chore: update changelog and packages (#10790)

* chore: update all pacakges and changelog

* chore: update all packages and remove anything un-needed

/* Vulnerable areas involved reading user-controlled config properties from objects that inherit from Object.prototype, allowing prototype pollution to affect request parameters such as auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser */

// Example vulnerable code snippet before patch:

function mergeConfig(defaults, config) {
  return Object.assign({}, defaults, config); // could be polluted via prototype properties
}

// socketPath value accepted without type validation or allowlist enforcement

1. Prototype Pollution:
// Malicious payload to inject prototype pollution
const pollutedConfig = JSON.parse('{"__proto__": {"socketPath": "/malicious/socket"}}');

// Using axios with polluted config causes requests to use attacker-controlled socketPath
axios.request(pollutedConfig); // request is sent via attacker socket

2. SSRF via socketPath:
// Without allowlist, attacker can provide socketPath to internal services
axios.request({ socketPath: '/var/run/docker.sock' }); // access internal docker API

// After patch, passing socketPath not in allowedSocketPaths rejects request
axios.request({ socketPath: '/var/run/docker.sock', allowedSocketPaths: ['/tmp/allowed.sock'] }); // throws AxiosError ERR_BAD_OPTION_VALUE