Remove axios from dependencies due to reported security vulnerability causing false alert

[erikeckhardt]

Vulnerability CVE-2019-10742 in npm package axios has been identified in the National Vulnerability Database.

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

Because axios is still listed in dependencies of js-sumo-logger, code depending on js-sumo-logger is getting flagged as having a security vulnerability.

This issue is thus for tracking removing axios from the dependency.

For more information from the axios side:

• axios issue 1098 – Download continues after maxContentLength exceeded
• axios PR 1485 – Destroy stream on exceeding maxContentLength
• axios release 0.19.0

[erikeckhardt]

I have submitted PR #79 to fix this issue.

[billsaysthis]

Thanks @erikeckhardt but we are removing Axios in favor of SuperAgent. Not sure why the line for Axios was left in the package but I will file a new PR removing it shortly.

[erikeckhardt]

That's a perfectly acceptable solution. Just for convenience, I've updated my PR to remove that as well, if you feel like merging it.

[billsaysthis]

Removed Axios in #80.

[erikeckhardt]

Ah, I see you've already created and merged your own. Pity, as I could easily have updated my PR for you. Thanks for taking care of it!

Do you expect a patch release soon?

[billsaysthis]

Yes, just triggered the script.