search

nusmodifications / nusmods

🏫 Official course planning platform for National University of Singapore.
https://nusmods.com
MIT License
557 stars 270 forks source link

fix(deps): update dependency axios [security] #3641

Open renovate[bot] opened 7 months ago

renovate[bot] commented 7 months ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
axios (source) 1.4.0 -> 1.6.0 age adoption passing confidence
axios (source) 0.27.2 -> 0.28.0 age adoption passing confidence
axios (source) 1.3.4 -> 1.6.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-45857

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Release Notes

axios/axios (axios) ### [`v1.6.0`](https://togithub.com/axios/axios/blob/HEAD/CHANGELOG.md#160-2023-10-26) [Compare Source](https://togithub.com/axios/axios/compare/v1.5.1...v1.6.0) ##### Bug Fixes - **CSRF:** fixed CSRF vulnerability CVE-2023-45857 ([#​6028](https://togithub.com/axios/axios/issues/6028)) ([96ee232](https://togithub.com/axios/axios/commit/96ee232bd3ee4de2e657333d4d2191cd389e14d0)) - **dns:** fixed lookup function decorator to work properly in node v20; ([#​6011](https://togithub.com/axios/axios/issues/6011)) ([5aaff53](https://togithub.com/axios/axios/commit/5aaff532a6b820bb9ab6a8cd0f77131b47e2adb8)) - **types:** fix AxiosHeaders types; ([#​5931](https://togithub.com/axios/axios/issues/5931)) ([a1c8ad0](https://togithub.com/axios/axios/commit/a1c8ad008b3c13d53e135bbd0862587fb9d3fc09)) ##### PRs - CVE 2023 45857 ( [#​6028](https://api.github.com/repos/axios/axios/pulls/6028) ) ``` ⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459 ``` ##### Contributors to this release - avatar [Dmitriy Mozgovoy](https://togithub.com/DigitalBrainJS "+449/-114 (#​6032 #​6021 #​6011 #​5932 #​5931 )") - avatar [Valentin Panov](https://togithub.com/valentin-panov "+4/-4 (#​6028 )") - avatar [Rinku Chaudhari](https://togithub.com/therealrinku "+1/-1 (#​5889 )") #### [1.5.1](https://togithub.com/axios/axios/compare/v1.5.0...v1.5.1) (2023-09-26) ##### Bug Fixes - **adapters:** improved adapters loading logic to have clear error messages; ([#​5919](https://togithub.com/axios/axios/issues/5919)) ([e410779](https://togithub.com/axios/axios/commit/e4107797a7a1376f6209fbecfbbce73d3faa7859)) - **formdata:** fixed automatic addition of the `Content-Type` header for FormData in non-browser environments; ([#​5917](https://togithub.com/axios/axios/issues/5917)) ([bc9af51](https://togithub.com/axios/axios/commit/bc9af51b1886d1b3529617702f2a21a6c0ed5d92)) - **headers:** allow `content-encoding` header to handle case-insensitive values ([#​5890](https://togithub.com/axios/axios/issues/5890)) ([#​5892](https://togithub.com/axios/axios/issues/5892)) ([4c89f25](https://togithub.com/axios/axios/commit/4c89f25196525e90a6e75eda9cb31ae0a2e18acd)) - **types:** removed duplicated code ([9e62056](https://togithub.com/axios/axios/commit/9e6205630e1c9cf863adf141c0edb9e6d8d4b149)) ##### Contributors to this release - avatar [Dmitriy Mozgovoy](https://togithub.com/DigitalBrainJS "+89/-18 (#​5919 #​5917 )") - avatar [David Dallas](https://togithub.com/DavidJDallas "+11/-5 ()") - avatar [Sean Sattler](https://togithub.com/fb-sean "+2/-8 ()") - avatar [Mustafa Ateş Uzun](https://togithub.com/0o001 "+4/-4 ()") - avatar [Przemyslaw Motacki](https://togithub.com/sfc-gh-pmotacki "+2/-1 (#​5892 )") - avatar [Michael Di Prisco](https://togithub.com/Cadienvan "+1/-1 ()") ##### PRs - CVE 2023 45857 ( [#​6028](https://api.github.com/repos/axios/axios/pulls/6028) ) ``` ⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459 ``` ### [`v1.5.1`](https://togithub.com/axios/axios/blob/HEAD/CHANGELOG.md#151-2023-09-26) [Compare Source](https://togithub.com/axios/axios/compare/v1.5.0...v1.5.1) ##### Bug Fixes - **adapters:** improved adapters loading logic to have clear error messages; ([#​5919](https://togithub.com/axios/axios/issues/5919)) ([e410779](https://togithub.com/axios/axios/commit/e4107797a7a1376f6209fbecfbbce73d3faa7859)) - **formdata:** fixed automatic addition of the `Content-Type` header for FormData in non-browser environments; ([#​5917](https://togithub.com/axios/axios/issues/5917)) ([bc9af51](https://togithub.com/axios/axios/commit/bc9af51b1886d1b3529617702f2a21a6c0ed5d92)) - **headers:** allow `content-encoding` header to handle case-insensitive values ([#​5890](https://togithub.com/axios/axios/issues/5890)) ([#​5892](https://togithub.com/axios/axios/issues/5892)) ([4c89f25](https://togithub.com/axios/axios/commit/4c89f25196525e90a6e75eda9cb31ae0a2e18acd)) - **types:** removed duplicated code ([9e62056](https://togithub.com/axios/axios/commit/9e6205630e1c9cf863adf141c0edb9e6d8d4b149)) ##### Contributors to this release - avatar [Dmitriy Mozgovoy](https://togithub.com/DigitalBrainJS "+89/-18 (#​5919 #​5917 )") - avatar [David Dallas](https://togithub.com/DavidJDallas "+11/-5 ()") - avatar [Sean Sattler](https://togithub.com/fb-sean "+2/-8 ()") - avatar [Mustafa Ateş Uzun](https://togithub.com/0o001 "+4/-4 ()") - avatar [Przemyslaw Motacki](https://togithub.com/sfc-gh-pmotacki "+2/-1 (#​5892 )") - avatar [Michael Di Prisco](https://togithub.com/Cadienvan "+1/-1 ()") ### [`v1.5.0`](https://togithub.com/axios/axios/blob/HEAD/CHANGELOG.md#150-2023-08-26) [Compare Source](https://togithub.com/axios/axios/compare/v1.4.0...v1.5.0) ##### Bug Fixes - **adapter:** make adapter loading error more clear by using platform-specific adapters explicitly ([#​5837](https://togithub.com/axios/axios/issues/5837)) ([9a414bb](https://togithub.com/axios/axios/commit/9a414bb6c81796a95c6c7fe668637825458e8b6d)) - **dns:** fixed `cacheable-lookup` integration; ([#​5836](https://togithub.com/axios/axios/issues/5836)) ([b3e327d](https://togithub.com/axios/axios/commit/b3e327dcc9277bdce34c7ef57beedf644b00d628)) - **headers:** added support for setting header names that overlap with class methods; ([#​5831](https://togithub.com/axios/axios/issues/5831)) ([d8b4ca0](https://togithub.com/axios/axios/commit/d8b4ca0ea5f2f05efa4edfe1e7684593f9f68273)) - **headers:** fixed common Content-Type header merging; ([#​5832](https://togithub.com/axios/axios/issues/5832)) ([8fda276](https://togithub.com/axios/axios/commit/8fda2766b1e6bcb72c3fabc146223083ef13ce17)) ##### Features - export getAdapter function ([#​5324](https://togithub.com/axios/axios/issues/5324)) ([ca73eb8](https://togithub.com/axios/axios/commit/ca73eb878df0ae2dace81fe3a7f1fb5986231bf1)) - **export:** export adapters without `unsafe` prefix ([#​5839](https://togithub.com/axios/axios/issues/5839)) ([1601f4a](https://togithub.com/axios/axios/commit/1601f4a27a81ab47fea228f1e244b2c4e3ce28bf)) ##### Contributors to this release - avatar [Dmitriy Mozgovoy](https://togithub.com/DigitalBrainJS "+66/-29 (#​5839 #​5837 #​5836 #​5832 #​5831 )") - avatar [夜葬](https://togithub.com/geekact "+42/-0 (#​5324 )") - avatar [Jonathan Budiman](https://togithub.com/JBudiman00 "+30/-0 (#​5788 )") - avatar [Michael Di Prisco](https://togithub.com/Cadienvan "+3/-5 (#​5791 )")

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Singapore, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

This PR has been generated by Mend Renovate. View repository job log here.

vercel[bot] commented 7 months ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
nusmods-export ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jul 7, 2024 4:41pm
nusmods-website ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jul 7, 2024 4:41pm
codecov[bot] commented 7 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 53.60%. Comparing base (ada49e0) to head (f951ba2).

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #3641 +/- ## ======================================= Coverage 53.60% 53.60% ======================================= Files 274 274 Lines 6025 6025 Branches 1446 1446 ======================================= Hits 3230 3230 Misses 2795 2795 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.