[Dependencies] Bump axios version for follow-redirects CVE - Githubissues

aws / aws-parallelcluster-ui

Apache License 2.0

31 stars 17 forks source link

[Dependencies] Bump axios version for follow-redirects CVE #309

Closed judysng closed 4 months ago

judysng commented 4 months ago

Changes

Update axios
- axios v1.6.4 upgrades follow-redirect to v1.15.4 for https://github.com/aws/aws-parallelcluster-ui/security/dependabot/27
Updated attribution doc with new version of axios

How Has This Been Tested?

Tested by running npm install; npm test; npm run export; npm run lint Deployed in personal account, made and deleted a cluster

References

PR Quality Checklist

In order to increase the likelihood of your contribution being accepted, please make sure you have read both the Contributing Guidelines and the Project Guidelines

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

gmarciani commented 4 months ago

Changes LGTM. I see from axios changelog, that some bugs ahve been fixed from 1.6.4 to 1.6.6 (latest version).

Let's consider to upgrade to axios 1.6.6 in a separated PR.