Skip to content

[Snyk] Upgrade axios from 0.18.1 to 0.30.2 #693

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
nejidevelops wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade axios from 0.18.1 to 0.30.2 #693

nejidevelops wants to merge 1 commit into from

Conversation

@nejidevelops
Copy link
Owner

@nejidevelops nejidevelops commented Oct 21, 2025

snyk-top-banner

Snyk has created this PR to upgrade axios from 0.18.1 to 0.30.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 26 versions ahead of your current version.

  • The recommended version was released 24 days ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ACORN-559469		 375 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ACORN-559469		 375 No Known Exploit
high severity Prototype Pollution
SNYK-JS-AJV-584908		 375 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 375 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SSRI-1246392		 375 Proof of Concept
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 375 No Known Exploit
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 375 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579147		 375 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579152		 375 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579155		 375 No Known Exploit
high severity Arbitrary File Overwrite
SNYK-JS-TAR-174125		 375 Proof of Concept
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 375 No Known Exploit
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 375 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579147		 375 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579152		 375 No Known Exploit
high severity Arbitrary File Write
SNYK-JS-TAR-1579155		 375 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TMPL-1583443		 375 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TRIM-1017038		 375 Proof of Concept
high severity Code Injection
SNYK-JS-LODASH-1040724		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-450202		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-567746		 375 Proof of Concept
high severity Improper Input Validation
SNYK-JS-URLPARSE-2407770		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-173692		 375 No Known Exploit
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-174183		 375 No Known Exploit
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-469063		 375 No Known Exploit
high severity Denial of Service (DoS)
SNYK-JS-HANDLEBARS-480388		 375 No Known Exploit
high severity Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970		 375 Proof of Concept
high severity Remote Memory Exposure
SNYK-JS-DNSPACKET-1293563		 375 No Known Exploit
high severity Cryptographic Issues
SNYK-JS-ELLIPTIC-571484		 375 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 375 Proof of Concept
medium severity Authorization Bypass Through User-Controlled Key
SNYK-JS-URLPARSE-2412697		 375 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-DOTPROP-543489		 375 Proof of Concept
medium severity Cryptographic Issues
SNYK-JS-ELLIPTIC-1064899		 375 No Known Exploit
medium severity Timing Attack
SNYK-JS-ELLIPTIC-511941		 375 No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 375 No Known Exploit
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577916		 375 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577917		 375 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577918		 375 Proof of Concept
high severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-8172694		 375 No Known Exploit
critical severity Information Exposure
SNYK-JS-ELLIPTIC-8720086		 375 Proof of Concept
high severity Arbitrary Code Execution
SNYK-JS-ESLINTUTILS-460220		 375 No Known Exploit
high severity Improper Handling of Extra Parameters
SNYK-JS-FOLLOWREDIRECTS-6141137		 375 Proof of Concept
high severity Improper Handling of Extra Parameters
SNYK-JS-FOLLOWREDIRECTS-6141137		 375 Proof of Concept
high severity Remote Code Execution (RCE)
SNYK-JS-HANDLEBARS-1056767		 375 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-ASYNC-2441827		 375 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-1579269		 375 Proof of Concept
high severity Cross-site Request Forgery (CSRF)
SNYK-JS-AXIOS-6032459		 375 Proof of Concept
high severity Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860		 375 No Known Exploit
medium severity Information Exposure
SNYK-JS-EVENTSOURCE-2823375		 375 Proof of Concept
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509		 375 No Known Exploit
medium severity Cross-site Scripting
SNYK-JS-EXPRESS-7926867		 375 No Known Exploit
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2332181		 375 Proof of Concept
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-6444610		 375 Proof of Concept
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2332181		 375 Proof of Concept
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-6444610		 375 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-HANDLEBARS-1279029		 375 Proof of Concept
medium severity Server-Side Request Forgery (SSRF)
SNYK-JS-AXIOS-1038255		 375 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-6124857		 375 Proof of Concept
medium severity Server-side Request Forgery (SSRF)
SNYK-JS-AXIOS-9292519		 375 Proof of Concept
medium severity Server-side Request Forgery (SSRF)
SNYK-JS-AXIOS-9403194		 375 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BABELHELPERS-9397697		 375 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 375 No Known Exploit
low severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2396346		 375 No Known Exploit
low severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2396346		 375 No Known Exploit
critical severity Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462		 375 Proof of Concept
high severity Improper Verification of Cryptographic Signature
SNYK-JS-BROWSERIFYSIGN-6037026		 375 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-WEBSOCKETEXTENSIONS-570623		 375 Proof of Concept
high severity Denial of Service (DoS)
SNYK-JS-WS-7266574		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-Y18N-1021887		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-Y18N-1021887		 375 Proof of Concept
high severity Arbitrary Code Execution
SNYK-JS-HANDLEBARS-534478		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-INI-1048974		 375 Proof of Concept
high severity Server-side Request Forgery (SSRF)
SNYK-JS-IP-6240864		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 375 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-COLORSTRING-1082939		 375 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-COOKIE-8163060		 375 No Known Exploit
medium severity Improper Input Validation
SNYK-JS-URLPARSE-1078283		 375 No Known Exploit
medium severity Access Restriction Bypass
SNYK-JS-URLPARSE-2401205		 375 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-HANDLEBARS-567742		 375 Proof of Concept
medium severity Denial of Service (DoS)
SNYK-JS-HTTPPROXY-569139		 375 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-JQUERY-567880		 375 Mature
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106		 375 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073		 375 Proof of Concept
critical severity Function Call With Incorrect Argument Type
SNYK-JS-CIPHERBASE-12084814		 375 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 375 Proof of Concept
medium severity Time of Check Time of Use (TOCTOU)
npm:chownr:20180731		 375 No Known Exploit
medium severity Denial of Service (DoS)
npm:mem:20180117		 375 No Known Exploit
medium severity Open Redirect
SNYK-JS-URLPARSE-1533425		 375 Proof of Concept
medium severity Authorization Bypass
SNYK-JS-URLPARSE-2407759		 375 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355		 375 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1085627		 375 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1243891		 375 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-JQUERY-565129		 375 Mature
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067		 375 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 375 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 375 Proof of Concept
critical severity Prototype Pollution
SNYK-JS-HANDLEBARS-534988		 375 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106		 375 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-8482416		 375 Proof of Concept
critical severity Generation of Predictable Numbers or Identifiers
SNYK-JS-PBKDF2-10495496		 375 Proof of Concept
critical severity Generation of Predictable Numbers or Identifiers
SNYK-JS-PBKDF2-10495498		 375 No Known Exploit
high severity Prototype Poisoning
SNYK-JS-QS-3153490		 375 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 375 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 375 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 375 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-SETVALUE-1540541		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-SETVALUE-450213		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-SETVALUE-1540541		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-SETVALUE-450213		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-608086		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-6139239		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-MERGEDEEP-1070277		 375 No Known Exploit
high severity Prototype Pollution
SNYK-JS-MIXINDEEP-450212		 375 Proof of Concept
high severity Prototype Pollution
SNYK-JS-NODEFORGE-598677		 375 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1090595		 375 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764		 375 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764		 375 Proof of Concept
medium severity Command Injection
SNYK-JS-NODENOTIFIER-1035794		 375 No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JS-NWSAPI-2841516		 375 No Known Exploit
medium severity Improper Handling of Unexpected Data Type
SNYK-JS-ONHEADERS-10773729		 375 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SEND-7926862		 375 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865		 375 No Known Exploit
critical severity Function Call With Incorrect Argument Type
SNYK-JS-SHAJS-12089400		 375 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764		 375 Proof of Concept
low severity Validation Bypass
SNYK-JS-KINDOF-537849		 375 Proof of Concept
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795		 375 Proof of Concept
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795		 375 Proof of Concept
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795		 375 Proof of Concept
Release notes
Package name: axios
  • 0.30.2 - 2025-09-27

    What's Changed

    • Backport maxContentLength vulnerability fix to v0.x by @ FeBe95 in #7034

    New Contributors

    Full Changelog: v0.30.1...v0.30.2

  • 0.30.1 - 2025-08-04

    Release notes:

    Bug Fixes

    • chore(deps): bump form-data from 4.0.0 to 4.0.4 for v0.x by @ wolandec in #6978

    Contributors to this release

    Full Changelog: v0.30.0...v0.30.1

  • 0.30.0 - 2025-03-26

    Release notes:

    Bug Fixes

    Contributors to this release

    Full Changelog: v0.29.0...v0.30.0

  • 0.29.0 - 2024-11-21
  • 0.28.1 - 2024-03-28
  • 0.28.0 - 2024-02-12
  • 0.27.2 - 2022-04-27
  • 0.27.1 - 2022-04-26
  • 0.27.0 - 2022-04-25
  • 0.26.1 - 2022-03-09
  • 0.26.0 - 2022-02-13
  • 0.25.0 - 2022-01-18
  • 0.24.0 - 2021-10-25
  • 0.23.0 - 2021-10-12
  • 0.22.0 - 2021-10-01
  • 0.21.4 - 2021-09-06
  • 0.21.3 - 2021-09-04
  • 0.21.2 - 2021-09-04
  • 0.21.1 - 2020-12-22
  • 0.21.0 - 2020-10-23
  • 0.20.0 - 2020-08-21
  • 0.20.0-0 - 2020-07-15
  • 0.19.2 - 2020-01-22
  • 0.19.1 - 2020-01-07
  • 0.19.0 - 2019-05-30
  • 0.19.0-beta.1 - 2018-08-09
  • 0.18.1 - 2019-06-01
from axios GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@snyk-bot
fix: upgrade axios from 0.18.1 to 0.30.2
9937af9 
Snyk has created this PR to upgrade axios from 0.18.1 to 0.30.2.

See this package in npm:
axios

See this project in Snyk:
https://app.snyk.io/org/newtonombese1/project/ddd26aaf-a7df-4183-bebb-964dc17df832?utm_source=github&utm_medium=referral&page=upgrade-pr
@gemini-code-assist
Copy link

gemini-code-assist bot commented Oct 21, 2025

Summary of Changes

Hello @nejidevelops, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request performs a significant and necessary upgrade of the axios dependency to enhance the security posture of the project. By updating axios to its latest stable version, the application benefits from numerous patches that resolve a wide array of critical, high, and medium severity vulnerabilities, ensuring a more robust and secure operational environment.

Highlights

  • Dependency Upgrade: The axios package has been upgraded from version 0.18.1 to 0.30.2, a jump of 26 versions.
  • Critical Security Fixes: This upgrade addresses a substantial number of security vulnerabilities, including critical issues like 'Improper Verification of Cryptographic Signature', 'Information Exposure', 'Function Call With Incorrect Argument Type', and 'Generation of Predictable Numbers or Identifiers', along with many high and medium severity vulnerabilities such as Regular Expression Denial of Service (ReDoS), Prototype Pollution, Arbitrary File Overwrite/Write, Code Injection, Server-Side Request Forgery (SSRF), and Cross-site Scripting (XSS).
  • Automated Maintenance: This pull request was automatically generated by Snyk to ensure dependencies are kept up-to-date and to mitigate known security risks.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist[bot]
gemini-code-assist bot reviewed Oct 21, 2025
View reviewed changes
Copy link

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request upgrades axios from version 0.18.1 to 0.30.2. While this is an important security upgrade, it introduces a critical breaking change. Axios versions 0.19.0 and later automatically handle JSON serialization. Your current implementation in src/api/todos-api.ts manually stringifies request bodies for POST and PATCH requests. With the new axios version, this will lead to double-encoding of the JSON payload, which will likely cause your API calls to fail. I've added a detailed comment on the package.json change with information on how to resolve this issue.

course-04/exercises/c4-client-master/package.json
"private": true,
"dependencies": {
"axios": "^0.18.1",
"axios": "^0.30.2",
Copy link

@gemini-code-assist gemini-code-assist bot Oct 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This upgrade to axios v0.30.2 introduces a breaking change that will likely cause your API calls to fail.

Starting with axios v0.19.0, JavaScript objects are automatically serialized to JSON for requests with Content-Type: 'application/json'. Your current code in src/api/todos-api.ts manually stringifies the data for POST and PATCH requests, for example:

// src/api/todos-api.ts:24
const response = await Axios.post(`${apiEndpoint}/todos`,  JSON.stringify(newTodo), { /* ... */ });

With the new axios version, this will lead to double-encoded JSON, breaking your backend integration.

To fix this, you must remove the JSON.stringify() calls in createTodo and patchTodo functions and pass the objects directly.

Example for createTodo:

// src/api/todos-api.ts
export async function createTodo(
  idToken: string,
  newTodo: CreateTodoRequest
): Promise<Todo> {
  const response = await Axios.post(`${apiEndpoint}/todos`, newTodo, { // No JSON.stringify
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${idToken}`
    }
  })
  return response.data.item
}

The same change is needed for patchTodo. This is a critical fix required for the app to function after this dependency upgrade.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@nejidevelops @snyk-bot