Dependency alert: axios compromised versions may be resolved via ^1.13.1

[hyperfinitism]

There is an ongoing public supply-chain compromise affecting axios@1.14.1 and axios@0.30.4 on npm.

axios/axios#10604

This repository currently declares:

"axios": "^1.13.1"

So even if the current lockfile is still safe, future lockfile refreshes / fresh installs that re-resolve dependencies may pick up a compromised Axios release.

Would you consider urgently:

1. pinning Axios to a known-good version,
2. checking that neither axios@1.14.1 / 0.30.4 nor plain-crypto-js appears in the dependency tree?

This seems worth addressing quickly because many users self-host or fork this project and may run fresh installs.