fix(deps): update dependency axios to v1.7.4 [security] #271

renovate · 2023-11-11T13:30:39Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
axios (source)	`1.4.0` -> `1.7.4`

GitHub Vulnerability Alerts

CVE-2023-45857

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Release Notes

axios/axios (axios)

`v1.7.4`

Compare Source

Bug Fixes

sec: CVE-2024-39338 (#6539) (#6543) (6b6b605)
sec: disregard protocol-relative URL to remediate SSRF (#6539) (07a661a)

Contributors to this release

`v1.7.3`

Compare Source

Bug Fixes

adapter: fix progress event emitting; (#6518) (e3c76fc)
fetch: fix withCredentials request config (#6505) (85d4d0e)
xhr: return original config on errors from XHR adapter (#6515) (8966ee7)

Contributors to this release

`v1.7.2`

Compare Source

Bug Fixes

fetch: enhance fetch API detection; (#6413) (4f79aef)

Contributors to this release

Dmitriy Mozgovoy

`v1.7.1`

Compare Source

Bug Fixes

fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#6410) (733f15f)

Contributors to this release

Dmitriy Mozgovoy

`v1.7.0`

Compare Source

Features

adapter: add fetch adapter; (#6371) (a3ff99b)

Bug Fixes

core/axios: handle un-writable error stack (#6362) (81e0455)

Contributors to this release

`v1.6.8`

Compare Source

Bug Fixes

AxiosHeaders: fix AxiosHeaders conversion to an object during config merging (#6243) (2656612)
import: use named export for EventEmitter; (7320430)
vulnerability: update follow-redirects to 1.15.6 (#6300) (8786e0f)

Contributors to this release

`v1.6.7`

Compare Source

Bug Fixes

capture async stack only for rejections with native error objects; (#6203) (1a08f90)

Contributors to this release

`v1.6.6`

Compare Source

Bug Fixes

fixed missed dispatchBeforeRedirect argument (#5778) (a1938ff)
wrap errors to improve async stack trace (#5987) (123f354)

Contributors to this release

`v1.6.5`

Compare Source

Bug Fixes

ci: refactor notify action as a job of publish action; (#6176) (0736f95)
dns: fixed lookup error handling; (#6175) (f4f2b03)

Contributors to this release

`v1.6.4`

Compare Source

Bug Fixes

security: fixed formToJSON prototype pollution vulnerability; (#6167) (3c0c11c)
security: fixed security vulnerability in follow-redirects (#6163) (75af1cd)

Contributors to this release

`v1.6.3`

Compare Source

Bug Fixes

Regular Expression Denial of Service (ReDoS) (#6132) (5e7ad38)

Contributors to this release

`v1.6.2`

Compare Source

Features

withXSRFToken: added withXSRFToken option as a workaround to achieve the old withCredentials behavior; (#6046) (cff9967)

PRs

feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #6046 )


📢 This PR added &#x27;withXSRFToken&#x27; option as a replacement for old withCredentials behaviour. 
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.

Contributors to this release

`v1.6.1`

Compare Source

Bug Fixes

formdata: fixed content-type header normalization for non-standard browser environments; (#6056) (dd465ab)
platform: fixed emulated browser detection in node.js environment; (#6055) (3dc8369)

Contributors to this release

`v1.6.0`

Compare Source

Bug Fixes

CSRF: fixed CSRF vulnerability CVE-2023-45857 (#6028) (96ee232)
dns: fixed lookup function decorator to work properly in node v20; (#6011) (5aaff53)
types: fix AxiosHeaders types; (#5931) (a1c8ad0)

PRs

CVE 2023 45857 ( #6028 )


⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

Contributors to this release

1.5.1 (2023-09-26)

Bug Fixes

adapters: improved adapters loading logic to have clear error messages; (#5919) (e410779)
formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#5917) (bc9af51)
headers: allow content-encoding header to handle case-insensitive values (#5890) (#5892) (4c89f25)
types: removed duplicated code (9e62056)

Contributors to this release

PRs

CVE 2023 45857 ( #6028 )


⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

`v1.5.1`

Compare Source

Bug Fixes

adapters: improved adapters loading logic to have clear error messages; (#5919) (e410779)
formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#5917) (bc9af51)
headers: allow content-encoding header to handle case-insensitive values (#5890) (#5892) (4c89f25)
types: removed duplicated code (9e62056)

Contributors to this release

`v1.5.0`

Compare Source

Bug Fixes

adapter: make adapter loading error more clear by using platform-specific adapters explicitly (#5837) (9a414bb)
dns: fixed cacheable-lookup integration; (#5836) (b3e327d)
headers: added support for setting header names that overlap with class methods; (#5831) (d8b4ca0)
headers: fixed common Content-Type header merging; (#5832) (8fda276)

Features

export getAdapter function (#5324) (ca73eb8)
export: export adapters without unsafe prefix (#5839) (1601f4a)

Contributors to this release

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sonarqubecloud · 2023-11-11T13:31:09Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

sonarqubecloud · 2024-02-21T03:35:07Z

Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-06-04T10:35:12Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-08-13T20:11:40Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-10-09T10:04:29Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

renovate bot changed the title ~~fix(deps): update dependency axios to v1.6.0 [security]~~ fix(deps): update dependency axios to v1.6.0 [security] - autoclosed Feb 20, 2024

renovate bot closed this Feb 20, 2024

renovate bot deleted the renovate/npm-axios-vulnerability branch February 20, 2024 21:55

renovate bot changed the title ~~fix(deps): update dependency axios to v1.6.0 [security] - autoclosed~~ fix(deps): update dependency axios to v1.6.0 [security] Feb 21, 2024

renovate bot reopened this Feb 21, 2024

renovate bot restored the renovate/npm-axios-vulnerability branch February 21, 2024 03:34

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 3ca4420 to 2b2e1c0 Compare February 21, 2024 03:34

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 2b2e1c0 to 0b10a25 Compare June 4, 2024 10:34

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 0b10a25 to 134a694 Compare August 13, 2024 20:11

renovate bot changed the title ~~fix(deps): update dependency axios to v1.6.0 [security]~~ fix(deps): update dependency axios to v1.7.4 [security] Aug 13, 2024

fix(deps): update dependency axios to v1.7.4 [security]

99917c9

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 134a694 to 99917c9 Compare October 9, 2024 10:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency axios to v1.7.4 [security] #271

fix(deps): update dependency axios to v1.7.4 [security] #271

renovate bot commented Nov 11, 2023 •

edited

Loading

sonarqubecloud bot commented Nov 11, 2023

sonarqubecloud bot commented Feb 21, 2024

sonarqubecloud bot commented Jun 4, 2024

sonarqubecloud bot commented Aug 13, 2024

sonarqubecloud bot commented Oct 9, 2024

fix(deps): update dependency axios to v1.7.4 [security] #271

Are you sure you want to change the base?

fix(deps): update dependency axios to v1.7.4 [security] #271

Conversation

renovate bot commented Nov 11, 2023 • edited Loading

GitHub Vulnerability Alerts

Release Notes

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Features

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Features

PRs

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

PRs

Contributors to this release

1.5.1 (2023-09-26)

Bug Fixes

Contributors to this release

PRs

Bug Fixes

Contributors to this release

Bug Fixes

Features

Contributors to this release

Configuration

sonarqubecloud bot commented Nov 11, 2023

sonarqubecloud bot commented Feb 21, 2024

Quality Gate passed

sonarqubecloud bot commented Jun 4, 2024

Quality Gate passed

sonarqubecloud bot commented Aug 13, 2024

Quality Gate passed

sonarqubecloud bot commented Oct 9, 2024

Quality Gate passed

renovate bot commented Nov 11, 2023 •

edited

Loading