[Snyk] Upgrade axios from 0.19.2 to 0.25.0 #8

snyk-bot · 2022-02-22T09:01:33Z

Snyk has created this PR to upgrade axios from 0.19.2 to 0.25.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 11 versions ahead of your current version.
The recommended version was released a month ago, on 2022-01-18.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-1579269	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2332181	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2396346	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: axios

0.25.0 - 2022-01-18
0.25.0 (January 18, 2022)

Breaking changes:
- Fixing maxBodyLength enforcement (#3786)
- Don't rely on strict mode behaviour for arguments (#3470)
- Adding error handling when missing url (#3791)
- Update isAbsoluteURL.js removing escaping of non-special characters (#3809)
- Use native Array.isArray() in utils.js (#3836)
- Adding error handling inside stream end callback (#3967)
Fixes and Functionality:
- Added aborted even handler (#3916)
- Header types expanded allowing boolean and number types (#4144)
- Fix cancel signature allowing cancel message to be undefined (#3153)
- Updated type checks to be formulated better (#3342)
- Avoid unnecessary buffer allocations (#3321)
- Adding a socket handler to keep TCP connection live when processing long living requests (#3422)
- Added toFormData helper function (#3757)
- Adding responseEncoding prop type in AxiosRequestConfig (#3918)
Internal and Tests:
- Adding axios-test-instance to ecosystem (#3786)
- Optimize the logic of isAxiosError (#3546)
- Add tests and documentation to display how multiple inceptors work (#3564)
- Updating follow-redirects to version 1.14.7 (#4379)
Documentation:
- Fixing changelog to show corrext pull request (#4219)
- Update upgrade guide for https proxy setting (#3604)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
0.24.0 - 2021-10-25
0.24.0 (October 25, 2021)

Breaking changes:
- Revert: change type of AxiosResponse to any, please read lengthy discussion here: (#4141) pull request: (#4186)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
0.23.0 - 2021-10-12
0.23.0 (October 12, 2021)

Breaking changes:
- Distinguish request and response data types (#4116)
- Change never type to unknown (#4142)
- Fixed TransitionalOptions typings (#4147)
Fixes and Functionality:
- Adding globalObject: 'this' to webpack config (#3176)
- Adding insecureHTTPParser type to AxiosRequestConfig (#4066)
- Fix missing semicolon in typings (#4115)
- Fix response headers types (#4136)
Internal and Tests:
- Improve timeout error when timeout is browser default (#3209)
- Fix node version on CI (#4069)
- Added testing to TypeScript portion of project (#4140)
Documentation:
- Rename Angular to AngularJS (#4114)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
0.22.0 - 2021-10-01
0.22.0 (October 01, 2021)

Fixes and Functionality:
- Caseless header comparing in HTTP adapter (#2880)
- Avoid package.json import fixing issues and warnings related to this (#4041), (#4065)
- Fixed cancelToken leakage and added AbortController support (#3305)
- Updating CI to run on release branches
- Bump follow redirects version
- Fixed default transitional config for custom Axios instance; (#4052)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
0.21.4 - 2021-09-06
0.21.4 (September 6, 2021)

Fixes and Functionality:
- Fixing JSON transform when data is stringified. Providing backward compatibility and complying to the JSON RFC standard (#4020)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
0.21.3 - 2021-09-04
0.21.3 (September 4, 2021)

Fixes and Functionality:
- Fixing response interceptor not being called when request interceptor is attached (#4013)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
- Julian Hollmann
0.21.2 - 2021-09-04
0.21.2 (September 4, 2021)

Fixes and Functionality:
- Updating axios requests to be delayed by pre-emptive promise creation (#2702)
- Adding "synchronous" and "runWhen" options to interceptors api (#2702)
- Updating of transformResponse (#3377)
- Adding ability to omit User-Agent header (#3703)
- Adding multiple JSON improvements (#3688, #3763)
- Fixing quadratic runtime and extra memory usage when setting a maxContentLength (#3738)
- Adding parseInt to config.timeout (#3781)
- Adding custom return type support to interceptor (#3783)
- Adding security fix for ReDoS vulnerability (#3980)
Internal and Tests:
- Updating build dev dependancies (#3401)
- Fixing builds running on Travis CI (#3538)
- Updating follow rediect version (#3694, #3771)
- Updating karma sauce launcher to fix failing sauce tests (#3712, #3717)
- Updating content-type header for application/json to not contain charset field, according do RFC 8259 (#2154)
- Fixing tests by bumping karma-sauce-launcher version (#3813)
- Changing testing process from Travis CI to GitHub Actions (#3938)
Documentation:
- Updating documentation around the use of AUTH_TOKEN with multiple domain endpoints (#3539)
- Remove duplication of item in changelog (#3523)
- Fixing gramatical errors (#2642)
- Fixing spelling error (#3567)
- Moving gitpod metion (#2637)
- Adding new axios documentation website link (#3681, #3707)
- Updating documentation around dispatching requests (#3772)
- Adding documentation for the type guard isAxiosError (#3767)
- Adding explanation of cancel token (#3803)
- Updating CI status badge (#3953)
- Fixing errors with JSON documentation (#3936)
- Fixing README typo under Request Config (#3825)
- Adding axios-multi-api to the ecosystem file (#3817)
- Adding SECURITY.md to properly disclose security vulnerabilities (#3981)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
0.21.1 - 2020-12-22
0.21.1 (December 21, 2020)

Fixes and Functionality:
- Hotfix: Prevent SSRF (#3410)
- Protocol not parsed when setting proxy config from env vars (#3070)
- Updating axios in types to be lower case (#2797)
- Adding a type guard for AxiosError (#2949)
Internal and Tests:
- Remove the skipping of the socket http test (#3364)
- Use different socket for Win32 test (#3375)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
- Daniel Lopretto [email protected]
- Jason Kwok [email protected]
- Jay [email protected]
- Jonathan Foster [email protected]
- Remco Haszing [email protected]
- Xianming Zhong [email protected]
0.21.0 - 2020-10-23
Read more
0.20.0 - 2020-08-21
Release of 0.20.0-pre as a full release with no other changes.
0.20.0-0 - 2020-07-15
0.19.2 - 2020-01-22

from axios GitHub release notes

Commit messages

Package name: axios

63dfce8 Releasing v0.25
dccaeb1 Updated changelog for release
51f3ccb Updating follow-redirects with security updates (#4379)
ccc9516 Fixing removing package-lock from gitignore (#4346)
ea0d9c6 Adding error handling inside stream end callback (#3967)
4fbf61d Adding responseEncoding prop type in AxiosRequestConfig (#3918)
a76571a Use native `Array.isArray()` in `utils.js` (#3836)
a8cd75a Update isAbsoluteURL.js (#3809)
9579290 Adding error handling when missing url (#3791)
9964815 toFormData helper function (#3757)
c00c4dd Fixing maxBodyLength enforcement (#3786)
962f9ab Update upgrade guide for https proxy setting (#3604)
e6aef5a (Add tests to) document how multiple inceptors work (#3564)
6fca6a7 refactor(helpers): optimize the logic of isAxiosError (#3546)
476ee88 chore: ignore yarn.lock file (#3545)
4c8b02d Adding axios-test-instance to ecosystem (#3496)
cd1b82b Removing code relying on strict mode behaviour for arguments (#3470)
55e6577 Adding a socket handler for keep TCP connection (#3422)
ebedf6b Avoid unnecessary Buffer allocations (#3321)
716d5de Update utils.js (#3342)
5431634 Fixing Cancel' signature. (#3152) (#3153)
6b4fd93 Expand Headers types (#4144)
c5fe05b Adding aborted event handler (#3916)
1885ac7 Adding dev branch to CI

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade axios from 0.19.2 to 0.25.0. See this package in npm: https://www.npmjs.com/package/axios See this project in Snyk: https://app.snyk.io/org/dfds-cloud-engineering/project/0d44f255-d32b-4f86-9a42-29c02f7b4789?utm_source=github-enterprise&utm_medium=referral&page=upgrade-pr

avnes closed this Mar 16, 2022

avnes deleted the snyk-upgrade-7c4baa542410554f3d280d0605fc1202 branch March 16, 2022 08:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade axios from 0.19.2 to 0.25.0 #8

[Snyk] Upgrade axios from 0.19.2 to 0.25.0 #8

snyk-bot commented Feb 22, 2022

0.25.0 (January 18, 2022)

0.24.0 (October 25, 2021)

0.23.0 (October 12, 2021)

0.22.0 (October 01, 2021)

0.21.4 (September 6, 2021)

0.21.3 (September 4, 2021)

0.21.2 (September 4, 2021)

0.21.1 (December 21, 2020)

[Snyk] Upgrade axios from 0.19.2 to 0.25.0 #8

[Snyk] Upgrade axios from 0.19.2 to 0.25.0 #8

Conversation

snyk-bot commented Feb 22, 2022

Snyk has created this PR to upgrade axios from 0.19.2 to 0.25.0.

0.25.0 (January 18, 2022)

0.24.0 (October 25, 2021)

0.23.0 (October 12, 2021)

0.22.0 (October 01, 2021)

0.21.4 (September 6, 2021)

0.21.3 (September 4, 2021)

0.21.2 (September 4, 2021)

0.21.1 (December 21, 2020)