Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency axios to v1.7.4 [security] #1125

Closed
wants to merge 1 commit into from
Closed

chore(deps): update dependency axios to v1.7.4 [security] #1125

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 14, 2024

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
axios (source) 1.3.2 -> 1.7.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-45857

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Release Notes

axios/axios (axios)

v1.7.4

Compare Source

Bug Fixes
Contributors to this release

v1.7.3

Compare Source

Bug Fixes
Contributors to this release

v1.7.2

Compare Source

Bug Fixes
Contributors to this release

v1.7.1

Compare Source

Bug Fixes
  • fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#​6410) (733f15f)
Contributors to this release

v1.7.0

Compare Source

Features
Bug Fixes
Contributors to this release

v1.6.8

Compare Source

Bug Fixes
  • AxiosHeaders: fix AxiosHeaders conversion to an object during config merging (#​6243) (2656612)
  • import: use named export for EventEmitter; (7320430)
  • vulnerability: update follow-redirects to 1.15.6 (#​6300) (8786e0f)
Contributors to this release

v1.6.7

Compare Source

Bug Fixes
  • capture async stack only for rejections with native error objects; (#​6203) (1a08f90)
Contributors to this release

v1.6.6

Compare Source

Bug Fixes
Contributors to this release

v1.6.5

Compare Source

Bug Fixes
Contributors to this release

v1.6.4

Compare Source

Bug Fixes
  • security: fixed formToJSON prototype pollution vulnerability; (#​6167) (3c0c11c)
  • security: fixed security vulnerability in follow-redirects (#​6163) (75af1cd)
Contributors to this release

v1.6.3

Compare Source

Bug Fixes
Contributors to this release

v1.6.2

Compare Source

Features
  • withXSRFToken: added withXSRFToken option as a workaround to achieve the old withCredentials behavior; (#​6046) (cff9967)
PRs
  • feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #​6046 )

📢 This PR added 'withXSRFToken' option as a replacement for old withCredentials behaviour. 
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.
Contributors to this release

v1.6.1

Compare Source

Bug Fixes
  • formdata: fixed content-type header normalization for non-standard browser environments; (#​6056) (dd465ab)
  • platform: fixed emulated browser detection in node.js environment; (#​6055) (3dc8369)
Contributors to this release

v1.6.0

Compare Source

Bug Fixes
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
Contributors to this release

1.5.1 (2023-09-26)

Bug Fixes
  • adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
  • formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
  • headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
  • types: removed duplicated code (9e62056)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

v1.5.1

Compare Source

Bug Fixes
  • adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
  • formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
  • headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
  • types: removed duplicated code (9e62056)
Contributors to this release

v1.5.0

Compare Source

Bug Fixes
  • adapter: make adapter loading error more clear by using platform-specific adapters explicitly (#​5837) (9a414bb)
  • dns: fixed cacheable-lookup integration; (#​5836) (b3e327d)
  • headers: added support for setting header names that overlap with class methods; (#​5831) (d8b4ca0)
  • headers: fixed common Content-Type header merging; (#​5832) (8fda276)
Features
Contributors to this release

v1.4.0

Compare Source

Bug Fixes
  • formdata: add multipart/form-data content type for FormData payload on custom client environments; (#​5678) (bbb61e7)
  • package: export package internals with unsafe path prefix; (#​5677) (df38c94)
Features
Performance Improvements
  • merge-config: optimize mergeConfig performance by avoiding duplicate key visits; (#​5679) (e6f7053)
Contributors to this release

1.3.6 (2023-04-19)

Bug Fixes
  • types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
  • utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)
Contributors to this release

1.3.5 (2023-04-05)

Bug Fixes
  • headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
  • params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)
Contributors to this release

1.3.4 (2023-02-22)

Bug Fixes
  • blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
  • http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)
Contributors to this release

1.3.3 (2023-02-13)

Bug Fixes
  • formdata: added a check to make sure the FormData class is available in the browser's global scope; (#​5545) (a6dfa72)
  • formdata: fixed setting NaN as Content-Length for form payload in some cases; (#​5535) (c19f7bf)
  • headers: fixed the filtering logic of the clear method; (#​5542) (ea87ebf)
Contributors to this release

1.3.2 (2023-02-03)

Bug Fixes
Contributors to this release

1.3.1 (2023-02-01)

Bug Fixes
  • formdata: add hotfix to use the asynchronous API to compute the content-length header value; (#​5521) (96d336f)
  • serializer: fixed serialization of array-like objects; (#​5518) (08104c0)
Contributors to this release

v1.3.6

Compare Source

Bug Fixes
  • types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
  • utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)
Contributors to this release

v1.3.5

Compare Source

Bug Fixes
  • headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
  • params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)
Contributors to this release

v1.3.4

Compare Source

Bug Fixes
  • blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
  • http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)
Contributors to this release

v1.3.3

Compare Source

Bug Fixes
  • formdata: added a check to make sure the FormData class is available in the browser's global scope; (#​5545) (a6dfa72)
  • formdata: fixed setting NaN as Content-Length for form payload in some cases; (#​5535) (c19f7bf)
  • headers: fixed the filtering logic of the clear method; (#​5542) (ea87ebf)
Contributors to this release

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested review from BugGambit, andersfylling and a team as code owners August 14, 2024 18:23
@renovate renovate bot added the dependencies Pull requests that update a dependency file label Aug 14, 2024
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch 10 times, most recently from c7a90eb to 555ff22 Compare August 22, 2024 09:03
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch 2 times, most recently from 8b2c371 to 5f1ffe2 Compare August 26, 2024 11:22
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 5f1ffe2 to 01fcea9 Compare August 26, 2024 11:25
@BugGambit BugGambit closed this Aug 26, 2024
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Aug 26, 2024

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (^1.0.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the renovate/npm-axios-vulnerability branch August 26, 2024 11:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@BugGambit BugGambit Awaiting requested review from BugGambit

@andersfylling andersfylling Awaiting requested review from andersfylling

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@BugGambit