[stefangutica]

Description of the pull request (what is new / what has changed)

The Cookbook TS verification workflow fails on every PR since seven high advisories were published for axios on 2026-09-30, after the last green run (#1207, 2026-09-10). The cookbook project and the recipes pin axios 1.18.1:

• GHSA-c29m-xwm3-cm6r (>=1.16.1 <1.20.0)
• GHSA-mghh-pgcx-3jjj (>=1.15.0 <1.20.0)
• GHSA-x97p-jq2g-jp4f (>=1.15.1 <1.20.0)
• GHSA-3pq3-5fj3-cg6v (>=1.13.0 <1.20.0)
• GHSA-542g-h47m-68v8 (>=1.13.0 <1.20.0)
• GHSA-m8m8-qj5v-23w3 (>=1.15.2 <1.20.0)
• GHSA-r4gj-5m52-g5wh (>=1.17.0 <1.20.0)

This bumps axios to 1.20.0, which fixes all seven and the moderate ones on the same range:

• testing/cookbook-ts/project/package.json: axios goes from 1.18.1 to 1.20.0.
• testing/cookbook-ts/project/package-lock.json: only the axios entry changes (version, resolved, integrity, and form-data ^4.0.5 to ^4.0.6; 4.0.6 is already the locked version).
• 52 recipes under docs/sdk-and-tools/sdk-js/cookbook/: the axios pin in the complete package.json goes from 1.18.1 to 1.20.0. verify-projects.mjs audits these too, and readers copying a recipe would otherwise install a vulnerable version.

1.20.0 is a minor release. Its only breaking-change notes are new names for the 413/422 status codes (the old ones stay as deprecated aliases) and a socket memory fix. The recipes only call axios.get, and the SDKs accept it (sdk-dapp needs >=1.15.0, sdk-native-auth-client ^1.10.0).

The workflow will still fail after this PR, on a braces advisory that has no fix yet:

• GHSA-vfj7-8cjw-p6xm (CVE-2026-93687), stack-exhaustion DoS through deeply nested patterns. Published on 2026-09-18 and reviewed by GitHub on 2026-10-02, which is when npm audit started reporting it.
• It affects braces <=3.0.3 and has no patched version. 3.0.3 is the latest braces release, so there is nothing to bump or override to yet.
• It comes in through micromatch 4 (latest 4.0.8 still requires braces ^3.0.3), via @multiversx/sdk-web-wallet-iframe-provider > @types/jest > expect > jest-message-util and via @multiversx/sdk-dapp-ui > @stencil/react-output-target > ts-morph > fast-glob. It fails the project audit and the audit of the 8 sdk-dapp recipes.
• This PR leaves it as is. Once braces ships a fix, it can be pinned through overrides, like brace-expansion in Bump brace-expansion to 5.0.12 in cookbook project #1212.

Checked locally: npm ci --dry-run accepts the lockfile, and node ./testing/cookbook-ts/audit-project.mjs no longer reports any axios advisory, only GHSA-vfj7-8cjw-p6xm. With that advisory skipped locally (not part of this PR), ./testing/cookbook-ts-ci.sh passes, building all 61 cookbook projects.

Did you test the changes locally ?

• yes
• no

Did you regenerate static/llms.txt and static/llms-full.txt ? (happens at build time)

• yes
• no

Which category (categories) does this pull request belong to?

• document new feature
• update documentation that is not relevant anymore
• add examples or more information about a component
• fix grammar issues
• other