Skip to content

Bump axios to 1.15.0 (security)#358

Open
assitantforjess wants to merge 1 commit into
gucong3000:masterfrom
assitantforjess:fix/security/bump-axios-1.15.0
Open

Bump axios to 1.15.0 (security)#358
assitantforjess wants to merge 1 commit into
gucong3000:masterfrom
assitantforjess:fix/security/bump-axios-1.15.0

Conversation

@assitantforjess

Copy link
Copy Markdown

Title: Bump axios dependency to 1.15.0 to address critical SSRF / memory-exfiltration advisories

Summary:
This PR updates gulp-reporter's dependency on axios from ^0.18.0 to ^1.15.0 to resolve several critical and high security advisories that currently affect projects depending on gulp-reporter.

Suggested change (package.json):

-  "dependencies": {
-    "axios": "^0.18.0",
+  "dependencies": {
+    "axios": "^1.15.0",
     ...
  }

Notes & testing:

  • axios 1.x includes API changes in some areas; run the gulp-reporter test suite and smoke tests for the gulp tasks that use HTTP calls.
  • If any internal use of axios requires code changes, update the callsites accordingly.

Rationale:

  • Multiple critical advisories are linked to old axios versions; bumping to a patched axios removes the vulnerability in downstream projects.

Suggested reviewer checklist:

  • Run npm install and npm test in gulp-reporter.
  • Verify that reporters still function with typical gulp pipelines.
  • Merge and publish patch version.

If upstream maintainers prefer, I can open this PR and include a small compatibility patch if tests indicate breaking changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant