[dependabot]

Updates the resolved axios version from 1.19.0 to 1.20.0 in the generated lockfile; package.json already allows this range, so this is a lockfile-only update. No application source changes are included.

Canonical requirement

• Canonical Issue URL: chore(governance): enforce revisioned Issue requirements and acceptance ledgers #95
• Consumed revision: R1
• No automatic close keywords: acknowledged

Delivery ownership

• implementationOwner: @dependabot
• automatedPreReviewOwner: Dependabot compatibility and hosted CI
• humanReviewOwner: @PeterGuy326
• Separation of duties: the bot authors the dependency update; a non-author human reviewer owns the final review.

Requirement trace

REQ/AC IDs	Changed files / domain	Tests or review evidence
REQ-378 / AC-378	the resolved axios version 1.19.0 to 1.20.0 update in package-lock.json	Hosted Node 20/22/24 CI, coverage, package-consumer, container, distribution, dependency review, CodeQL, and security checks on the exact PR head

File domains

• the resolved axios version 1.19.0 to 1.20.0 update in package-lock.json; no application runtime source is changed.

Scope and non-goals

This PR updates only the the resolved axios version lockfile resolution in package-lock.json. It does not change product behavior, APIs, data formats, or release policy beyond the stated dependency/action update.

Validation

• Exact commands: hosted workflow command npm test; governance command npm run governance:check -- --github-event-file "$GITHUB_EVENT_PATH".
• Observed counts/results: NOT VERIFIED: hosted checks will be rerun after this PR trace is restored.
• Check URLs: https://github.com/bytefolk/digital-employee/pull/378/checks

ID	REQ/AC	Observable acceptance criterion	Command or manual steps	Environment	Expected	Observed	Status
V1	AC-378	Dependency and workflow files resolve across supported Node versions.	Hosted GitHub Actions CI matrix	Node 20, 22, and 24 GitHub-hosted runners	Required checks pass on exact head.	NOT VERIFIED: hosted checks will be rerun after this body update.	NOT VERIFIED

Security and compatibility

The change is a within-range patch update of a runtime HTTP dependency and leaves workflow permissions, publication policy, and application code unchanged. Hosted dependency review and the supported Node-version matrix remain required.

Known limitations

The governance-only failed jobs must be rerun after restoring this body. No local result substitutes for required hosted checks.

Risk and rollback

Risk is limited to runtime HTTP client compatibility. Rollback is the single-file lockfile revert; there is no data migration or irreversible side effect.

Product review handoff

• Automated pre-review result: PASS: Dependabot generated a dependency-only update.
• Human final review: PENDING
• Merge ledger owner: @PeterGuy326
• Product reviewer: @PeterGuy326
• Milestone or release packet: N/A: dependency maintenance PR; no separate product packet.
• Merge, CI, release, and model judgment do not accept or close the Issue: acknowledged

[PeterGuy326]

Maintainer note: the axios 1.20.0 lockfile update from this branch has been merged into #373 so that a single head carries both runtime dependency security fixes (axios 1.20.0 + fast-uri 3.1.8) required to make npm audit pass. Once #373 lands, this PR will either merge as-is or be closed as superseded by #373.