data to 4.0.6 in the same manifest if the resolver allows it. Current Dependabot alerts for this manifest require axios>=1.16.0 and form-data>=4.0.6.

[Copilot]

@copilot: update this PR to bump axios to 1.16.0 instead of 1.15.0 in dotnet/samples/Demos/ProcessFrameworkWithSignalR/package-lock.json. Also bump form-data to 4.0.6 in the same manifest if the resol...

Addressed in 42ba327.

[Copilot]

Pull request overview

This PR updates the npm dependency set for the ProcessFrameworkWithSignalR .NET sample to address Dependabot security alerts by bumping axios and refreshing the lockfile so patched transitive versions are resolved.

Changes:

• Bump axios dependency from ^1.12.0 to ^1.16.0 in the sample package.json.
• Regenerate package-lock.json to resolve updated versions of axios and transitive dependencies (including form-data and follow-redirects).
• Update lockfile metadata (notably the top-level name) as a side-effect of regeneration.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
dotnet/samples/Demos/ProcessFrameworkWithSignalR/package.json	Updates the sample’s direct npm dependency on axios.
dotnet/samples/Demos/ProcessFrameworkWithSignalR/package-lock.json	Refreshes the resolved dependency graph to include updated/patched transitive packages.

Files not reviewed (1)

• dotnet/samples/Demos/ProcessFrameworkWithSignalR/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.