twilio / twilio-node

Node.js helper library

MIT License

1.37k stars 495 forks source link

chore: Update axios to 1.6 to pull in fix for CVE 2023 45857 #971

Closed kitu-apietila closed 8 months ago

kitu-apietila commented 8 months ago

Fixes

Updates axios to 1.6.0
Explicit TypeScript types to fix build/test.

Checklist

[x] I acknowledge that all my contributions will be made under the project's license
[ ] I have made a material change to the repo (functionality, testing, spelling, grammar)
[x] I have read the Contribution Guidelines and my PR follows them
[x] I have titled the PR appropriately
[x] I have updated my branch with the main branch
[ ] I have added tests that prove my fix is effective or that my feature works
[ ] I have added the necessary documentation about the functionality in the appropriate .md file
[ ] I have added inline documentation to the code I modified

If you have questions, please file a support ticket, or create a GitHub Issue in this repository.

yangsu-ab commented 8 months ago

any progress on this? i see another PR opened a week ago addressing this vulnerability.

yangsu-ab commented 8 months ago

@kitu-apietila seems like it got approved, rebase/pull main to get it tested and merged?

kitu-apietila commented 8 months ago

@kitu-apietila seems like it got approved, rebase/pull main to get it tested and merged?

According to Github:

Review required At least 1 approving review is required by reviewers with write access

I've gone ahead and rebased.

yangsu-ab commented 8 months ago

@kitu-apietila seems like it got approved, rebase/pull main to get it tested and merged?

According to Github:

Review required At least 1 approving review is required by reviewers with write access

I've gone ahead and rebased.

i thought deepakverdethos had write access to approve :rofl:

ghost commented 8 months ago

@kitu-apietila seems like it got approved, rebase/pull main to get it tested and merged?

According to Github: Review required At least 1 approving review is required by reviewers with write access I've gone ahead and rebased.

i thought deepakverdethos had write access to approve 🤣

We want this fix so bad, I thought I would give it a try by approving it. Well it didn't work 🤣

tiwarishubham635 commented 8 months ago

Hi! We are working on fixing this pipeline. Should be able to merge it by today. Thanks!

Afellman commented 7 months ago

I see the fix has been merged in. Any ETA on a new version published to NPM?

tiwarishubham635 commented 7 months ago

The new changes will be published this Thursday