search

infinitered / apisauce

Axios + standardized errors + request/response transforms.
MIT License
2.78k stars 184 forks source link

Update axios dependency to pick up vulnerability #287

Closed eithe closed 1 year ago

eithe commented 2 years ago

The follow-redirects package which is a dependency of axios 0.21.4 is vulnerable; https://github.com/advisories/GHSA-74fj-2j2h-c42q.

Any chance you could update the axios dependency all the way to latest 0.25.0?

ardasatata commented 2 years ago

I've forked the repo and tried to update the axios, seems working properly & the test case doesn't seems to have any problem.

These are the dependencies that I update in my repo

"axios": "^0.25.0",
"@types/node": "15.6.1",
"typescript": "3.9.4"

here is the link to the package.json : package.json

hope it helps 🙏

eithe commented 2 years ago

@ardasatata Perhaps (if you have time) you could submit a PR for this? Last time there was a similar case the PR was accepted I believe.

infinitered-circleci commented 1 year ago

:tada: This issue has been resolved in version 3.0.0 :tada:

The release is available on:

Your semantic-release bot :package::rocket: