fix: form-data@v4.0.0 critical vulnerability (#6894)

arndom · web-flow · commit 783a103d4212 · 2025-07-31T09:56:01.000+03:00
diff --git a/.changeset/empty-boats-exist.md b/.changeset/empty-boats-exist.md
@@ -0,0 +1,11 @@
+---
+"@refinedev/nestjsx-crud": patch
+"@refinedev/simple-rest": patch
+"@refinedev/strapi-v4": patch
+"@refinedev/medusa": patch
+"@refinedev/strapi": patch
+---
+
+- Bump `axios` dependency to `^1.11.0` to fix critical vulnerability of `form-data@v4.0.0`
+
+[Resolves #6888](https://github.com/refinedev/refine/issues/6888)
diff --git a/examples/auth-auth0/package.json b/examples/auth-auth0/package.json
@@ -30,7 +30,7 @@
     "@refinedev/simple-rest": "^5.0.10",
     "@uiw/react-md-editor": "^3.19.5",
     "antd": "^5.17.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/examples/auth-google-login/package.json b/examples/auth-google-login/package.json
@@ -29,7 +29,7 @@
     "@refinedev/simple-rest": "^5.0.10",
     "@uiw/react-md-editor": "^3.19.5",
     "antd": "^5.17.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/examples/auth-keycloak/package.json b/examples/auth-keycloak/package.json
@@ -30,7 +30,7 @@
     "@refinedev/simple-rest": "^5.0.10",
     "@uiw/react-md-editor": "^3.19.5",
     "antd": "^5.17.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "keycloak-js": "^25.0.1",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
diff --git a/examples/auth-kinde/package.json b/examples/auth-kinde/package.json
@@ -29,7 +29,7 @@
     "@refinedev/react-router": "^1.0.1",
     "@refinedev/simple-rest": "^5.0.10",
     "antd": "^5.17.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/examples/blog-ecommerce/package.json b/examples/blog-ecommerce/package.json
@@ -18,7 +18,7 @@
     "@refinedev/nextjs-router": "^6.1.0",
     "@refinedev/strapi": "^4.1.12",
     "@refinedev/strapi-v4": "^6.0.9",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "cross-env": "^7.0.3",
     "framer-motion": "^7.5.3",
     "next": "^14.2.26",
diff --git a/examples/blog-invoice-generator/package.json b/examples/blog-invoice-generator/package.json
@@ -31,7 +31,7 @@
     "@refinedev/react-router": "^0.1.0",
     "@refinedev/strapi-v4": "^6.0.9",
     "antd": "^5.17.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-pdf": "^5.7.1",
diff --git a/examples/blog-material-ui/package.json b/examples/blog-material-ui/package.json
@@ -36,7 +36,7 @@
     "@refinedev/react-hook-form": "^4.9.1",
     "@refinedev/react-router": "^0.1.0",
     "@refinedev/strapi-v4": "^6.0.9",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-hook-form": "^7.57.0",
diff --git a/examples/blog-ra-chakra-tutorial/package.json b/examples/blog-ra-chakra-tutorial/package.json
@@ -20,7 +20,7 @@
     "@refinedev/react-table": "^5.6.13",
     "@refinedev/strapi-v4": "^6.0.9",
     "@tabler/icons-react": "^3.1.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-hook-form": "^7.57.0",
diff --git a/examples/blog-refine-mantine-strapi/package.json b/examples/blog-refine-mantine-strapi/package.json
@@ -36,7 +36,7 @@
     "@refinedev/react-table": "^5.6.13",
     "@refinedev/strapi-v4": "^6.0.9",
     "@tabler/icons-react": "^3.1.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/examples/data-provider-strapi-v4/package.json b/examples/data-provider-strapi-v4/package.json
@@ -29,7 +29,7 @@
     "@refinedev/strapi-v4": "^6.0.11",
     "@uiw/react-md-editor": "^3.19.5",
     "antd": "^5.17.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/examples/data-provider-strapi/package.json b/examples/data-provider-strapi/package.json
@@ -29,7 +29,7 @@
     "@refinedev/strapi": "^4.1.14",
     "@uiw/react-md-editor": "^3.19.5",
     "antd": "^5.17.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/examples/finefoods-material-ui/package.json b/examples/finefoods-material-ui/package.json
@@ -39,7 +39,7 @@
     "@refinedev/simple-rest": "^5.0.10",
     "@tanstack/react-table": "^8.2.6",
     "@uiw/react-md-editor": "^3.19.5",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "dayjs": "^1.10.7",
     "google-map-react": "^2.1.10",
     "i18next": "^20.1.0",
diff --git a/examples/form-react-hook-form-use-form/package.json b/examples/form-react-hook-form-use-form/package.json
@@ -27,7 +27,7 @@
     "@refinedev/react-hook-form": "^4.10.2",
     "@refinedev/react-router": "^1.0.1",
     "@refinedev/simple-rest": "^5.0.10",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/examples/form-react-hook-form-use-modal-form/package.json b/examples/form-react-hook-form-use-modal-form/package.json
@@ -27,7 +27,7 @@
     "@refinedev/react-hook-form": "^4.10.2",
     "@refinedev/react-router": "^1.0.1",
     "@refinedev/simple-rest": "^5.0.10",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/examples/form-react-hook-form-use-steps-form/package.json b/examples/form-react-hook-form-use-steps-form/package.json
@@ -27,7 +27,7 @@
     "@refinedev/react-hook-form": "^4.10.2",
     "@refinedev/react-router": "^1.0.1",
     "@refinedev/simple-rest": "^5.0.10",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-hook-form": "^7.57.0",
diff --git a/examples/form-save-and-continue/package.json b/examples/form-save-and-continue/package.json
@@ -26,7 +26,7 @@
     "@refinedev/core": "^4.57.10",
     "@refinedev/react-router": "^1.0.1",
     "@refinedev/simple-rest": "^5.0.10",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2",
diff --git a/examples/invoicer/package.json b/examples/invoicer/package.json
@@ -30,7 +30,7 @@
     "@refinedev/strapi-v4": "^6.0.11",
     "antd": "^5.17.0",
     "antd-style": "^3.6.1",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-input-mask": "^2.0.4",
diff --git a/examples/mern-dashboard-client/package.json b/examples/mern-dashboard-client/package.json
@@ -37,7 +37,7 @@
     "@refinedev/react-router-v6": "^4.6.0",
     "@refinedev/simple-rest": "^5.0.8",
     "apexcharts": "^3.36.3",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "cross-env": "^7.0.3",
     "react": "^18.0.0",
     "react-apexcharts": "^1.4.0",
diff --git a/examples/refine-week-invoice-generator/package.json b/examples/refine-week-invoice-generator/package.json
@@ -32,7 +32,7 @@
     "@refinedev/react-router": "^1.0.1",
     "@refinedev/strapi-v4": "^6.0.11",
     "antd": "^5.17.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/examples/table-material-ui-cursor-pagination/package.json b/examples/table-material-ui-cursor-pagination/package.json
@@ -31,7 +31,7 @@
     "@refinedev/core": "^4.57.10",
     "@refinedev/mui": "^6.2.2",
     "@refinedev/react-router": "^1.0.1",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
     "react-router": "^7.0.2"
diff --git a/packages/live-previews/package.json b/packages/live-previews/package.json
@@ -50,7 +50,7 @@
     "@tanstack/react-table": "^8.2.6",
     "@uiw/react-md-editor": "^3.19.5",
     "antd": "^5.17.0",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "base64url": "^3.0.1",
     "casbin": "^5.15.2",
     "graphql-tag": "^2.12.6",
diff --git a/packages/medusa/package.json b/packages/medusa/package.json
@@ -40,7 +40,7 @@
     "types": "node ../shared/generate-declarations.js"
   },
   "dependencies": {
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "query-string": "^7.1.1"
   },
   "devDependencies": {
diff --git a/packages/nestjsx-crud/package.json b/packages/nestjsx-crud/package.json
@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "@nestjsx/crud-request": "^5.0.0-alpha.3",
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "query-string": "^7.1.1"
   },
   "devDependencies": {
diff --git a/packages/simple-rest/package.json b/packages/simple-rest/package.json
@@ -40,7 +40,7 @@
     "types": "node ../shared/generate-declarations.js"
   },
   "dependencies": {
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "query-string": "^7.1.1"
   },
   "devDependencies": {
diff --git a/packages/strapi-v4/package.json b/packages/strapi-v4/package.json
@@ -40,7 +40,7 @@
     "types": "node ../shared/generate-declarations.js"
   },
   "dependencies": {
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "qs": "^6.10.1"
   },
   "devDependencies": {
diff --git a/packages/strapi/package.json b/packages/strapi/package.json
@@ -39,7 +39,7 @@
     "types": "node ../shared/generate-declarations.js"
   },
   "dependencies": {
-    "axios": "^1.6.2",
+    "axios": "^1.11.0",
     "query-string": "^7.1.1"
   },
   "devDependencies": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
