vuejs-datatable icon indicating copy to clipboard operation
vuejs-datatable copied to clipboard

Published 20 hours ago β€’ verified publisher icon GerkinDev

chore: πŸ€– Renovate auto-bump Update dependency axios to ^0.28.0 [SECURITY]

Open renovate[bot] opened this issue 6 months ago β€’ 0 comments

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
axios (source) ^0.21.0 -> ^0.28.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2020-28168

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

CVE-2023-45857

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Release Notes

axios/axios (axios)

v0.28.0

Compare Source

Release notes:

Bug Fixes
  • fix(security): fixed CVE-2023-45857 by backporting withXSRFToken option to v0.x (#​6091)
Backports from v1.x:
  • Allow null indexes on formSerializer and paramsSerializer v0.x (#​4961)
  • Fixing content-type header repeated #​4745
  • Fixed timeout error message for HTTP 4738
  • Added axios.formToJSON method (#​4735)
  • URL params serializer (#​4734)
  • Fixed toFormData Blob issue on node>v17 #​4728
  • Adding types for progress event callbacks #​4675
  • Fixed max body length defaults #​4731
  • Added data URL support for node.js (#​4725)
  • Added isCancel type assert (#​4293)
  • Added the ability for the url-encoded-form serializer to respect the formSerializer config (#​4721)
  • Add string[] to AxiosRequestHeaders type (#​4322)
  • Allow type definition for axios instance methods (#​4224)
  • Fixed AxiosError stack capturing; (#​4718)
  • Fixed AxiosError status code type; (#​4717)
  • Adding Canceler parameters config and request (#​4711)
  • fix(types): allow to specify partial default headers for instance creation (#​4185)
  • Added blob to the list of protocols supported by the browser (#​4678)
  • Fixing Z_BUF_ERROR when no content (#​4701)
  • Fixed race condition on immediate requests cancellation (#​4261)
  • Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an Axios instance https://github.com/axios/axios/pull/4248
  • Added generic AxiosAbortSignal TS interface to avoid importing AbortController polyfill (#​4229)
  • Fix TS definition for AxiosRequestTransformer (#​4201)
  • Use type alias instead of interface for AxiosPromise (#​4505)
  • Include request and config when creating a CanceledError instance (#​4659)
  • Added generic TS types for the exposed toFormData helper (#​4668)
  • Optimized the code that checks cancellation (#​4587)
  • Replaced webpack with rollup (#​4596)
  • Added stack trace to AxiosError (#​4624)
  • Updated AxiosError.config to be optional in the type definition (#​4665)
  • Removed incorrect argument for NetworkError constructor (#​4656)

v0.27.2

Compare Source

Fixes and Functionality:

v0.27.1

Compare Source

Fixes and Functionality:
  • Removed import of url module in browser build due to huge size overhead and builds being broken (#​4594)
  • Bumped follow-redirects to ^1.14.9 (#​4615)

v0.27.0

Compare Source

Breaking changes:
  • New toFormData helper function that allows the implementor to pass an object and allow axios to convert it to FormData (#​3757)
  • Removed functionality that removed the the Content-Type request header when passing FormData (#​3785)
  • (*) Refactored error handling implementing AxiosError as a constructor, this is a large change to error handling on the whole (#​3645)
  • Separated responsibility for FormData instantiation between transformRequest and toFormData (#​4470)
  • (*) Improved and fixed multiple issues with FormData support (#​4448)
QOL and DevX improvements:
  • Added a multipart/form-data testing playground allowing contributors to debug changes easily (#​4465)
Fixes and Functionality:
Internal and Tests:
  • Updated dev dependencies to latest version
Documentation:
Notes:
  • (*) Please read these pull requests before updating, these changes are very impactful and far reaching.

v0.26.1

Compare Source

Fixes and Functionality:
  • Refactored project file structure to avoid circular imports (#​4220)

v0.26.0

Compare Source

Fixes and Functionality:
  • Fixed The timeoutErrorMessage property in config not work with Node.js (#​3581)
  • Added errors to be displayed when the query parsing process itself fails (#​3961)
  • Fix/remove url required (#​4426)
  • Update follow-redirects dependency due to Vulnerability (#​4462)
  • Bump karma from 6.3.11 to 6.3.14 (#​4461)
  • Bump follow-redirects from 1.14.7 to 1.14.8 (#​4473)

v0.25.0

Compare Source

Breaking changes:
  • Fixing maxBodyLength enforcement (#​3786)
  • Don't rely on strict mode behaviour for arguments (#​3470)
  • Adding error handling when missing url (#​3791)
  • Update isAbsoluteURL.js removing escaping of non-special characters (#​3809)
  • Use native Array.isArray() in utils.js (#​3836)
  • Adding error handling inside stream end callback (#​3967)
Fixes and Functionality:
  • Added aborted even handler (#​3916)
  • Header types expanded allowing boolean and number types (#​4144)
  • Fix cancel signature allowing cancel message to be undefined (#​3153)
  • Updated type checks to be formulated better (#​3342)
  • Avoid unnecessary buffer allocations (#​3321)
  • Adding a socket handler to keep TCP connection live when processing long living requests (#​3422)
  • Added toFormData helper function (#​3757)
  • Adding responseEncoding prop type in AxiosRequestConfig (#​3918)
Internal and Tests:
  • Adding axios-test-instance to ecosystem (#​3786)
  • Optimize the logic of isAxiosError (#​3546)
  • Add tests and documentation to display how multiple inceptors work (#​3564)
  • Updating follow-redirects to version 1.14.7 (#​4379)
Documentation:
  • Fixing changelog to show corrext pull request (#​4219)
  • Update upgrade guide for https proxy setting (#​3604)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

v0.24.0

Compare Source

Breaking changes:
  • Revert: change type of AxiosResponse to any, please read lengthy discussion here: (#​4141) pull request: (#​4186)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

v0.23.0

Compare Source

Breaking changes:
Fixes and Functionality:
Internal and Tests:
  • Improve timeout error when timeout is browser default (#​3209)
  • Fix node version on CI (#​4069)
  • Added testing to TypeScript portion of project (#​4140)
Documentation:

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

v0.22.0

Compare Source

Fixes and Functionality:
  • Caseless header comparing in HTTP adapter (#​2880)
  • Avoid package.json import fixing issues and warnings related to this (#​4041), (#​4065)
  • Fixed cancelToken leakage and added AbortController support (#​3305)
  • Updating CI to run on release branches
  • Bump follow redirects version
  • Fixed default transitional config for custom Axios instance; (#​4052)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

v0.21.4

Compare Source

Fixes and Functionality:
  • Fixing JSON transform when data is stringified. Providing backward compatibility and complying to the JSON RFC standard (#​4020)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

v0.21.3

Compare Source

Fixes and Functionality:
  • Fixing response interceptor not being called when request interceptor is attached (#​4013)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

v0.21.2

Compare Source

Fixes and Functionality:
  • Updating axios requests to be delayed by pre-emptive promise creation (#​2702)
  • Adding "synchronous" and "runWhen" options to interceptors api (#​2702)
  • Updating of transformResponse (#​3377)
  • Adding ability to omit User-Agent header (#​3703)
  • Adding multiple JSON improvements (#​3688, #​3763)
  • Fixing quadratic runtime and extra memory usage when setting a maxContentLength (#​3738)
  • Adding parseInt to config.timeout (#​3781)
  • Adding custom return type support to interceptor (#​3783)
  • Adding security fix for ReDoS vulnerability (#​3980)
Internal and Tests:
Documentation:

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

v0.21.1

Compare Source

Fixes and Functionality:
Internal and Tests:

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

Configuration

πŸ“… Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

β™» Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

πŸ”• Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar Aug 06 '24 10:08 renovate[bot]