chore(deps): update peerdependency axios to ^0.28.0 [security] #45
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
WalkthroughThis update primarily involves an enhancement to the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (1)
- package.json (1 hunks)
Additional comments not posted (1)
package.json (1)
54-55: LGTM! But verify for breaking changes.The update to
axiosversion^0.28.0addresses a security vulnerability and includes several improvements.However, ensure that this update does not introduce breaking changes in the codebase.
Verification successful
Verification Successful: No Breaking Changes Found
The update to
axiosversion^0.28.0does not introduce breaking changes in the codebase. Thepostmethod used in the code remains compatible with the new version.
test/index.test.js: Mockingaxios.postsrc/index.js: Usingaxios.postto make a POST requestScripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that the update to axios version ^0.28.0 does not introduce breaking changes. # Test: Search for axios usage in the codebase. Expect: No breaking changes. rg --type js --type ts --type vue 'axios'Length of output: 69
Script:
#!/bin/bash # Description: Verify that the update to axios version ^0.28.0 does not introduce breaking changes. # Test: Search for axios usage in the codebase. Expect: No breaking changes. rg --type js --type ts --type jsx --type tsx 'axios'Length of output: 80
Script:
#!/bin/bash # Description: Verify that the update to axios version ^0.28.0 does not introduce breaking changes. # Test: Search for axios usage in the codebase. Expect: No breaking changes. rg --type js --type ts 'axios'Length of output: 174
Script:
#!/bin/bash # Extract relevant code segments where axios is used for inspection. # Extract from test/index.test.js echo "test/index.test.js:" rg 'axios' test/index.test.js -A 5 # Extract from src/index.js echo "src/index.js:" rg 'axios' src/index.js -A 5Length of output: 656
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-axios-vulnerability
branch
from
c2f985c
to
af47417
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-axios-vulnerability
branch
from
af47417
to
2faac7b
Compare
This PR contains the following updates:
^0.27.2->^0.28.0GitHub Vulnerability Alerts
CVE-2023-45857
An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
Release Notes
axios/axios (axios)
v0.28.0Compare Source
Release notes:
Bug Fixes
withXSRFTokenoption to v0.x (#6091)Backports from v1.x:
axios.formToJSONmethod (#4735)url-encoded-formserializer to respect theformSerializerconfig (#4721)string[]toAxiosRequestHeaderstype (#4322)AxiosErrorstack capturing; (#4718)AxiosErrorstatus code type; (#4717)blobto the list of protocols supported by the browser (#4678)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.