Repository navigation
Bump axios from 1.2.3 to 1.20.0 in /server - #114
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [axios](https://github.com/axios/axios) from 1.2.3 to 1.20.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.2.3...v1.20.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![xhawk-ai[bot]](https://avatars.githubusercontent.com/in/2457056?s=60&v=4){kind=small}
There was a problem hiding this comment.
📋 Review Summary — Ready to merge
Summary
The change upgrades the server’s direct Axios dependency to 1.20.0 and deduplicates the compatible pi-backend Axios range onto the same lockfile resolution. Static review found no demonstrable correctness, security, performance, or maintainability defects introduced by the update.
Tests were not run.
Findings
- js-yaml 4.1.0 has 5 known advisories ↗
- minimatch 3.1.2 has 3 known advisories ↗
- @faker-js/faker 7.6.0 has 1 known advisory ↗
- @tootallnate/once 1.1.2 has 1 known advisory ↗
- serve-static 1.15.0 has 1 known advisory ↗
- ajv 6.12.6 has 1 known advisory ↗
- axios 0.25.0 has 23 known advisories ↗
- body-parser 1.20.1 has 2 known advisories ↗
- qs 6.11.0 has 3 known advisories ↗
- brace-expansion 1.1.11 has 8 known advisories ↗
- braces 3.0.2 has 2 known advisories ↗
- cloudinary 1.33.0 has 1 known advisory ↗
- lodash 4.17.21 has 2 known advisories ↗
- cookie 0.5.0 has 1 known advisory ↗
- diff 4.0.2 has 1 known advisory ↗
- express 4.18.2 has 2 known advisories ↗
- path-to-regexp 0.1.7 has 2 known advisories ↗
- proxy-addr 2.0.7 has 1 known advisory ↗
- send 0.18.0 has 1 known advisory ↗
- flatted 3.2.7 has 2 known advisories ↗
- ip 1.1.8 has 2 known advisories ↗
- jws 3.2.2 has 1 known advisory ↗
- micromatch 4.0.5 has 1 known advisory ↗
- picomatch 2.3.1 has 2 known advisories ↗
- morgan 1.10.0 has 3 known advisories ↗
- on-headers 1.0.2 has 1 known advisory ↗
- multer 1.4.5-lts.1 has 11 known advisories ↗
- semver 5.7.1 has 1 known advisory ↗
- word-wrap 1.2.3 has 1 known advisory ↗
- sha.js 2.4.11 has 1 known advisory ↗
- shell-quote 1.7.4 has 2 known advisories ↗
- toml 2.3.6 has 2 known advisories ↗
- typeorm 0.3.11 has 3 known advisories ↗
- uuid 8.3.2 has 1 known advisory ↗
- xml2js 0.4.23 has 1 known advisory ↗
- vm2 3.9.13 has 59 known advisories ↗
Commands
Re-review the latest changes:
@xhawk-ai review again
Resolve all review threads and post a summary:
@xhawk-ai resolve all
Fix with agent prompt
These are the findings from a code review of this pull request.
## 1. @faker-js/faker 7.6.0 has 1 known advisory
Path: server/yarn.lock
Line: 27
This file is not part of the pull request's diff.
Bug: [CVE-2026-73231](https://osv.dev/vulnerability/CVE-2026-73231). Faker: helpers.fake exploitable into arbritary code execution
Cause: `server/yarn.lock` resolves `@faker-js/faker` to 7.6.0, which OSV lists as affected by 1 advisory. Highest CVSS 7.8. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `@faker-js/faker` to 10.5.0 or later in `server/yarn.lock`.
## 2. @tootallnate/once 1.1.2 has 1 known advisory
Path: server/yarn.lock
Line: 97
This file is not part of the pull request's diff.
Bug: [CVE-2026-3449](https://osv.dev/vulnerability/CVE-2026-3449). @tootallnate/once vulnerable to Incorrect Control Flow Scoping
Cause: `server/yarn.lock` resolves `@tootallnate/once` to 1.1.2, which OSV lists as affected by 1 advisory. Highest CVSS 3.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `@tootallnate/once` to 3.0.1 or later in `server/yarn.lock`.
## 3. ajv 6.12.6 has 1 known advisory
Path: server/yarn.lock
Line: 357
This file is not part of the pull request's diff.
Bug: [CVE-2025-69873](https://osv.dev/vulnerability/CVE-2025-69873). ajv has ReDoS when using `$data` option
Cause: `server/yarn.lock` resolves `ajv` to 6.12.6, which OSV lists as affected by 1 advisory. Highest CVSS 5.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `ajv` to 8.18.0 or later in `server/yarn.lock`.
## 4. axios 0.25.0 has 23 known advisories
Path: server/yarn.lock
Line: 432
This file is not part of the pull request's diff.
Bug: [CVE-2023-45857](https://osv.dev/vulnerability/CVE-2023-45857), [CVE-2025-27152](https://osv.dev/vulnerability/CVE-2025-27152), [CVE-2025-62718](https://osv.dev/vulnerability/CVE-2025-62718), [CVE-2026-25639](https://osv.dev/vulnerability/CVE-2026-25639), and 19 more. axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Cause: `server/yarn.lock` resolves `axios` to 0.25.0, which OSV lists as affected by 23 advisories. Highest CVSS 8.6. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `axios` to 1.18.0 or later in `server/yarn.lock`.
## 5. body-parser 1.20.1 has 2 known advisories
Path: server/yarn.lock
Line: 481
This file is not part of the pull request's diff.
Bug: [CVE-2024-45590](https://osv.dev/vulnerability/CVE-2024-45590), [CVE-2026-12590](https://osv.dev/vulnerability/CVE-2026-12590). body-parser vulnerable to denial of service when url encoding is enabled
Cause: `server/yarn.lock` resolves `body-parser` to 1.20.1, which OSV lists as affected by 2 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `body-parser` to 1.20.6 or later in `server/yarn.lock`.
## 6. brace-expansion 1.1.11 has 8 known advisories
Path: server/yarn.lock
Line: 501
This file is not part of the pull request's diff.
Bug: [CVE-2025-5889](https://osv.dev/vulnerability/CVE-2025-5889), [CVE-2026-102276](https://osv.dev/vulnerability/CVE-2026-102276), [CVE-2026-102277](https://osv.dev/vulnerability/CVE-2026-102277), [CVE-2026-102278](https://osv.dev/vulnerability/CVE-2026-102278), and 4 more. brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
Cause: `server/yarn.lock` resolves `brace-expansion` to 1.1.11, which OSV lists as affected by 8 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `brace-expansion` to 5.0.12 or later in `server/yarn.lock`.
## 7. braces 3.0.2 has 2 known advisories
Path: server/yarn.lock
Line: 514
This file is not part of the pull request's diff.
Bug: [CVE-2024-4068](https://osv.dev/vulnerability/CVE-2024-4068), [CVE-2026-93687](https://osv.dev/vulnerability/CVE-2026-93687). Uncontrolled resource consumption in braces
Cause: `server/yarn.lock` resolves `braces` to 3.0.2, which OSV lists as affected by 2 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `braces` to 3.0.3 or later in `server/yarn.lock`.
## 8. cloudinary 1.33.0 has 1 known advisory
Path: server/yarn.lock
Line: 643
This file is not part of the pull request's diff.
Bug: [CVE-2025-12613](https://osv.dev/vulnerability/CVE-2025-12613). Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand
Cause: `server/yarn.lock` resolves `cloudinary` to 1.33.0, which OSV lists as affected by 1 advisory. Highest CVSS 8.8. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `cloudinary` to 2.7.0 or later in `server/yarn.lock`.
## 9. cookie 0.5.0 has 1 known advisory
Path: server/yarn.lock
Line: 721
This file is not part of the pull request's diff.
Bug: [CVE-2024-47764](https://osv.dev/vulnerability/CVE-2024-47764). cookie accepts cookie name, path, and domain with out of bounds characters
Cause: `server/yarn.lock` resolves `cookie` to 0.5.0, which OSV lists as affected by 1 advisory. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `cookie` to 0.7.0 or later in `server/yarn.lock`.
## 10. diff 4.0.2 has 1 known advisory
Path: server/yarn.lock
Line: 840
This file is not part of the pull request's diff.
Bug: [CVE-2026-24001](https://osv.dev/vulnerability/CVE-2026-24001). jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
Cause: `server/yarn.lock` resolves `diff` to 4.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 2.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `diff` to 8.0.3 or later in `server/yarn.lock`.
## 11. express 4.18.2 has 2 known advisories
Path: server/yarn.lock
Line: 1102
This file is not part of the pull request's diff.
Bug: [CVE-2024-29041](https://osv.dev/vulnerability/CVE-2024-29041), [CVE-2024-43796](https://osv.dev/vulnerability/CVE-2024-43796). express vulnerable to XSS via response.redirect()
Cause: `server/yarn.lock` resolves `express` to 4.18.2, which OSV lists as affected by 2 advisories. Highest CVSS 6.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `express` to 4.20.0 or later in `server/yarn.lock`.
## 12. flatted 3.2.7 has 2 known advisories
Path: server/yarn.lock
Line: 1227
This file is not part of the pull request's diff.
Bug: [CVE-2026-32141](https://osv.dev/vulnerability/CVE-2026-32141), [CVE-2026-33228](https://osv.dev/vulnerability/CVE-2026-33228). flatted vulnerable to unbounded recursion DoS in parse() revive phase
Cause: `server/yarn.lock` resolves `flatted` to 3.2.7, which OSV lists as affected by 2 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `flatted` to 3.4.2 or later in `server/yarn.lock`.
## 13. ip 1.1.8 has 2 known advisories
Path: server/yarn.lock
Line: 1538
This file is not part of the pull request's diff.
Bug: [CVE-2023-42282](https://osv.dev/vulnerability/CVE-2023-42282), [CVE-2024-29415](https://osv.dev/vulnerability/CVE-2024-29415). ip SSRF improper categorization in isPublic
Cause: `server/yarn.lock` resolves `ip` to 1.1.8, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `ip` to 2.0.1 or later in `server/yarn.lock`.
## 14. js-yaml 4.1.0 has 5 known advisories
Path: server/yarn.lock
Line: 23
This file is not part of the pull request's diff.
Bug: [CVE-2025-64718](https://osv.dev/vulnerability/CVE-2025-64718), [CVE-2026-53550](https://osv.dev/vulnerability/CVE-2026-53550), [CVE-2026-59869](https://osv.dev/vulnerability/CVE-2026-59869), [CVE-2026-84375](https://osv.dev/vulnerability/CVE-2026-84375), and 1 more. js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Cause: `server/yarn.lock` resolves `js-yaml` to 4.1.0, which OSV lists as affected by 5 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `js-yaml` to 4.3.2 or later in `server/yarn.lock`.
## 15. jws 3.2.2 has 1 known advisory
Path: server/yarn.lock
Line: 1642
This file is not part of the pull request's diff.
Bug: [CVE-2025-65945](https://osv.dev/vulnerability/CVE-2025-65945). auth0/node-jws Improperly Verifies HMAC Signature
Cause: `server/yarn.lock` resolves `jws` to 3.2.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `jws` to 3.2.3 or later in `server/yarn.lock`.
## 16. lodash 4.17.21 has 2 known advisories
Path: server/yarn.lock
Line: 650
This file is not part of the pull request's diff.
Bug: [CVE-2021-23337](https://osv.dev/vulnerability/CVE-2021-23337), [CVE-2025-13465](https://osv.dev/vulnerability/CVE-2025-13465). lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Cause: `server/yarn.lock` resolves `lodash` to 4.17.21, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `lodash` to 4.18.0 or later in `server/yarn.lock`.
## 17. micromatch 4.0.5 has 1 known advisory
Path: server/yarn.lock
Line: 1756
This file is not part of the pull request's diff.
Bug: [CVE-2024-4067](https://osv.dev/vulnerability/CVE-2024-4067). Regular Expression Denial of Service (ReDoS) in micromatch
Cause: `server/yarn.lock` resolves `micromatch` to 4.0.5, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `micromatch` to 4.0.8 or later in `server/yarn.lock`.
## 18. minimatch 3.1.2 has 3 known advisories
Path: server/yarn.lock
Line: 24
This file is not part of the pull request's diff.
Bug: [CVE-2026-26996](https://osv.dev/vulnerability/CVE-2026-26996), [CVE-2026-27903](https://osv.dev/vulnerability/CVE-2026-27903), [CVE-2026-27904](https://osv.dev/vulnerability/CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Cause: `server/yarn.lock` resolves `minimatch` to 3.1.2, which OSV lists as affected by 3 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `minimatch` to 10.2.3 or later in `server/yarn.lock`.
## 19. morgan 1.10.0 has 3 known advisories
Path: server/yarn.lock
Line: 1810
This file is not part of the pull request's diff.
Bug: [CVE-2026-15603](https://osv.dev/vulnerability/CVE-2026-15603), [CVE-2026-5078](https://osv.dev/vulnerability/CVE-2026-5078), [CVE-2026-87859](https://osv.dev/vulnerability/CVE-2026-87859). morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Cause: `server/yarn.lock` resolves `morgan` to 1.10.0, which OSV lists as affected by 3 advisories. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `morgan` to 1.12.1 or later in `server/yarn.lock`.
## 20. multer 1.4.5-lts.1 has 11 known advisories
Path: server/yarn.lock
Line: 1836
This file is not part of the pull request's diff.
Bug: [CVE-2025-47935](https://osv.dev/vulnerability/CVE-2025-47935), [CVE-2025-47944](https://osv.dev/vulnerability/CVE-2025-47944), [CVE-2025-48997](https://osv.dev/vulnerability/CVE-2025-48997), [CVE-2025-7338](https://osv.dev/vulnerability/CVE-2025-7338), and 7 more. Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Cause: `server/yarn.lock` resolves `multer` to 1.4.5-lts.1, which OSV lists as affected by 11 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `multer` to 2.3.0 or later in `server/yarn.lock`.
## 21. on-headers 1.0.2 has 1 known advisory
Path: server/yarn.lock
Line: 1819
This file is not part of the pull request's diff.
Bug: [CVE-2025-7339](https://osv.dev/vulnerability/CVE-2025-7339). on-headers is vulnerable to http response header manipulation
Cause: `server/yarn.lock` resolves `on-headers` to 1.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 3.4. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `on-headers` to 1.1.0 or later in `server/yarn.lock`.
## 22. path-to-regexp 0.1.7 has 2 known advisories
Path: server/yarn.lock
Line: 1126
This file is not part of the pull request's diff.
Bug: [CVE-2024-45296](https://osv.dev/vulnerability/CVE-2024-45296), [CVE-2024-52798](https://osv.dev/vulnerability/CVE-2024-52798). path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
Cause: `server/yarn.lock` resolves `path-to-regexp` to 0.1.7, which OSV lists as affected by 2 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `path-to-regexp` to 0.1.13 or later in `server/yarn.lock`.
## 23. picomatch 2.3.1 has 2 known advisories
Path: server/yarn.lock
Line: 1760
This file is not part of the pull request's diff.
Bug: [CVE-2026-33671](https://osv.dev/vulnerability/CVE-2026-33671), [CVE-2026-33672](https://osv.dev/vulnerability/CVE-2026-33672). Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
Cause: `server/yarn.lock` resolves `picomatch` to 2.3.1, which OSV lists as affected by 2 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `picomatch` to 4.0.4 or later in `server/yarn.lock`.
## 24. proxy-addr 2.0.7 has 1 known advisory
Path: server/yarn.lock
Line: 1127
This file is not part of the pull request's diff.
Bug: [CVE-2026-90711](https://osv.dev/vulnerability/CVE-2026-90711). proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Cause: `server/yarn.lock` resolves `proxy-addr` to 2.0.7, which OSV lists as affected by 1 advisory. Highest CVSS 9.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `proxy-addr` to 2.0.8 or later in `server/yarn.lock`.
## 25. qs 6.11.0 has 3 known advisories
Path: server/yarn.lock
Line: 494
This file is not part of the pull request's diff.
Bug: [CVE-2025-15284](https://osv.dev/vulnerability/CVE-2025-15284), [CVE-2026-2391](https://osv.dev/vulnerability/CVE-2026-2391), [CVE-2026-82417](https://osv.dev/vulnerability/CVE-2026-82417). qs: Denial of Service via Attacker Controlled isBuffer
Cause: `server/yarn.lock` resolves `qs` to 6.11.0, which OSV lists as affected by 3 advisories. Highest CVSS 6.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `qs` to 6.16.0 or later in `server/yarn.lock`.
## 26. semver 5.7.1 has 1 known advisory
Path: server/yarn.lock
Line: 1893
This file is not part of the pull request's diff.
Bug: [CVE-2022-25883](https://osv.dev/vulnerability/CVE-2022-25883). semver vulnerable to Regular Expression Denial of Service
Cause: `server/yarn.lock` resolves `semver` to 5.7.1, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `semver` to 7.5.2 or later in `server/yarn.lock`.
## 27. send 0.18.0 has 1 known advisory
Path: server/yarn.lock
Line: 1131
This file is not part of the pull request's diff.
Bug: [CVE-2024-43799](https://osv.dev/vulnerability/CVE-2024-43799). send vulnerable to template injection that can lead to XSS
Cause: `server/yarn.lock` resolves `send` to 0.18.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `send` to 0.19.0 or later in `server/yarn.lock`.
## 28. serve-static 1.15.0 has 1 known advisory
Path: server/yarn.lock
Line: 226
This file is not part of the pull request's diff.
Bug: [CVE-2024-43800](https://osv.dev/vulnerability/CVE-2024-43800). serve-static vulnerable to template injection that can lead to XSS
Cause: `server/yarn.lock` resolves `serve-static` to 1.15.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `serve-static` to 1.16.0 or later in `server/yarn.lock`.
## 29. sha.js 2.4.11 has 1 known advisory
Path: server/yarn.lock
Line: 2421
This file is not part of the pull request's diff.
Bug: [CVE-2025-9288](https://osv.dev/vulnerability/CVE-2025-9288). sha.js is missing type checks leading to hash rewind and passing on crafted data
Cause: `server/yarn.lock` resolves `sha.js` to 2.4.11, which OSV lists as affected by 1 advisory. Highest CVSS 9.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `sha.js` to 2.4.12 or later in `server/yarn.lock`.
## 30. shell-quote 1.7.4 has 2 known advisories
Path: server/yarn.lock
Line: 2443
This file is not part of the pull request's diff.
Bug: [CVE-2026-13311](https://osv.dev/vulnerability/CVE-2026-13311), [CVE-2026-9277](https://osv.dev/vulnerability/CVE-2026-9277). shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
Cause: `server/yarn.lock` resolves `shell-quote` to 1.7.4, which OSV lists as affected by 2 advisories. Highest CVSS 9.2. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `shell-quote` to 1.9.0 or later in `server/yarn.lock`.
## 31. toml 2.3.6 has 2 known advisories
Path: server/yarn.lock
Line: 2655
This file is not part of the pull request's diff.
Bug: [CVE-2026-63376](https://osv.dev/vulnerability/CVE-2026-63376), [CVE-2026-77465](https://osv.dev/vulnerability/CVE-2026-77465). toml-node: Uncontrolled Recursion
Cause: `server/yarn.lock` resolves `toml` to 2.3.6, which OSV lists as affected by 2 advisories. Highest CVSS 8.2. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `toml` to 4.2.0 or later in `server/yarn.lock`.
## 32. typeorm 0.3.11 has 3 known advisories
Path: server/yarn.lock
Line: 2759
This file is not part of the pull request's diff.
Bug: [CVE-2025-60542](https://osv.dev/vulnerability/CVE-2025-60542), [CVE-2026-73651](https://osv.dev/vulnerability/CVE-2026-73651), [GHSA-9ggv-8w38-r7pm](https://osv.dev/vulnerability/GHSA-9ggv-8w38-r7pm). TypeORM: migration:generate template-literal code injection
Cause: `server/yarn.lock` resolves `typeorm` to 0.3.11, which OSV lists as affected by 3 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `typeorm` to 0.3.31 or later in `server/yarn.lock`.
## 33. uuid 8.3.2 has 1 known advisory
Path: server/yarn.lock
Line: 2778
This file is not part of the pull request's diff.
Bug: [CVE-2026-41907](https://osv.dev/vulnerability/CVE-2026-41907). uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
Cause: `server/yarn.lock` resolves `uuid` to 8.3.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `uuid` to 11.1.1 or later in `server/yarn.lock`.
## 34. vm2 3.9.13 has 59 known advisories
Path: server/yarn.lock
Line: 2846
This file is not part of the pull request's diff.
Bug: [CVE-2023-29017](https://osv.dev/vulnerability/CVE-2023-29017), [CVE-2023-29199](https://osv.dev/vulnerability/CVE-2023-29199), [CVE-2023-30547](https://osv.dev/vulnerability/CVE-2023-30547), [CVE-2023-32313](https://osv.dev/vulnerability/CVE-2023-32313), and 55 more. vm2 Has a Sandbox Breakout Using Async Generator
Cause: `server/yarn.lock` resolves `vm2` to 3.9.13, which OSV lists as affected by 59 advisories. Highest CVSS 10.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `vm2` to 3.12.2 or later in `server/yarn.lock`.
## 35. word-wrap 1.2.3 has 1 known advisory
Path: server/yarn.lock
Line: 1957
This file is not part of the pull request's diff.
Bug: [CVE-2023-26115](https://osv.dev/vulnerability/CVE-2023-26115). word-wrap vulnerable to Regular Expression Denial of Service
Cause: `server/yarn.lock` resolves `word-wrap` to 1.2.3, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `word-wrap` to 1.2.4 or later in `server/yarn.lock`.
## 36. xml2js 0.4.23 has 1 known advisory
Path: server/yarn.lock
Line: 2779
This file is not part of the pull request's diff.
Bug: [CVE-2023-0842](https://osv.dev/vulnerability/CVE-2023-0842). xml2js is vulnerable to prototype pollution
Cause: `server/yarn.lock` resolves `xml2js` to 0.4.23, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `xml2js` to 0.5.0 or later in `server/yarn.lock`.
---
For each finding above, determine whether it is valid and should be fixed. If so, fix it directly. Where a finding offers several remedies, pick one and say why. Leave the pull request's own changed files alone unless a fix requires touching them.
Findings Outside the DiffNote The change causes these, but the lines that exhibit them are not in the diff, so GitHub cannot host them inline. A finding drops off this list as soon as the file it names is part of the diff. @faker-js/faker 7.6.0 has 1 known advisory —
|
Bumps axios from 1.2.3 to 1.20.0.
Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
84a9f3bchore(release): prepare release 1.20.0 (#11152)e6824eefix: core methodList, HTTP adapter errors, and add tests (#11096)d8a919ffix(xhr): flush final progress during the live loadend dispatch (#11121)2d2a21afix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)d19040bfix: harden runtime option handling (#11141)e0a02ddchore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...d10cb3achore(deps-dev): bump the development_dependencies group with 4 updates (#11143)2c94646chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)76c12bcchore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)ba98559docs: add ScrapingBee sponsor (#11137)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.