siddharthkp / bundlesize

Keep your bundle size in check
MIT License
4.46k stars 180 forks source link

fix security vulnerability in axios and update dependencies #387

Open LeichtF opened 1 month ago

LeichtF commented 1 month ago

Do you want to request a feature or report a bug? bug

What is the current behavior?

If the current behavior is a bug, please provide the steps to reproduce.

What is the expected behavior?

If this is a feature request, what is motivation or use case for changing the behavior?

Please mention other relevant information.

falsyvalues commented 1 week ago

Resolved Partially resolved in #382

LeichtF commented 1 week ago

@falsyvalues I disagree. #382 upgraded axios from 0.21.1 to 1.6.2 and github-build from 1.2.2 to 1.2.4.

388 is taking care of more packages and also upgrades to newer versions. axios should be upgraded to 1.6.4 or above to include the latest security fixes (see release notes for axios 1.6.4)

edit: axios v.1.6.8 adds another security fix

falsyvalues commented 1 week ago

@LeichtF Oh, let me correct that. Anyway its up to maintainer if he wants to be on the edge with other dependencies.