fix(deps): bump axios to >=1.16.0 (CVE-2026-44488/44492/44494/44496) - #160
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the repo’s JavaScript dependency graph to remediate axios CVEs by enforcing an axios resolution floor and refreshing the pnpm lockfile accordingly.
Changes:
- Bumps direct dependency
axiosto^1.16.0and enforcesaxios >=1.16.0via pnpm overrides. - Removes the stale
axios@1.14.1 → 1.14.0redirect by retargeting it to>=1.16.0. - Regenerates
pnpm-lock.yaml, resulting in a unifiedaxios@1.18.0resolution and related transitive updates (e.g.,follow-redirects).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Raises the direct axios version and updates pnpm overrides; pins packageManager to pnpm 10.13.1. |
| pnpm-lock.yaml | Lockfile refresh reflecting axios resolution to 1.18.0 (and associated transitive dependency updates). |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…4494/44496 Tree resolved axios@1.14.0 (< 1.16.0), inside the affected range of all four advisories. The blanket override resolved to 1.14.1, then a stale 'axios@1.14.1: 1.14.0' redirect (a prior supply-chain pin) pulled it back to the now-vulnerable 1.14.0. - Direct dep: ^1.12.0 -> ^1.16.0 - Override: axios >=1.13.5 -> >=1.16.0 - Stale redirect: axios@1.14.1 1.14.0 -> >=1.16.0 Lockfile now resolves axios@1.18.0 everywhere; no resolution < 1.16.0 remains. axios@0.30.4 pin left untouched (0.x, below the >=1.0.0 CVE floor).
30fe693 to
648f47c
Compare
Feedback-loop summary (1 iteration, stopped early)Addressed:
Code review (high effort): no correctness/security/test issues. One Low note — the No code commits this run — the only actionable item was a documentation fix. The remediation itself is unchanged and verified: tree resolves Open items: none. |
What
Bump
axiosto>=1.16.0to remediate four advisories (CVE-2026-44488, -44492, -44494, -44496).Why
The dependency tree resolved
axios@1.14.0, which is inside the affected range of all four CVEs (< 1.16.0). The vulnerable resolution was caused by a stale fail-closed override: the blanketaxios: ">=1.13.5"resolved up to1.14.1, then a prior supply-chain pinaxios@1.14.1: 1.14.0redirected it back down to the now-vulnerable1.14.0. axios is pulled in both directly and transitively via@aptos-labs/ts-sdk→@aptos-labs/aptos-client.Changes
^1.12.0→^1.16.0axios >=1.13.5→>=1.16.0(fail-closed floor)axios@1.14.1: 1.14.0→>=1.16.0(target was the source of the vulnerable resolution)axios@0.30.4: 0.30.3left untouched —0.xis below the>= 1.0.0CVE floor, not affectedTest plan
pnpm install --lockfile-onlyregenerated the lockfile successfullyaxios@1.18.0everywhere;grepconfirms no resolution< 1.16.0remains (the onlyaxios@1.14.1reference left is the override key, a redirect rule →>=1.16.0)package.jsontest script is a placeholder); change is dependency-onlySecurity & data impact
Security impact: Remediates 4 axios CVEs (
< 1.16.0); enforces a fail-closed>=1.16.0override floor against regression. No production code paths changed.Data classification affected: None
Audit log updated: n/a
Major/breaking risk
Low.
1.14.0 → 1.18.0stays within major 1.@aptos-labs/aptos-client@1.2.0declares an exact peeraxios: 1.14.0; the override forces1.18.0and pnpm raised no axios peer warning. axios1.xis backward-compatible. Verify by running an Aptos-backed integration underintegrations/.Rollback
No state migration —
git revertof this commit is sufficient.