Skip to content

fix(deps): update dependency axios to v1.6.0 [security] #108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 11, 2023

This PR contains the following updates:

Package Change Age Confidence
axios (source) 1.1.3 -> 1.6.0 age confidence

GitHub Vulnerability Alerts

CVE-2023-45857

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.


Release Notes

axios/axios (axios)

v1.6.0

Compare Source

Features
Contributors to this release

1.6.8 (2024-03-15)

Bug Fixes
  • AxiosHeaders: fix AxiosHeaders conversion to an object during config merging (#​6243) (2656612)
  • import: use named export for EventEmitter; (7320430)
  • vulnerability: update follow-redirects to 1.15.6 (#​6300) (8786e0f)
Contributors to this release

1.6.7 (2024-01-25)

Bug Fixes
  • capture async stack only for rejections with native error objects; (#​6203) (1a08f90)
Contributors to this release

1.6.6 (2024-01-24)

Bug Fixes
Contributors to this release

1.6.5 (2024-01-05)

Bug Fixes
Contributors to this release

1.6.4 (2024-01-03)

Bug Fixes
  • security: fixed formToJSON prototype pollution vulnerability; (#​6167) (3c0c11c)
  • security: fixed security vulnerability in follow-redirects (#​6163) (75af1cd)
Contributors to this release

1.6.3 (2023-12-26)

Bug Fixes
Contributors to this release

1.6.2 (2023-11-14)

Features
  • withXSRFToken: added withXSRFToken option as a workaround to achieve the old withCredentials behavior; (#​6046) (cff9967)
PRs
  • feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #​6046 )

📢 This PR added 'withXSRFToken' option as a replacement for old withCredentials behaviour. 
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.
Contributors to this release

1.6.1 (2023-11-08)

Bug Fixes
  • formdata: fixed content-type header normalization for non-standard browser environments; (#​6056) (dd465ab)
  • platform: fixed emulated browser detection in node.js environment; (#​6055) (3dc8369)
Contributors to this release
PRs
  • feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #​6046 )

📢 This PR added 'withXSRFToken' option as a replacement for old withCredentials behaviour. 
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.

v1.5.1

Compare Source

Bug Fixes
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
Contributors to this release

1.5.1 (2023-09-26)

Bug Fixes
  • adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
  • formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
  • headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
  • types: removed duplicated code (9e62056)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

v1.5.0

Compare Source

Bug Fixes
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
Contributors to this release

1.5.1 (2023-09-26)

Bug Fixes
  • adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
  • formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
  • headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
  • types: removed duplicated code (9e62056)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

v1.4.0

Compare Source

Bug Fixes
  • formdata: add multipart/form-data content type for FormData payload on custom client environments; (#​5678) (bbb61e7)
  • package: export package internals with unsafe path prefix; (#​5677) (df38c94)
Features
Performance Improvements
  • merge-config: optimize mergeConfig performance by avoiding duplicate key visits; (#​5679) (e6f7053)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.6 (2023-04-19)

Bug Fixes
  • types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
  • utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.5 (2023-04-05)

Bug Fixes
  • headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
  • params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.4 (2023-02-22)

Bug Fixes
  • blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
  • http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.3 (2023-02-13)

Bug Fixes
  • formdata: added a check to make sure the FormData class is available in the browser's global scope; (#​5545) (a6dfa72)
  • formdata: fixed setting NaN as Content-Length for form payload in some cases; (#​5535) (c19f7bf)
  • headers: fixed the filtering logic of the clear method; (#​5542) (ea87ebf)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.2 (2023-02-03)

Bug Fixes
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.1 (2023-02-01)

Bug Fixes
  • formdata: add hotfix to use the asynchronous API to compute the content-length header value; (#​5521) (96d336f)
  • serializer: fixed serialization of array-like objects; (#​5518) (08104c0)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

v1.3.6

Compare Source

Bug Fixes
  • formdata: add multipart/form-data content type for FormData payload on custom client environments; (#​5678) (bbb61e7)
  • package: export package internals with unsafe path prefix; (#​5677) (df38c94)
Features
Performance Improvements
  • merge-config: optimize mergeConfig performance by avoiding duplicate key visits; (#​5679) (e6f7053)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.6 (2023-04-19)

Bug Fixes
  • types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
  • utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.5 (2023-04-05)

Bug Fixes
  • headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
  • params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.4 (2023-02-22)

Bug Fixes
  • blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
  • http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.3 (2023-02-13)

Bug Fixes
  • formdata: added a check to make sure the FormData class is available in the browser's global scope; (#​5545) (a6dfa72)
  • formdata: fixed setting NaN as Content-Length for form payload in some cases; (#​5535) (c19f7bf)
  • headers: fixed the filtering logic of the clear method; (#​5542) (ea87ebf)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.2 (2023-02-03)

Bug Fixes
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.1 (2023-02-01)

Bug Fixes
  • formdata: add hotfix to use the asynchronous API to compute the content-length header value; (#​5521) (96d336f)
  • serializer: fixed serialization of array-like objects; (#​5518) (08104c0)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

v1.3.5

Compare Source

Bug Fixes
  • formdata: add multipart/form-data content type for FormData payload on custom client environments; (#​5678) (bbb61e7)
  • package: export package internals with unsafe path prefix; (#​5677) (df38c94)
Features
Performance Improvements
  • merge-config: optimize mergeConfig performance by avoiding duplicate key visits; (#​5679) (e6f7053)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.6 (2023-04-19)

Bug Fixes
  • types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
  • utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.5 (2023-04-05)

Bug Fixes
  • headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
  • params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.4 (2023-02-22)

Bug Fixes
  • blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
  • http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.3 (2023-02-13)

Bug Fixes
  • formdata: added a check to make sure the FormData class is available in the browser's global scope; (#​5545) (a6dfa72)
  • formdata: fixed setting NaN as Content-Length for form payload in some cases; (#​5535) (c19f7bf)
  • headers: fixed the filtering logic of the clear method; (#​5542) (ea87ebf)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.2 (2023-02-03)

Bug Fixes
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.1 (2023-02-01)

Bug Fixes
  • formdata: add hotfix to use the asynchronous API to compute the content-length header value; (#​5521) (96d336f)
  • serializer: fixed serialization of array-like objects; (#​5518) (08104c0)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

v1.3.4

Compare Source

Bug Fixes
  • formdata: add multipart/form-data content type for FormData payload on custom client environments; (#​5678) (bbb61e7)
  • package: export package internals with unsafe path prefix; (#​5677) (df38c94)
Features
Performance Improvements
  • merge-config: optimize mergeConfig performance by avoiding duplicate key visits; (#​5679) (e6f7053)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.6 (2023-04-19)

Bug Fixes
  • types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
  • utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.5 (2023-04-05)

Bug Fixes
  • headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
  • params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.4 (2023-02-22)

Bug Fixes
  • blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
  • http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.3 (2023-02-13)

Bug Fixes
  • formdata: added a check to make sure the FormData class is available in the browser's global scope; (#​5545) (a6dfa72)
  • formdata: fixed setting NaN as Content-Length for form payload in some cases; (#​5535) (c19f7bf)
  • headers: fixed the filtering logic of the clear method; (#​5542) (ea87ebf)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.3.2 (2023-02-03)

B

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Kolkata, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

vercel bot commented Nov 11, 2023

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
random-words-api ❌ Failed (Inspect) Jun 4, 2025 10:16am

@renovate renovate bot added the renovate label Nov 11, 2023
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 1d2daa6 to 0d5adc1 Compare November 16, 2023 11:50
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 0d5adc1 to ba95b21 Compare January 28, 2024 12:41
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from ba95b21 to 3d1386b Compare March 20, 2024 14:03
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 3d1386b to 754cede Compare June 4, 2024 12:05
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 754cede to 4f84cee Compare August 6, 2024 08:14
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 4f84cee to b3c5032 Compare August 28, 2024 09:38
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from b3c5032 to 3a42b8f Compare October 9, 2024 11:16
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 3a42b8f to 06c5e18 Compare December 2, 2024 11:47
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 06c5e18 to 1d2d694 Compare January 23, 2025 17:50
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 1d2d694 to 36a3d21 Compare January 30, 2025 17:14
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 36a3d21 to b32344a Compare March 3, 2025 11:43
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from b32344a to 002e476 Compare March 8, 2025 14:06
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.6.0 [security] fix(deps): update dependency axios to v1.8.2 [security] Mar 8, 2025
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 002e476 to a055a5a Compare March 11, 2025 10:27
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from a055a5a to 82d41ad Compare March 13, 2025 15:38
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 82d41ad to 0d94eb9 Compare March 28, 2025 15:11
@renovate renovate bot changed the title fix(deps): update dependency axios to v1.8.2 [security] fix(deps): update dependency axios to v1.6.0 [security] Mar 28, 2025
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 0d94eb9 to c25f193 Compare April 1, 2025 10:56
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from c25f193 to 6d20a5e Compare April 8, 2025 10:22
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 6d20a5e to 691c6b6 Compare April 24, 2025 07:06
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 691c6b6 to e7d9991 Compare May 19, 2025 16:35
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from e7d9991 to 23f387e Compare May 28, 2025 09:46
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 23f387e to 379da20 Compare June 4, 2025 10:16
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 379da20 to 834d681 Compare June 22, 2025 15:28
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 834d681 to 5a41a67 Compare July 2, 2025 19:15
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 5a41a67 to 21dbe2a Compare August 10, 2025 12:51
@renovate renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 21dbe2a to d28784d Compare August 13, 2025 14:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants