fix(deps): upgrade axios and typescript

infinitered / apisauce

Axios + standardized errors + request/response transforms.

MIT License

2.78k stars 184 forks source link

fix(deps): upgrade axios and typescript #288

Closed jeremyadavis closed 1 year ago

jeremyadavis commented 2 years ago

This fixes vulnerabilities in the axios library: CVE-2022-0155 and CVE-2022-0536.

There are a couple of things to consider if this PR is worth merging:

There are a few breaking changes in axios along the way from 0.21.4 to 0.26.1
Axios used the AbortController type from the DOM library and now doesn't. The upgrade broke a type and the fix was to add "dom" to the tsconfig. Really not sure if that is the correct work around or not.
The upgrade needed the Omit utility type which wasn't added until 3.5.1, so I had to upgrade the typescript dependency TBH, I don't understand why the tsconfig doesn't exclude node_modules, so maybe that's the better approach unless I'm missing something.

I tested this locally with my company's iOS and Android app and saw no issues. I did not test on the web.

Fixes: #287

jeremyadavis commented 2 years ago

I uncovered an issue with this upgrade and multi-part/form-data:

There is a hack to get around it, but the official fix isn't merged yet so I'm going to undo my usage of the axios upgrade until an official fix is available.

I'll try to remember to update the PR when fixed.

chakrihacker commented 2 years ago

Thanks @jeremyadavis for the PR

noah-eigenfeld commented 2 years ago

@jeremyadavis you should try bumping the version of axios to 0.27.2 per this comment in one of the issues you mentioned.

jeremyadavis commented 2 years ago

I upgrade axios to 0.27.2 I confirmed that it does fix the issue with the multipart/form-data was broken using my company's React Native app.

Notably, axios 0.27.0 had refactored their error handling which broke a couple of tests that had expected null responses, that now have explicit error strings.

tgensol commented 2 years ago

Any update on this one ? thank you !

florinvasilevilsan commented 2 years ago

Could someone please merge and release this? It has been months since it was opened.

hariks-mm commented 2 years ago

@infinitered-circleci @jamonholmgren Any update on this?

Thank you

TheWirv commented 1 year ago

What's the status on this?

eithe commented 1 year ago

Any chance this could be merged and released? Perhaps labeled as beta for a while?

nazrdogan commented 1 year ago

Any update ?

pgodha commented 1 year ago

When this PR can be merged? upgrading axios lib version will fix CVE-2022-0155 and CVE-2022-0536.

surethink commented 1 year ago

@infinitered-circleci any one can merge this? thanks

eithe commented 1 year ago

Pretty please @jamonholmgren, is anyone on your team able to merge this? Or should we move on from apisauce? That's ok, but would be good to know.

jamonholmgren commented 1 year ago

Hey folks, I'll take a look at this. Kinda slipped off my radar. Not enough people tagged me :joy:

infinitered-circleci commented 1 year ago

:tada: This PR is included in version 3.0.0 :tada:

The release is available on:

Your semantic-release bot :package::rocket:

jamonholmgren commented 1 year ago

@jeremyadavis Thanks a ton for sending in this PR, and for your patience.

We've been focusing on Ignite and Reactotron lately, but apisauce is on our list to revive at some point.

TheScalion commented 3 months ago

I have downgraded to ^2.1.5 this version and its working for me. i will upgrade if this PR merge.