search

mollie / mollie-api-node

Official Mollie API client for Node
http://www.mollie.com
BSD 3-Clause "New" or "Revised" License
238 stars 63 forks source link

Vulnerability in axios #190

Closed amir-secondcompany closed 3 years ago

amir-secondcompany commented 3 years ago

When running npm audit, projects that have @mollie/api-client installed report issue with axios library. Can the specified package be updated?

image

Information about the issue: https://npmjs.com/advisories/1594

Pimm commented 3 years ago

Hi, thanks for opening this issue. As was previously discussed in #187, the security issue in axios is not one which realistically affects Mollie merchants.

The dependency will be updated in the near future. However ‒ as there is no security risk ‒ this will happen in the next planned release instead of a hotfix.

Pimm commented 3 years ago

The latest version of the library uses a newer axios. If anyone is still concerned about this, upgrade to 3.5.0+.