Weekly Dependency Update 09/28/26 Part 2 (CRASM-4310)

[hawkishpolicy]

Weekly Dependency Update 09/28/26 Part 2 (CRASM-4310)

🗣 Description

• axios updated to 1.20
• dom purify updated to 3.4.16
• source-map-js to 1.2.2
• proxy-addr to 2.0.8

💭 Motivation and context

• Closes 4310
• Reduces vulnerabilities in our node library.
• These vulns happened later in the week after the first PR.

🧪 Testing

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• Tests have been added and/or modified to cover the changes in this PR.
• All new and existing tests pass.
• Bump major, minor, patch, pre-release, and/or build versions as appropriate via the bump_version script if this repository is versioned and the changes in this PR warrant a version bump.
• Create a pre-release (necessary if and only if the pre-release version was bumped).

✅ Pre-merge checklist

• Revert dependencies to default branches.
• Finalize version.

✅ Post-merge checklist

• Create a release (necessary if and only if the version was bumped).

[nickviola]

LGTM

[cduhn17]

LGTM simple fix. Add evidence for what fixes the vuln's

[jsalinasnttdata]

@hawkishpolicy closes CRASM-4388