Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency axios to v1.7.4 [security] #45

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(deps): update dependency axios to v1.7.4 [security] #45

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 21, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
axios (source) 1.3.3 -> 1.7.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-45857

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Release Notes

axios/axios (axios)

v1.7.4

Compare Source

Bug Fixes
Contributors to this release

v1.7.3

Compare Source

Bug Fixes
Contributors to this release

v1.7.2

Compare Source

Bug Fixes
Contributors to this release

v1.7.1

Compare Source

Bug Fixes
  • fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#​6410) (733f15f)
Contributors to this release

v1.7.0

Compare Source

Features
Bug Fixes
Contributors to this release

v1.6.8

Compare Source

Bug Fixes
  • AxiosHeaders: fix AxiosHeaders conversion to an object during config merging (#​6243) (2656612)
  • import: use named export for EventEmitter; (7320430)
  • vulnerability: update follow-redirects to 1.15.6 (#​6300) (8786e0f)
Contributors to this release

v1.6.7

Compare Source

Bug Fixes
  • capture async stack only for rejections with native error objects; (#​6203) (1a08f90)
Contributors to this release

v1.6.6

Compare Source

Bug Fixes
Contributors to this release

v1.6.5

Compare Source

Bug Fixes
Contributors to this release

v1.6.4

Compare Source

Bug Fixes
  • security: fixed formToJSON prototype pollution vulnerability; (#​6167) (3c0c11c)
  • security: fixed security vulnerability in follow-redirects (#​6163) (75af1cd)
Contributors to this release

v1.6.3

Compare Source

Bug Fixes
Contributors to this release

v1.6.2

Compare Source

Features
  • withXSRFToken: added withXSRFToken option as a workaround to achieve the old withCredentials behavior; (#​6046) (cff9967)
PRs
  • feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #​6046 )

📢 This PR added 'withXSRFToken' option as a replacement for old withCredentials behaviour. 
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.
Contributors to this release

v1.6.1

Compare Source

Bug Fixes
  • formdata: fixed content-type header normalization for non-standard browser environments; (#​6056) (dd465ab)
  • platform: fixed emulated browser detection in node.js environment; (#​6055) (3dc8369)
Contributors to this release

v1.6.0

Compare Source

Bug Fixes
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
Contributors to this release

1.5.1 (2023-09-26)

Bug Fixes
  • adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
  • formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
  • headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
  • types: removed duplicated code (9e62056)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

v1.5.1

Compare Source

Bug Fixes
  • adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
  • formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
  • headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
  • types: removed duplicated code (9e62056)
Contributors to this release

v1.5.0

Compare Source

Bug Fixes
  • adapter: make adapter loading error more clear by using platform-specific adapters explicitly (#​5837) (9a414bb)
  • dns: fixed cacheable-lookup integration; (#​5836) (b3e327d)
  • headers: added support for setting header names that overlap with class methods; (#​5831) (d8b4ca0)
  • headers: fixed common Content-Type header merging; (#​5832) (8fda276)
Features
Contributors to this release

v1.4.0

Compare Source

Bug Fixes
  • formdata: add multipart/form-data content type for FormData payload on custom client environments; (#​5678) (bbb61e7)
  • package: export package internals with unsafe path prefix; (#​5677) (df38c94)
Features
Performance Improvements
  • merge-config: optimize mergeConfig performance by avoiding duplicate key visits; (#​5679) (e6f7053)
Contributors to this release

1.3.6 (2023-04-19)

Bug Fixes
  • types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
  • utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)
Contributors to this release

1.3.5 (2023-04-05)

Bug Fixes
  • headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
  • params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)
Contributors to this release

1.3.4 (2023-02-22)

Bug Fixes
  • blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
  • http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)
Contributors to this release

1.3.3 (2023-02-13)

Bug Fixes
  • formdata: added a check to make sure the FormData class is available in the browser's global scope; (#​5545) (a6dfa72)
  • formdata: fixed setting NaN as Content-Length for form payload in some cases; (#​5535) (c19f7bf)
  • headers: fixed the filtering logic of the clear method; (#​5542) (ea87ebf)
Contributors to this release

1.3.2 (2023-02-03)

Bug Fixes
Contributors to this release

1.3.1 (2023-02-01)

Bug Fixes
  • formdata: add hotfix to use the asynchronous API to compute the content-length header value; (#​5521) (96d336f)
  • serializer: fixed serialization of array-like objects; (#​5518) (08104c0)
Contributors to this release

v1.3.6

Compare Source

Bug Fixes
  • types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
  • utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)
Contributors to this release

v1.3.5

Compare Source

Bug Fixes
  • headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
  • params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)
Contributors to this release

v1.3.4

Compare Source

Bug Fixes
  • blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
  • http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)
Contributors to this release

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Feb 21, 2024
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.6.0 [security] fix(deps): update dependency axios to v1.6.0 [security] - autoclosed Feb 23, 2024
@renovate renovate bot closed this Feb 23, 2024
@renovate renovate bot deleted the renovate/npm-axios-vulnerability branch February 23, 2024 23:20
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.6.0 [security] - autoclosed fix(deps): update dependency axios to v1.6.0 [security] Feb 24, 2024
@renovate renovate bot reopened this Feb 24, 2024
@renovate renovate bot restored the renovate/npm-axios-vulnerability branch February 24, 2024 02:14
@SocialGroovyBot SocialGroovyBot temporarily deployed to review-renovate-npm-axios-vulnerability-2209ju February 24, 2024 02:14 Destroyed
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from f8cb6d2 to 0312a4e Compare February 24, 2024 02:17
@github-actions GitHub Actions
Copy link

🎉 Deployment for commit 0312a4e :

Ingresses
Docker images
  • 📦 docker pull harbor.fabrique.social.gouv.fr/1000jours/app-dashboard/app:sha-0312a4ea25a8a0d053ca15d301620a58d5702858
Debug

@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 0312a4e to bb74660 Compare March 20, 2024 15:24
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@socket-security Socket Security
Copy link

socket-security bot commented Mar 20, 2024 •
edited
Loading

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@babel/[email protected] None 0 31.6 kB nicolo-ribaudo
npm/@babel/[email protected] None 0 49.1 kB nicolo-ribaudo
npm/@babel/[email protected] environment 0 2.41 MB nicolo-ribaudo
npm/[email protected] network 0 2.12 MB jasonsaayman
npm/[email protected] network 0 29.4 kB rubenverborgh
npm/[email protected] environment, filesystem 0 32.5 kB isaacs

🚮 Removed packages: npm/@babel/[email protected], npm/@babel/[email protected], npm/@babel/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from bb74660 to 0d8bd44 Compare June 4, 2024 10:23
@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Jun 4, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@socket-security Socket Security
Copy link

socket-security bot commented Jun 4, 2024 •
edited
Loading

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report↗︎

@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 0d8bd44 to 0af91b9 Compare August 6, 2024 07:24
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 0af91b9 to 8a2c802 Compare August 13, 2024 22:04
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.6.0 [security] fix(deps): update dependency axios to v1.7.4 [security] Aug 13, 2024
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@SocialGroovyBot