R11DT-4404 - Bump vulnerable deps in swagger-ui

[OS-thiagosiqueira]

Jira Issue

R11DT-4404

The problem

Wiz flags axios@1.18.1 against the b11 branch: 12 findings (CVE-2026-101898 to CVE-2026-101909, 7 High and 5 Medium), all with fix version 1.20.0. The advisories cover ReDoS in the data: URL parser and in proxy-bypass host normalization, prototype-pollution gadgets in the HTTP and fetch adapters, header injection, redirect-based SSRF (maxRedirects: 0 not enforced by the fetch adapter), and NO_PROXY CIDR entries being ignored.

npm audit on the same lockfile reports the same range:

"axios": {
  "severity": "high",
  "range": "1.0.0 - 1.19.0"
}

Proposed solution

Patch-level bump of a transitive dependency only, same surgical-bump pattern as #209 and #207. No src/ changes and no package.json change: the existing override "axios": ">=1.18.0" already admits 1.20.0, so only the lockfile moves.

Where	Change
package-lock.json	axios 1.18.1 → 1.20.0; its form-data requirement ^4.0.5 → ^4.0.6 (the installed form-data was already 4.0.6, so nothing else moves)

axios is only reached through start-server-and-test → wait-on (Cypress tooling) and swagger-client → @swagger-api/apidom-reference; both resolve to the single 1.20.0 copy.

Verification:

• npm audit — no axios finding left (95 → 94 vulnerable packages, 168 → 156 advisories).
• npm ls axios — both paths on 1.20.0.
• npm run build — succeeds.

Notes / scope

• dist/ is not part of this PR, on purpose. axios is not bundled into any dist/ file. A rebuild after the bump differs from HEAD only in the GIT_COMMIT and BUILD_TIME stamps embedded in the bundles (same file length, 60 characters changed), so there is no code change to ship.
• Unrelated to this PR: npm run lint-errors (144 errors) and npm run test:unit (34 failed tests in 7 suites) fail in files with OutSystems customizations (info.jsx, parameter-row.jsx, model-example.jsx, markdown rendering, and similar). This PR changes none of them, and none of the failures involve network or HTTP code. I did not compare them against a clean b11 run, and the Cypress suite (the only one that exercises wait-on/axios) was not run.
• Lockfile registry: the axios entry now carries the Azure Artifacts resolved URL with a sha1 integrity, as the other 162 entries from that registry do, instead of registry.npmjs.org with sha512.
• Left out of scope: the other Wiz findings on b11 (brace-expansion x3, dompurify x2) are not touched here.
• Wiz scans the b11 branch, so the 12 axios findings should clear on the first rescan after this is merged.