chore(deps): update dependency axios to ^0.28.0 [security] #572

renovate · 2023-11-12T01:52:07Z

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`^0.21.1` → `^0.28.0`

GitHub Vulnerability Alerts

CVE-2023-45857

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Release Notes

axios/axios (axios)

`v0.28.0`

Compare Source

Release notes:

Bug Fixes

fix(security): fixed CVE-2023-45857 by backporting withXSRFToken option to v0.x (#6091)

Backports from v1.x:

Allow null indexes on formSerializer and paramsSerializer v0.x (#4961)
Fixing content-type header repeated #4745
Fixed timeout error message for HTTP 4738
Added axios.formToJSON method (#4735)
URL params serializer (#4734)
Fixed toFormData Blob issue on node>v17 #4728
Adding types for progress event callbacks #4675
Fixed max body length defaults #4731
Added data URL support for node.js (#4725)
Added isCancel type assert (#4293)
Added the ability for the url-encoded-form serializer to respect the formSerializer config (#4721)
Add string[] to AxiosRequestHeaders type (#4322)
Allow type definition for axios instance methods (#4224)
Fixed AxiosError stack capturing; (#4718)
Fixed AxiosError status code type; (#4717)
Adding Canceler parameters config and request (#4711)
fix(types): allow to specify partial default headers for instance creation (#4185)
Added blob to the list of protocols supported by the browser (#4678)
Fixing Z_BUF_ERROR when no content (#4701)
Fixed race condition on immediate requests cancellation (#4261)
Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an Axios instance #4248
Added generic AxiosAbortSignal TS interface to avoid importing AbortController polyfill (#4229)
Fix TS definition for AxiosRequestTransformer (#4201)
Use type alias instead of interface for AxiosPromise (#4505)
Include request and config when creating a CanceledError instance (#4659)
Added generic TS types for the exposed toFormData helper (#4668)
Optimized the code that checks cancellation (#4587)
Replaced webpack with rollup (#4596)
Added stack trace to AxiosError (#4624)
Updated AxiosError.config to be optional in the type definition (#4665)
Removed incorrect argument for NetworkError constructor (#4656)

`v0.27.2`

Compare Source

Fixes and Functionality:

Fixed FormData posting in browser environment by reverting #3785 (#4640)
Enhanced protocol parsing implementation (#4639)
Fixed bundle size

`v0.27.1`

Compare Source

Fixes and Functionality:

Removed import of url module in browser build due to huge size overhead and builds being broken (#4594)
Bumped follow-redirects to ^1.14.9 (#4615)

`v0.27.0`

Compare Source

Breaking changes:

New toFormData helper function that allows the implementor to pass an object and allow axios to convert it to FormData (#3757)
Removed functionality that removed the the Content-Type request header when passing FormData (#3785)
(*) Refactored error handling implementing AxiosError as a constructor, this is a large change to error handling on the whole (#3645)
Separated responsibility for FormData instantiation between transformRequest and toFormData (#4470)
(*) Improved and fixed multiple issues with FormData support (#4448)

QOL and DevX improvements:

Added a multipart/form-data testing playground allowing contributors to debug changes easily (#4465)

Fixes and Functionality:

Refactored project file structure to avoid circular imports (#4515) & (#4516)
Bumped follow-redirects to ^1.14.9 (#4562)

Internal and Tests:

Updated dev dependencies to latest version

Documentation:

Fixing incorrect link in changelog (#4551)

Notes:

(*) Please read these pull requests before updating, these changes are very impactful and far reaching.

`v0.26.1`

Compare Source

Fixes and Functionality:

Refactored project file structure to avoid circular imports (#4220)

`v0.26.0`

Compare Source

Fixes and Functionality:

Fixed The timeoutErrorMessage property in config not work with Node.js (#3581)
Added errors to be displayed when the query parsing process itself fails (#3961)
Fix/remove url required (#4426)
Update follow-redirects dependency due to Vulnerability (#4462)
Bump karma from 6.3.11 to 6.3.14 (#4461)
Bump follow-redirects from 1.14.7 to 1.14.8 (#4473)

`v0.25.0`

Compare Source

Breaking changes:

Fixing maxBodyLength enforcement (#3786)
Don't rely on strict mode behaviour for arguments (#3470)
Adding error handling when missing url (#3791)
Update isAbsoluteURL.js removing escaping of non-special characters (#3809)
Use native Array.isArray() in utils.js (#3836)
Adding error handling inside stream end callback (#3967)

Fixes and Functionality:

Added aborted even handler (#3916)
Header types expanded allowing boolean and number types (#4144)
Fix cancel signature allowing cancel message to be undefined (#3153)
Updated type checks to be formulated better (#3342)
Avoid unnecessary buffer allocations (#3321)
Adding a socket handler to keep TCP connection live when processing long living requests (#3422)
Added toFormData helper function (#3757)
Adding responseEncoding prop type in AxiosRequestConfig (#3918)

Internal and Tests:

Adding axios-test-instance to ecosystem (#3786)
Optimize the logic of isAxiosError (#3546)
Add tests and documentation to display how multiple inceptors work (#3564)
Updating follow-redirects to version 1.14.7 (#4379)

Documentation:

Fixing changelog to show corrext pull request (#4219)
Update upgrade guide for https proxy setting (#3604)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

`v0.24.0`

Compare Source

Breaking changes:

Revert: change type of AxiosResponse to any, please read lengthy discussion here: (#4141) pull request: (#4186)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

`v0.23.0`

Compare Source

Breaking changes:

Distinguish request and response data types (#4116)
Change never type to unknown (#4142)
Fixed TransitionalOptions typings (#4147)

Fixes and Functionality:

Adding globalObject: 'this' to webpack config (#3176)
Adding insecureHTTPParser type to AxiosRequestConfig (#4066)
Fix missing semicolon in typings (#4115)
Fix response headers types (#4136)

Internal and Tests:

Improve timeout error when timeout is browser default (#3209)
Fix node version on CI (#4069)
Added testing to TypeScript portion of project (#4140)

Documentation:

Rename Angular to AngularJS (#4114)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

`v0.22.0`

Compare Source

Fixes and Functionality:

Caseless header comparing in HTTP adapter (#2880)
Avoid package.json import fixing issues and warnings related to this (#4041), (#4065)
Fixed cancelToken leakage and added AbortController support (#3305)
Updating CI to run on release branches
Bump follow redirects version
Fixed default transitional config for custom Axios instance; (#4052)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

`v0.21.4`

Compare Source

Fixes and Functionality:

Fixing JSON transform when data is stringified. Providing backward compatibility and complying to the JSON RFC standard (#4020)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

`v0.21.3`

Compare Source

Fixes and Functionality:

Fixing response interceptor not being called when request interceptor is attached (#4013)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

Julian Hollmann

`v0.21.2`

Compare Source

Fixes and Functionality:

Updating axios requests to be delayed by pre-emptive promise creation (#2702)
Adding "synchronous" and "runWhen" options to interceptors api (#2702)
Updating of transformResponse (#3377)
Adding ability to omit User-Agent header (#3703)
Adding multiple JSON improvements (#3688, #3763)
Fixing quadratic runtime and extra memory usage when setting a maxContentLength (#3738)
Adding parseInt to config.timeout (#3781)
Adding custom return type support to interceptor (#3783)
Adding security fix for ReDoS vulnerability (#3980)

Internal and Tests:

Updating build dev dependancies (#3401)
Fixing builds running on Travis CI (#3538)
Updating follow rediect version (#3694, #3771)
Updating karma sauce launcher to fix failing sauce tests (#3712, #3717)
Updating content-type header for application/json to not contain charset field, according do RFC 8259 (#2154)
Fixing tests by bumping karma-sauce-launcher version (#3813)
Changing testing process from Travis CI to GitHub Actions (#3938)

Documentation:

Updating documentation around the use of AUTH_TOKEN with multiple domain endpoints (#3539)
Remove duplication of item in changelog (#3523)
Fixing gramatical errors (#2642)
Fixing spelling error (#3567)
Moving gitpod metion (#2637)
Adding new axios documentation website link (#3681, #3707)
Updating documentation around dispatching requests (#3772)
Adding documentation for the type guard isAxiosError (#3767)
Adding explanation of cancel token (#3803)
Updating CI status badge (#3953)
Fixing errors with JSON documentation (#3936)
Fixing README typo under Request Config (#3825)
Adding axios-multi-api to the ecosystem file (#3817)
Adding SECURITY.md to properly disclose security vulnerabilities (#3981)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2023-11-12T01:52:08Z

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code EBADPLATFORM
npm ERR! notsup Unsupported platform for [email protected]: wanted {"os":"darwin"} (current: {"os":"linux"})
npm ERR! notsup Valid os:  darwin
npm ERR! notsup Actual os: linux

npm ERR! A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2024-02-22T13_33_43_967Z-debug-0.log

renovate · 2025-03-08T06:31:05Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code EBADPLATFORM
npm error notsup Unsupported platform for [email protected]: wanted {"os":"darwin"} (current: {"os":"linux"})
npm error notsup Valid os:  darwin
npm error notsup Actual os: linux
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-01-16T15_31_47_287Z-debug-0.log

renovate bot changed the title ~~chore(deps): update dependency axios to v1 [security]~~ chore(deps): update dependency axios to v1 [security] - autoclosed Feb 20, 2024

renovate bot closed this Feb 20, 2024

renovate bot deleted the renovate/npm-axios-vulnerability branch February 20, 2024 21:26

renovate bot changed the title ~~chore(deps): update dependency axios to v1 [security] - autoclosed~~ chore(deps): update dependency axios to v1 [security] Feb 22, 2024

renovate bot restored the renovate/npm-axios-vulnerability branch February 22, 2024 13:33

renovate bot reopened this Feb 22, 2024

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 73004ba to 72a2c36 Compare February 22, 2024 13:33

renovate bot changed the title ~~chore(deps): update dependency axios to v1 [security]~~ chore(deps): update dependency axios to ^0.28.0 [security] Feb 22, 2024

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 72a2c36 to 0e47f5d Compare March 8, 2025 06:31

renovate bot changed the title ~~chore(deps): update dependency axios to ^0.28.0 [security]~~ chore(deps): update dependency axios to v1 [security] Mar 8, 2025

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 0e47f5d to 83da7ee Compare March 28, 2025 15:36

renovate bot changed the title ~~chore(deps): update dependency axios to v1 [security]~~ chore(deps): update dependency axios to ^0.28.0 [security] Mar 28, 2025

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 83da7ee to 1b38abc Compare September 13, 2025 09:02

renovate bot changed the title ~~chore(deps): update dependency axios to ^0.28.0 [security]~~ chore(deps): update dependency axios to v1 [security] Sep 13, 2025

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 1b38abc to 3f2c57e Compare September 29, 2025 22:29

renovate bot changed the title ~~chore(deps): update dependency axios to v1 [security]~~ chore(deps): update dependency axios to ^0.28.0 [security] Sep 29, 2025

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 3f2c57e to 975741d Compare September 30, 2025 02:12

renovate bot changed the title ~~chore(deps): update dependency axios to ^0.28.0 [security]~~ chore(deps): update dependency axios to ^0.30.0 [security] Sep 30, 2025

chore(deps): update dependency axios to ^0.28.0 [security]

1b3cdee

renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 975741d to 1b3cdee Compare January 16, 2026 15:31

renovate bot changed the title ~~chore(deps): update dependency axios to ^0.30.0 [security]~~ chore(deps): update dependency axios to ^0.28.0 [security] Jan 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency axios to ^0.28.0 [security] #572

chore(deps): update dependency axios to ^0.28.0 [security] #572

renovate bot commented Nov 12, 2023 •

edited

Loading

Uh oh!

renovate bot commented Nov 12, 2023 •

edited

Loading

Uh oh!

renovate bot commented Mar 8, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): update dependency axios to ^0.28.0 [security] #572

Are you sure you want to change the base?

chore(deps): update dependency axios to ^0.28.0 [security] #572

Conversation

renovate bot commented Nov 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Release Notes

Release notes:

Bug Fixes

Backports from v1.x:

Fixes and Functionality:

Breaking changes:

QOL and DevX improvements:

Fixes and Functionality:

Internal and Tests:

Documentation:

Notes:

Fixes and Functionality:

Fixes and Functionality:

Breaking changes:

Fixes and Functionality:

Internal and Tests:

Documentation:

Breaking changes:

Breaking changes:

Fixes and Functionality:

Internal and Tests:

Documentation:

Fixes and Functionality:

Fixes and Functionality:

Fixes and Functionality:

Fixes and Functionality:

Internal and Tests:

Documentation:

Configuration

Uh oh!

renovate bot commented Nov 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠ Artifact update problem

File name: package-lock.json

Uh oh!

renovate bot commented Mar 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Nov 12, 2023 •

edited

Loading

renovate bot commented Nov 12, 2023 •

edited

Loading

renovate bot commented Mar 8, 2025 •

edited

Loading