Not pinning and not testing is egregious enough but to use a CDN for a web-based cross-platform app? Absurd.
If it would be a private CDN which points only to the content they explicitly published as part of a build&release process they wouldn't have the problem.
If you rely on public artifacts that others published, all your availability and security guarantees are gone.
Many of these products are likely commercial based on their comments
With unit testing it us generally considered bad practice to test your dependencies and many people don't have good integration tests.
That being said, the ultimate culprit here is the nodeJS system. npm install will add the package with it being setup to upgrade to the latest minor version by default, instead of the obvious choice of fixing it to the specific version that was installed.
Further, the package-lock.json technology is neither well explained by NodeJS, nor well documented. The process one should use is not well explained either. And often fairly trivial changes will lead to significant changes in package-lock.json.
If you have a dependency like this that could be production breaking then lock it down. Do not upgrade it without someone looking at it. Or have a set of tests that do that for you.
Axios broke something but who cares. If your build broke or your application broke then you have something to fix not the axios devs.
It is too bad github does not have a "put on your bigboy pants" icon.
