apisauce fix(deps): upgrade axios and typescript

fix(deps): upgrade axios and typescript

Open jeremyadavis opened this issue 2 years ago • 7 comments

This fixes vulnerabilities in the axios library: CVE-2022-0155 and CVE-2022-0536.

There are a couple of things to consider if this PR is worth merging:

There are a few breaking changes in axios along the way from 0.21.4 to 0.26.1
Axios used the AbortController type from the DOM library and now doesn't. The upgrade broke a type and the fix was to add "dom" to the tsconfig. Really not sure if that is the correct work around or not.
The upgrade needed the Omit utility type which wasn't added until 3.5.1, so I had to upgrade the typescript dependency TBH, I don't understand why the tsconfig doesn't exclude node_modules, so maybe that's the better approach unless I'm missing something.

I tested this locally with my company's iOS and Android app and saw no issues. I did not test on the web.

Fixes: #287

Mar 09 '22 23:03 jeremyadavis

I uncovered an issue with this upgrade and multi-part/form-data:

There is a hack to get around it, but the official fix isn't merged yet so I'm going to undo my usage of the axios upgrade until an official fix is available.

I'll try to remember to update the PR when fixed.

Mar 11 '22 17:03 jeremyadavis

Thanks @jeremyadavis for the PR

Mar 15 '22 02:03 chakrihacker

@jeremyadavis you should try bumping the version of axios to 0.27.2 per this comment in one of the issues you mentioned.

May 12 '22 20:05 noah-eigenfeld

I upgrade axios to 0.27.2 I confirmed that it does fix the issue with the multipart/form-data was broken using my company's React Native app.

Notably, axios 0.27.0 had refactored their error handling which broke a couple of tests that had expected null responses, that now have explicit error strings.

May 13 '22 21:05 jeremyadavis

Any update on this one ? thank you !