Skip to content

Commit

Permalink
fix(deps): update dependency axios to v1.7.4 [security] (#11977)
Browse files Browse the repository at this point in the history
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [axios](https://axios-http.com) ([source](https://togithub.com/axios/axios)) | [`1.7.3` -> `1.7.4`](https://renovatebot.com/diffs/npm/axios/1.7.3/1.7.4) | [![age](https://developer.mend.io/api/mc/badges/age/npm/axios/1.7.4?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/axios/1.7.4?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/axios/1.7.3/1.7.4?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/axios/1.7.3/1.7.4?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

### GitHub Vulnerability Alerts

#### [CVE-2023-45857](https://nvd.nist.gov/vuln/detail/CVE-2023-45857)

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

#### [CVE-2024-39338](https://nvd.nist.gov/vuln/detail/CVE-2024-39338)

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

---

### Release Notes

<details>
<summary>axios/axios (axios)</summary>

### [`v1.7.4`](https://togithub.com/axios/axios/blob/HEAD/CHANGELOG.md#174-2024-08-13)

[Compare Source](https://togithub.com/axios/axios/compare/v1.7.3...v1.7.4)

##### Bug Fixes

-   **sec:** CVE-2024-39338 ([#&#8203;6539](https://togithub.com/axios/axios/issues/6539)) ([#&#8203;6543](https://togithub.com/axios/axios/issues/6543)) ([6b6b605](https://togithub.com/axios/axios/commit/6b6b605eaf73852fb2dae033f1e786155959de3a))
-   **sec:** disregard protocol-relative URL to remediate SSRF ([#&#8203;6539](https://togithub.com/axios/axios/issues/6539)) ([07a661a](https://togithub.com/axios/axios/commit/07a661a2a6b9092c4aa640dcc7f724ec5e65bdda))

##### Contributors to this release

-   <img src="https://avatars.githubusercontent.com/u/31389480?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [Lev Pachmanov](https://togithub.com/levpachmanov "+47/-11 (#&#8203;6543 )")
-   <img src="https://avatars.githubusercontent.com/u/41283691?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [Đỗ Trọng Hải](https://togithub.com/hainenber "+49/-4 (#&#8203;6539 )")

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/carbon-design-system/carbon-for-ibm-dotcom).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC4yNi4xIiwidXBkYXRlZEluVmVyIjoiMzguMjYuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
  • Loading branch information
renovate[bot] authored Aug 14, 2024
1 parent b8983f2 commit fb74b72
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
Binary file not shown.
6 changes: 3 additions & 3 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -10598,13 +10598,13 @@ __metadata:
linkType: hard

"axios@npm:^1.0.0, axios@npm:^1.6.8":
version: 1.7.3
resolution: "axios@npm:1.7.3"
version: 1.7.4
resolution: "axios@npm:1.7.4"
dependencies:
follow-redirects: "npm:^1.15.6"
form-data: "npm:^4.0.0"
proxy-from-env: "npm:^1.1.0"
checksum: 10/7f92af205705a8fb4a9d35666b663729507657f252a1d39d83582590119941872d49078017cf992e32f47aa3b7317f5439f77be772a173dac2ae0fedd38f43ae
checksum: 10/7a1429be1e3d0c2e1b96d4bba4d113efbfabc7c724bed107beb535c782c7bea447ff634886b0c7c43395a264d085450d009eb1154b5f38a8bae49d469fdcbc61
languageName: node
linkType: hard

Expand Down

0 comments on commit fb74b72

Please sign in to comment.