fix(deps): remediate axios advisories via override to ^1.18.1 - #1142
Open
Isaac-kps wants to merge 1 commit into
Open
fix(deps): remediate axios advisories via override to ^1.18.1#1142Isaac-kps wants to merge 1 commit into
Isaac-kps wants to merge 1 commit into
Conversation
axios was pulled in transitively at vulnerable versions (notably the hoisted axios@0.27.2, plus several 1.x copies < 1.16.0), triggering a large set of high-severity GHSA advisories (SSRF, prototype-pollution gadgets, proxy-auth leakage, ReDoS, DoS). npm audit reported fixAvailable:false because every copy is transitive, so the remediation is a package.json override. - Override axios to ^1.18.1 (clears all axios advisories; safe floor is >=1.16.0 per the advisory ranges). - Override axios-extensions to ^4.0.0: v3.1.6 deep-imports axios/lib/helpers/buildURL, which axios 1.x blocks via its exports field, breaking the webpack build. v4 drops the deep import, peers axios>=1.0.0, and exposes the identical API surface. Verified: check-types, lint, production webpack build, and the full jest suite (488/488) all pass; npm audit no longer flags axios. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for reference-implementation ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughTwo entries are added to the ChangesDependency Version Overrides
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Deploy Preview for tradetrust-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
axios was present only transitively at vulnerable versions — the hoisted
axios@0.27.2(via@govtechsg/address-identity-resolver/axios-extensions), plus several 1.x copies< 1.16.0(via@tradetrust-tt/*,dnsprove,tt-verify,synpress). These trigger a large set of high-severity GHSA advisories: SSRF, prototype-pollution gadgets, proxy-auth credential leakage, ReDoS, and DoS.Because every axios copy is transitive,
npm auditreportsfixAvailable: false— the only remediation is apackage.jsonoverridesentry.Changes
axios→^1.18.1(override). Clears every axios advisory; the safe floor per the advisory ranges is>= 1.16.0.axios-extensions→^4.0.0(override).v3.1.6deep-importsaxios/lib/helpers/buildURL, which axios 1.x blocks via itsexportsfield — this breaks the webpack build.v4drops the deep import, declarespeerDependencies: { axios: '>=1.0.0' }, and exposes the identical API (Cache,cacheAdapterEnhancer,retryAdapterEnhancer,throttleAdapterEnhancer).After the fix, every nested axios collapses to a single
axios@1.18.1andnpm auditno longer flags axios.Verification
npm run check-types(tsc) — ✅ passnpm run lint— ✅ passnpm run build(production webpack) — ✅ passnpm test(jest) — ✅ 488/488 tests passnpm audit— axios no longer listed🤖 Generated with Claude Code
Summary by CodeRabbit
axiosandaxios-extensionsto ensure more consistent builds and installs.