From 010bdd1dc66fa8a0b7bfd8d528481eaf80b62f10 Mon Sep 17 00:00:00 2001 From: SandipBajracharya Date: Wed, 22 Apr 2026 15:16:13 +0545 Subject: [PATCH] fix(OUT-3587): pin axios to ^1.15.2 via yarn resolutions Addresses Dependabot alerts GHSA-3p68-rc4w-qgx5 (NO_PROXY SSRF) and GHSA-fvcv-3m26-pcqx (cloud metadata exfiltration) pulled transitively through intuit-oauth@4.2.3 (which pins axios@1.14.0). intuit-oauth is at its latest version with no upstream fix available; the resolution override is SemVer-compatible with its declared ^1.9.0 range. Co-Authored-By: Claude Opus 4.7 (1M context) --- package.json | 3 ++- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index ff5650b1..c8ca4835 100644 --- a/package.json +++ b/package.json @@ -89,7 +89,8 @@ "packageManager": "yarn@4.9.1", "resolutions": { "@types/react": "19.1.2", - "@types/react-dom": "19.1.2" + "@types/react-dom": "19.1.2", + "axios": "^1.15.2" }, "lint-staged": { "src/**/*.{ts,tsx}": [ diff --git a/yarn.lock b/yarn.lock index 026b1c6d..fb127f71 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5004,14 +5004,14 @@ __metadata: languageName: node linkType: hard -"axios@npm:^1.9.0": - version: 1.14.0 - resolution: "axios@npm:1.14.0" +"axios@npm:^1.15.2": + version: 1.15.2 + resolution: "axios@npm:1.15.2" dependencies: follow-redirects: "npm:^1.15.11" form-data: "npm:^4.0.5" proxy-from-env: "npm:^2.1.0" - checksum: 10c0/2541f4aa215a7d1842429dad006fc682d82bc0e74bd14500823f7d8cce3bbae0e0a8c328c8538946718f366ab8ce5a4c12e9ad40e5a0f3482ff8bff0cd115d45 + checksum: 10c0/4eeae0feeaa7fdc1ef24f81f8b378fdadedf4aebdd6bf224484675160f8744cf17b9b0d1c215279979940f7e8ce463beffa2f713099612e428eac238515c81d5 languageName: node linkType: hard