Skip to content

Commit

Permalink
Upgrade axios package to resolve follow-redirect vulnerability (#952)
Browse files Browse the repository at this point in the history
### Feature or Bugfix
<!-- please choose -->
- Bugfix

### Detail
- Fix `npm audit` vulnerability on `follow-redirects` package


### Relates
N/A

### Security
Please answer the questions below briefly where applicable, or write
`N/A`. Based on
[OWASP 10](https://owasp.org/Top10/en/).

- Does this PR introduce or modify any input fields or queries - this
includes
fetching data from storage outside the application (e.g. a database, an
S3 bucket)? N/A
  - Is the input sanitized? N/A
- What precautions are you taking before deserializing the data you
consume? N/A
  - Is injection prevented by parametrizing queries? N/A
  - Have you ensured no `eval` or similar functions are used? N/A
- Does this PR introduce any functionality or component that requires
authorization? N/A
- How have you ensured it respects the existing AuthN/AuthZ mechanisms?
N/A
  - Are you logging failed auth attempts? N/A
- Are you using or adding any cryptographic features? N/A
  - Do you use a standard proven implementations? N/A
- Are the used keys controlled by the customer? Where are they stored?
N/A
- Are you introducing any new policies/roles/users? N/A
  - Have you used the least-privilege principle? How? N/A


By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.
  • Loading branch information
noah-paige authored Jan 10, 2024
1 parent a273e52 commit d32bd49
Show file tree
Hide file tree
Showing 3 changed files with 30 additions and 25 deletions.
30 changes: 15 additions & 15 deletions frontend/package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion frontend/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
"apexcharts": "^3.33.2",
"apollo-boost": "^0.4.9",
"aws-amplify": "^5.3.8",
"axios": "^1.6.0",
"axios": "^1.6.5",
"classnames": "^2.3.1",
"date-fns": "^2.28.0",
"dayjs": "^1.11.0",
Expand Down
23 changes: 14 additions & 9 deletions frontend/yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -5838,12 +5838,12 @@ axe-core@^4.6.2:
resolved "https://registry.npmjs.org/axe-core/-/axe-core-4.7.2.tgz"
integrity sha512-zIURGIS1E1Q4pcrMjp+nnEh+16G56eG/MUllJH8yEvw7asDo7Ac9uhC9KIH5jzpITueEZolfYglnCGIuSBz39g==

axios@^1.6.0:
version "1.6.0"
resolved "https://registry.npmjs.org/axios/-/axios-1.6.0.tgz"
integrity sha512-EZ1DYihju9pwVB+jg67ogm+Tmqc6JmhamRN6I4Zt8DfZu5lbcQGw3ozH9lFejSJgs/ibaef3A9PMXPLeefFGJg==
axios@^1.6.5:
version "1.6.5"
resolved "https://registry.npmjs.org/axios/-/axios-1.6.5.tgz"
integrity sha512-Ii012v05KEVuUoFWmMW/UQv9aRIc3ZwkWDcM+h5Il8izZCtRVpDUfwpoFf7eOtajT3QiGR4yDUx7lPqHJULgbg==
dependencies:
follow-redirects "^1.15.0"
follow-redirects "^1.15.4"
form-data "^4.0.0"
proxy-from-env "^1.1.0"

Expand Down Expand Up @@ -7385,6 +7385,11 @@ domhandler@^4.0.0, domhandler@^4.2.0, domhandler@^4.3.1:
dependencies:
domelementtype "^2.2.0"

dompurify@^3.0.6:
version "3.0.6"
resolved "https://registry.npmjs.org/dompurify/-/dompurify-3.0.6.tgz"
integrity sha512-ilkD8YEnnGh1zJ240uJsW7AzE+2qpbOUYjacomn3AvJ6J4JhKGSZ2nh4wUIXPZrEPppaCLx5jFe8T89Rk8tQ7w==

domutils@^1.7.0:
version "1.7.0"
resolved "https://registry.npmjs.org/domutils/-/domutils-1.7.0.tgz"
Expand Down Expand Up @@ -8285,10 +8290,10 @@ flow-parser@^0.206.0, flow-parser@0.*:
resolved "https://registry.npmjs.org/flow-parser/-/flow-parser-0.206.0.tgz"
integrity sha512-HVzoK3r6Vsg+lKvlIZzaWNBVai+FXTX1wdYhz/wVlH13tb/gOdLXmlTqy6odmTBhT5UoWUbq0k8263Qhr9d88w==

follow-redirects@^1.0.0, follow-redirects@^1.14.8, follow-redirects@^1.15.0:
version "1.15.2"
resolved "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz"
integrity sha512-VQLG33o04KaQ8uYi2tVNbdrWp1QWxNNea+nmIB4EVM28v0hmP17z7aG1+wAkNzVq4KeXTq3221ye5qTJP91JwA==
follow-redirects@^1.0.0, follow-redirects@^1.14.8, follow-redirects@^1.15.4:
version "1.15.4"
resolved "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz"
integrity sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==

for-each@^0.3.3:
version "0.3.3"
Expand Down

0 comments on commit d32bd49

Please sign in to comment.