Bump axios from 0.18.1 to 0.21.2 - #32
Conversation
dependabot
Bot
added
the
dependencies
4bc6b1b to
54bc601
Compare
da95cc7 to
ae6f5ba
Compare
Bumps [axios](https://github.com/axios/axios) from 0.18.1 to 0.21.2. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/master/CHANGELOG.md) - [Commits](axios/axios@v0.18.1...v0.21.2) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
ae6f5ba to
47325b4
Compare
foxpatch-aleph
left a comment
foxpatch-aleph
left a comment
There was a problem hiding this comment.
This is a security-motivated dependency update bumping axios from 0.18.1 to 0.21.2. The change addresses a ReDoS vulnerability in axios (CVE fix in #3980) and an SSRF vulnerability in follow-redirects (updated from 1.5.10 to 1.14.7). The diff is entirely in lock files and package.json, with no application logic changes. The cascading dependency updates (e.g., @solana/web3.js 0.90.5 → 1.33.0, superstruct 0.8.4 → 0.14.2, jayson 3.6.5 → 3.6.6, uuid 3.4.0 → 8.3.2 within jayson) are expected consequences of resolving the transitive dependency tree. Removal of is-buffer, crypto-hash, npm-run-all, esdoc-inject-style-plugin, and related packages reflects the updated @solana/web3.js dependency tree. The is-buffer removal from axios is intentional as 0.21.x no longer needs that polyfill. No security regressions are introduced.
package.json (line 32): The version range ^0.21.2 pins to the 0.x series. Note that axios has since released 1.x with breaking changes, so this range is appropriate for a controlled upgrade. If the project is later ready for axios 1.x, a separate PR would be needed.
package-lock.json (line 1): The follow-redirects transitive dependency is updated from 1.5.10 to 1.14.7, which addresses CVE-2022-0155 (credential exposure to the redirect host). This is the primary security motivation for the axios bump alongside the ReDoS fix, making this update important to merge.
1 participant
Bumps axios from 0.18.1 to 0.21.2.
Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
c0c8761[Updating] changelog to include links to issues and contributors619bb46[Releasing] v0.21.282c9455Create SECURITY.md (#3981)5b45711Security fix for ReDoS (#3980)5bc9ea2Update ECOSYSTEM.md (#3817)e72813aFixing README.md (#3818)e10a027Fix README typo under Request Config (#3825)e091491Update README.md (#3936)b42fbadRemoved un-needed bracket520c8dcUpdating CI status badge (#3953)Maintainer changes
This version was pushed to npm by jasonsaayman, a new releaser for axios since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labelswill set the current labels as the default for future PRs for this repo and language@dependabot use these reviewerswill set the current reviewers as the default for future PRs for this repo and language@dependabot use these assigneeswill set the current assignees as the default for future PRs for this repo and language@dependabot use this milestonewill set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.