Moderate security vulnerability for versions of Axios 0.8.1 - 1.5.1 (Dependency)

[OIRNOIR]

This shows a moderate security vulnerability in the npm audit text, since PM2 depends on this package. The fixed version is Axios 1.6.0 and higher. I suggest we migrate towards that one.

[RobinTail]

Reference: GHSA-wf5p-g6vw-rhxx

[globalexport]

Maybe it is time to leave axios for another library since the used v0.21.4 is far away from current state. Undici perhaps?

[buffcode]

@globalexport Axios is maintained. pm2/js-api isn't maintained enough to keep up with dependency updates ;)

[globalexport]

@buffcode You are right. Although it would be nice to avoid having such a dependency at all. I am getting audit failures for dozens of projects just because of this case everyday. And it's open for two weeks now. :/

[MartinFalatic]

Any package that isn't maintained enough to keep up with vulnerabilities is effectively dead. Either the vulnerability should be fixed or the package replaced.

[OIRNOIR]

Any package that isn't maintained enough to keep up with vulnerabilities is effectively dead. Either the vulnerability should be fixed or the package replaced.

The package itself's vulnerability has been fixed. We are just using a severely outdated version of said package. We need to update the package or else it is this project that becomes "effectively dead".

[JackHammer29]

Any update on this please?

[OIRNOIR]

Any update on this please?

We're still waiting for @Unitech to review my PR. It's honestly getting annoying seeing Dependabot email me about this vulnerability.

[guizzo]

@Unitech Any update?

[estevanpedro]

How do i fix this? Should i stop using pm2? What are the others options/solutions?

[smo043]

Added details here - Unitech/pm2#5728

[boxexchanger]

@Unitech any update?

[Unitech]

fixed via pm2@5.3.1

[kopacko]

The UUID version issue is not fixed with pm2 v5.3.1.

/usr/lib
├─┬ pm2@5.3.1
│ └─┬ @pm2/io@5.0.2
│   ├─┬ @opencensus/core@0.0.9
│   │ └── uuid@3.4.0
│   └─┬ @opencensus/propagation-b3@0.0.8
│     ├─┬ @opencensus/core@0.0.8
│     │ └── uuid@3.4.0 deduped
│     └── uuid@3.4.0 deduped
└── uuid@9.0.1