Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade axios from 0.25.0 to 1.7.9 #630

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade axios from 0.25.0 to 1.7.9 #630

wants to merge 1 commit into from
+59 −16

Conversation

aravindvnair99
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade axios from 0.25.0 to 1.7.9.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 54 versions ahead of your current version.

  • The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Improper Handling of Extra Parameters
SNYK-JS-FOLLOWREDIRECTS-6141137		 686 Proof of Concept
high severity Cross-site Request Forgery (CSRF)
SNYK-JS-AXIOS-6032459		 686 Proof of Concept
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-6444610		 686 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-6124857		 686 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-AXIOS-6671926		 686 No Known Exploit
Release notes
Package name: axios from axios GitHub release notes

Important

  • Warning: This PR contains a major version upgrade, and may be a breaking change.
  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@guardrails GuardRails
Copy link

guardrails bot commented Jan 6, 2025

⚠️ We detected 9 security issues in this pull request:

Insecure File Management (1)
Severity Details Docs
High Title: Path Traversal from user input

Spot-the-Hole/functions/index.js

Line 562 in ceb3449

path.join(os.tmpdir(), path.basename(req.files.file[0].fieldname)),
📚

More info on how to fix Insecure File Management in JavaScript.

Insecure Use of Crypto (1)
Severity Details Docs
Medium Title: Insecure use of random generator

Spot-the-Hole/functions/index.js

Line 204 in ceb3449

result += characters.charAt(Math.floor(Math.random() * charactersLength));
📚

More info on how to fix Insecure Use of Crypto in JavaScript.

Vulnerable Libraries (7)
Severity Details
N/A pkg:npm/[email protected] upgrade to: 3.1.10
High pkg:npm/[email protected] upgrade to: > 0.3.1
High pkg:npm/[email protected] upgrade to: > 8.54.0
High pkg:npm/[email protected] upgrade to: > 4.2.1
Critical pkg:npm/[email protected] upgrade to: > 11.3.0
Informational pkg:npm/[email protected] upgrade to: > 1.4.6
Critical pkg:npm/@tensorflow/[email protected] upgrade to: > 3.14.0

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Jan 6, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
size/XS
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@aravindvnair99 @snyk-bot