Updating Gatsby dependencies for security reasons

[lukasz-walendziuk]

Hi, I work at a company that takes security concerns very seriously. I am currently in the process of updating library and framework versions across several projects, and I noticed that the latest Gatsby release (5.16.1) depends on quite a few outdated toolchains or/and libraries.

Examples include:

• cache-manager (used: 2.11.1, latest: 7.2.8),
• axios (used: 1.8.4, latest: 1.13.6).

This may introduce potential security risks. For example:

• gatsby@5.16.1 -> cache-manager@2.11.1 -> async@1.5.2 > (reported: CVE-2024-39249 (NVD)),
• gatsby@5.16.1 -> axios@1.8.4 -> form-data@4.0.0 > (reported: GHSA-fjxv-7rqg-78g4 (GITHUB)).

I understand that some of these are direct dependencies and others are transitive, so in some cases the issue may not be easy to resolve immediately. However, it might still be worth considering updating them to newer versions where possible.

[aniruddhaadak80]

@lukasz-walendziuk

Thanks for opening this up! Usually, with these kinds of underlying issues, the first step is double-checking if there is a minor version mismatch in your installed environment tooling vs the actual framework requirements.

Have you tried outright clearing the respective local build/cache directories, forcing a clean slate reinstall, and ruling out any implicit breaking changes from recent patches?

If you are still hitting the exact same bottleneck, dropping a minimal reproduction steps (or specifically the raw error logs) here usually gets it sorted out way faster by the maintainers.

Hope this helps point you in the right direction. Let me know if you make any progress!