fix(security): update CLI network and git dependencies

[tannerlinsley]

Problem

The published CLI exact-pins simple-git@3.30.0 and axios@1.13.5. Current npm advisories classify the simple-git path as critical because it permits remote command execution, and the Axios path as high severity. These direct dependencies also cause downstream security policy failures for NativeScript consumers.

Fix

• update simple-git to 3.36.0
• update axios to 1.18.1
• regenerate package-lock.json

Validation

• clean npm ci --ignore-scripts
• npm test: TypeScript plus 1,507 passing tests, 9 existing pending
• npm audit --package-lock-only: no remaining advisory for axios or simple-git
• TanStack Start + NativeScript Android build, install, launch, server-function, routing, back-stack, and blocker E2E passed with these versions

Summary by CodeRabbit

• Chores
  • Updated networking and Git integration components to newer versions.
  • Includes the latest improvements and fixes from these component updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: da0ec01b-9810-45d7-8252-a033f3ce0343

📥 Commits

Reviewing files that changed from the base of the PR and between e027862 and 9b54ead.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

Updates the axios and simple-git dependency versions in package.json.

Changes

Dependency updates

Layer / File(s)	Summary
Update package dependencies package.json	Updates axios from 1.13.5 to 1.18.1 and simple-git from 3.30.0 to 3.36.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: nathanwalker

Poem

A rabbit hops through package rows,
Two fresh versions bloom and grow.
Axios leaps, simple-git too,
With tidy bounds and numbers new.
“Dependencies updated!” I cheer,
Then nibble carrots without fear.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the security-related dependency update to the CLI's network and git packages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}