meetmatt / colla

Collaborative 360-degree review
0 stars 0 forks source link

[Snyk] Upgrade axios from 0.18.0 to 0.25.0 #32

Closed meetmatt closed 2 years ago

meetmatt commented 2 years ago

Snyk has created this PR to upgrade axios from 0.18.0 to 0.25.0.

merge advice As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user.
:sparkles: Snyk has automatically assigned this pull request, set who gets assigned.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-1579269
696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Proof of Concept
Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2332181
696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Proof of Concept
Denial of Service (DoS)
SNYK-JS-AXIOS-174505
696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Proof of Concept
Server-Side Request Forgery (SSRF)
SNYK-JS-AXIOS-1038255
696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Proof of Concept
Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2396346
696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: axios
  • 0.25.0 - 2022-01-18

    0.25.0 (January 18, 2022)

    Breaking changes:

    • Fixing maxBodyLength enforcement (#3786)
    • Don't rely on strict mode behaviour for arguments (#3470)
    • Adding error handling when missing url (#3791)
    • Update isAbsoluteURL.js removing escaping of non-special characters (#3809)
    • Use native Array.isArray() in utils.js (#3836)
    • Adding error handling inside stream end callback (#3967)

    Fixes and Functionality:

    • Added aborted even handler (#3916)
    • Header types expanded allowing boolean and number types (#4144)
    • Fix cancel signature allowing cancel message to be undefined (#3153)
    • Updated type checks to be formulated better (#3342)
    • Avoid unnecessary buffer allocations (#3321)
    • Adding a socket handler to keep TCP connection live when processing long living requests (#3422)
    • Added toFormData helper function (#3757)
    • Adding responseEncoding prop type in AxiosRequestConfig (#3918)

    Internal and Tests:

    • Adding axios-test-instance to ecosystem (#3786)
    • Optimize the logic of isAxiosError (#3546)
    • Add tests and documentation to display how multiple inceptors work (#3564)
    • Updating follow-redirects to version 1.14.7 (#4379)

    Documentation:

    • Fixing changelog to show corrext pull request (#4219)
    • Update upgrade guide for https proxy setting (#3604)

    Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

  • 0.24.0 - 2021-10-25

    0.24.0 (October 25, 2021)

    Breaking changes:

    • Revert: change type of AxiosResponse to any, please read lengthy discussion here: (#4141) pull request: (#4186)

    Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

  • 0.23.0 - 2021-10-12

    0.23.0 (October 12, 2021)

    Breaking changes:

    • Distinguish request and response data types (#4116)
    • Change never type to unknown (#4142)
    • Fixed TransitionalOptions typings (#4147)

    Fixes and Functionality:

    • Adding globalObject: 'this' to webpack config (#3176)
    • Adding insecureHTTPParser type to AxiosRequestConfig (#4066)
    • Fix missing semicolon in typings (#4115)
    • Fix response headers types (#4136)

    Internal and Tests:

    • Improve timeout error when timeout is browser default (#3209)
    • Fix node version on CI (#4069)
    • Added testing to TypeScript portion of project (#4140)

    Documentation:

    • Rename Angular to AngularJS (#4114)

    Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

  • 0.22.0 - 2021-10-01

    0.22.0 (October 01, 2021)

    Fixes and Functionality:

    • Caseless header comparing in HTTP adapter (#2880)
    • Avoid package.json import fixing issues and warnings related to this (#4041), (#4065)
    • Fixed cancelToken leakage and added AbortController support (#3305)
    • Updating CI to run on release branches
    • Bump follow redirects version
    • Fixed default transitional config for custom Axios instance; (#4052)

    Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

  • 0.21.4 - 2021-09-06

    0.21.4 (September 6, 2021)

    Fixes and Functionality:

    • Fixing JSON transform when data is stringified. Providing backward compatibility and complying to the JSON RFC standard (#4020)

    Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

  • 0.21.3 - 2021-09-04

    0.21.3 (September 4, 2021)

    Fixes and Functionality:

    • Fixing response interceptor not being called when request interceptor is attached (#4013)

    Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

  • 0.21.2 - 2021-09-04

    0.21.2 (September 4, 2021)

    Fixes and Functionality:

    • Updating axios requests to be delayed by pre-emptive promise creation (#2702)
    • Adding "synchronous" and "runWhen" options to interceptors api (#2702)
    • Updating of transformResponse (#3377)
    • Adding ability to omit User-Agent header (#3703)
    • Adding multiple JSON improvements (#3688, #3763)
    • Fixing quadratic runtime and extra memory usage when setting a maxContentLength (#3738)
    • Adding parseInt to config.timeout (#3781)
    • Adding custom return type support to interceptor (#3783)
    • Adding security fix for ReDoS vulnerability (#3980)

    Internal and Tests:

    • Updating build dev dependancies (#3401)
    • Fixing builds running on Travis CI (#3538)
    • Updating follow rediect version (#3694, #3771)
    • Updating karma sauce launcher to fix failing sauce tests (#3712, #3717)
    • Updating content-type header for application/json to not contain charset field, according do RFC 8259 (#2154)
    • Fixing tests by bumping karma-sauce-launcher version (#3813)
    • Changing testing process from Travis CI to GitHub Actions (#3938)

    Documentation:

    • Updating documentation around the use of AUTH_TOKEN with multiple domain endpoints (#3539)
    • Remove duplication of item in changelog (#3523)
    • Fixing gramatical errors (#2642)
    • Fixing spelling error (#3567)
    • Moving gitpod metion (#2637)
    • Adding new axios documentation website link (#3681, #3707)
    • Updating documentation around dispatching requests (#3772)
    • Adding documentation for the type guard isAxiosError (#3767)
    • Adding explanation of cancel token (#3803)
    • Updating CI status badge (#3953)
    • Fixing errors with JSON documentation (#3936)
    • Fixing README typo under Request Config (#3825)
    • Adding axios-multi-api to the ecosystem file (#3817)
    • Adding SECURITY.md to properly disclose security vulnerabilities (#3981)

    Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

  • 0.21.1 - 2020-12-22

    0.21.1 (December 21, 2020)

    Fixes and Functionality:

    • Hotfix: Prevent SSRF (#3410)
    • Protocol not parsed when setting proxy config from env vars (#3070)
    • Updating axios in types to be lower case (#2797)
    • Adding a type guard for AxiosError (#2949)

    Internal and Tests:

    • Remove the skipping of the socket http test (#3364)
    • Use different socket for Win32 test (#3375)

    Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

  • 0.21.0 - 2020-10-23
    Read more
  • 0.20.0 - 2020-08-21

    Release of 0.20.0-pre as a full release with no other changes.

  • 0.20.0-0 - 2020-07-15
  • 0.19.2 - 2020-01-22
  • 0.19.1 - 2020-01-07
  • 0.19.0 - 2019-05-30
  • 0.19.0-beta.1 - 2018-08-09
  • 0.18.1 - 2019-06-01
  • 0.18.0 - 2018-02-19
from axios GitHub release notes
Commit messages
Package name: axios
  • 63dfce8 Releasing v0.25
  • dccaeb1 Updated changelog for release
  • 51f3ccb Updating follow-redirects with security updates (#4379)
  • ccc9516 Fixing removing package-lock from gitignore (#4346)
  • ea0d9c6 Adding error handling inside stream end callback (#3967)
  • 4fbf61d Adding responseEncoding prop type in AxiosRequestConfig (#3918)
  • a76571a Use native `Array.isArray()` in `utils.js` (#3836)
  • a8cd75a Update isAbsoluteURL.js (#3809)
  • 9579290 Adding error handling when missing url (#3791)
  • 9964815 toFormData helper function (#3757)
  • c00c4dd Fixing maxBodyLength enforcement (#3786)
  • 962f9ab Update upgrade guide for https proxy setting (#3604)
  • e6aef5a (Add tests to) document how multiple inceptors work (#3564)
  • 6fca6a7 refactor(helpers): optimize the logic of isAxiosError (#3546)
  • 476ee88 chore: ignore yarn.lock file (#3545)
  • 4c8b02d Adding axios-test-instance to ecosystem (#3496)
  • cd1b82b Removing code relying on strict mode behaviour for arguments (#3470)
  • 55e6577 Adding a socket handler for keep TCP connection (#3422)
  • ebedf6b Avoid unnecessary Buffer allocations (#3321)
  • 716d5de Update utils.js (#3342)
  • 5431634 Fixing Cancel' signature. (#3152) (#3153)
  • 6b4fd93 Expand Headers types (#4144)
  • c5fe05b Adding aborted event handler (#3916)
  • 1885ac7 Adding dev branch to CI
Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

👩‍💻 Set who automatically gets assigned

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs