chore(deps): bump axios from 0.21.0 to 0.30.3 in /docs/multiple-tests/pattern-vulnerability-critical/src/javascript#241
Conversation
Bumps [axios](https://github.com/axios/axios) from 0.21.0 to 0.30.3. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.21.0...v0.30.3) --- updated-dependencies: - dependency-name: axios dependency-version: 0.30.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
Codacy's Analysis Summary0 new issue (≤ 1 medium issue) Review Pull Request in Codacy →
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR is up to standards according to the static analysis. It addresses a critical security vulnerability (Prototype Pollution) by bumping axios from 0.21.0 to 0.30.3. Note that this version introduces a breaking change in how configuration objects are merged.
🗒️ Improve review quality by adding custom instructions.
💡 Codacy uses AI. Check for mistakes.
| "main": "index.js", | ||
| "dependencies": { | ||
| "axios": "0.21.0" | ||
| "axios": "0.30.3" |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: Axios 0.30.3 blocks the __proto__ key during configuration merging to prevent prototype pollution. If the application logic involves dynamic construction or deep-merging of Axios configurations using user-supplied data, these operations might now be ignored or fail.
Recommendation: Verify that any dynamic Axios configuration generation logic does not rely on prototype manipulation.
|
This is a test dependency, it should not be updated. We are using a vulnerable version on purpose, to trigger our tests. |
Pull request was closed
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
afsmeira
deleted the
dependabot/npm_and_yarn/docs/multiple-tests/pattern-vulnerability-critical/src/javascript/axios-0.30.3
branch
2 participants
Bumps axios from 0.21.0 to 0.30.3.
Release notes
Sourced from axios's releases.
... (truncated)
Commits
f53bcf6chore: release 0.30.23ddccd3chore: remove publish as this wont work9ef39d0chore: try with npm token4775de6chore: fix version schemef96f26bchore: fix issues with using replaceead45c2chore: update the publish workflow to run on tag8119265chore: tag version as legacy on v0.x9954985chore: dispatch for first time3f8b70fchore: final renamec665584chore: revert namingMaintainer changes
This version was pushed to npm by jasonsaayman, a new releaser for axios since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.