Update dependency axios to ^0.21.0 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
axios (source)	^0.19.0 -> ^0.21.0

GitHub Vulnerability Alerts

CVE-2020-28168

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

CVE-2021-3749

axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.

---

Release Notes

axios/axios (axios)

v0.21.2

Compare Source

Fixes and Functionality:

• Updating axios requests to be delayed by pre-emptive promise creation (#​2702)
• Adding "synchronous" and "runWhen" options to interceptors api (#​2702)
• Updating of transformResponse (#​3377)
• Adding ability to omit User-Agent header (#​3703)
• Adding multiple JSON improvements (#​3688, #​3763)
• Fixing quadratic runtime and extra memory usage when setting a maxContentLength (#​3738)
• Adding parseInt to config.timeout (#​3781)
• Adding custom return type support to interceptor (#​3783)
• Adding security fix for ReDoS vulnerability (#​3980)

Internal and Tests:

• Updating build dev dependancies (#​3401)
• Fixing builds running on Travis CI (#​3538)
• Updating follow rediect version (#​3694, #​3771)
• Updating karma sauce launcher to fix failing sauce tests (#​3712, #​3717)
• Updating content-type header for application/json to not contain charset field, according do RFC 8259 (#​2154)
• Fixing tests by bumping karma-sauce-launcher version (#​3813)
• Changing testing process from Travis CI to GitHub Actions (#​3938)

Documentation:

• Updating documentation around the use of AUTH_TOKEN with multiple domain endpoints (#​3539)
• Remove duplication of item in changelog (#​3523)
• Fixing gramatical errors (#​2642)
• Fixing spelling error (#​3567)
• Moving gitpod metion (#​2637)
• Adding new axios documentation website link (#​3681, #​3707)
• Updating documentation around dispatching requests (#​3772)
• Adding documentation for the type guard isAxiosError (#​3767)
• Adding explanation of cancel token (#​3803)
• Updating CI status badge (#​3953)
• Fixing errors with JSON documentation (#​3936)
• Fixing README typo under Request Config (#​3825)
• Adding axios-multi-api to the ecosystem file (#​3817)
• Adding SECURITY.md to properly disclose security vulnerabilities (#​3981)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Sasha Korotkov
• Daniel Lopretto
• Mike Bishop
• Dmitriy Mozgovoy
• Mark
• Philipe Gouveia Paixão
• hippo
• ready-research
• Xianming Zhong
• Christopher Chrapka
• Brian Anglin
• Kohta Ito
• Ali Clark
• caikan
• Elina Gorshkova
• Ryota Ikezawa
• Nisar Hassan Naqvi
• Jake
• TagawaHirotaka
• Johannes Jarbratt
• Mo Sattler
• Sam Carlton
• Matt Czapliński
• Ziding Zhang

v0.21.1

Compare Source

Fixes and Functionality:

• Hotfix: Prevent SSRF (#​3410)
• Protocol not parsed when setting proxy config from env vars (#​3070)
• Updating axios in types to be lower case (#​2797)
• Adding a type guard for AxiosError (#​2949)

Internal and Tests:

• Remove the skipping of the socket http test (#​3364)
• Use different socket for Win32 test (#​3375)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Daniel Lopretto <timemachine3030@​users.noreply.github.com>
• Jason Kwok JasonHK@users.noreply.github.com
• Jay jasonsaayman@gmail.com
• Jonathan Foster jonathan@jonathanfoster.io
• Remco Haszing remcohaszing@gmail.com
• Xianming Zhong chinesedfan@qq.com

v0.21.0

Compare Source

Fixes and Functionality:

• Fixing requestHeaders.Authorization (#​3287)
• Fixing node types (#​3237)
• Fixing axios.delete ignores config.data (#​3282)
• Revert "Fixing overwrite Blob/File type as Content-Type in browser. (#​1773)" (#​3289)
• Fixing an issue that type 'null' and 'undefined' is not assignable to validateStatus when typescript strict option is enabled (#​3200)

Internal and Tests:

• Lock travis to not use node v15 (#​3361)

Documentation:

• Fixing simple typo, existant -> existent (#​3252)
• Fixing typos (#​3309)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Allan Cruz 57270969+Allanbcruz@users.noreply.github.com
• George Cheng Gerhut@GMail.com
• Jay jasonsaayman@gmail.com
• Kevin Kirsche Kev.Kirsche+GitHub@gmail.com
• Remco Haszing remcohaszing@gmail.com
• Taemin Shin <cprayer13@​gmail.com>
• Tim Gates tim.gates@iress.com
• Xianming Zhong chinesedfan@qq.com

v0.20.0

Compare Source

Release of 0.20.0-pre as a full release with no other changes.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pils-frontend/package-lock.json

/usr/local/bin/docker: line 4: .: filename argument required
.: usage: . filename [arguments]
[21:25:35.080] INFO (43): Downloading file ...
    url: "https://github.com/containerbase/node-prebuild/releases/download/18.17.0/node-18.17.0-focal-x86_64.tar.xz.sha512"
    output: "/tmp/worker/8d1444/a1eda3/cache/containerbase/4f1b66de1eebc4e832e9ad5a012165a5e79cd3b1c3892eb6646e768a14a95e7c/node-18.17.0-focal-x86_64.tar.xz.sha512"
[21:25:35.120] INFO (43): Download completed  in 40ms.
[21:25:35.235] INFO (59): Downloading file ...
    url: "https://github.com/containerbase/node-prebuild/releases/download/18.17.0/node-18.17.0-focal-x86_64.tar.xz"
    output: "/tmp/worker/8d1444/a1eda3/cache/containerbase/d71155bd68a6dac4a334976c5d82cd47e91bf95aa8811a4ec27c615d8d82df76/node-18.17.0-focal-x86_64.tar.xz"
[21:25:35.443] INFO (59): Download completed  in 208ms.
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: css-loader@3.4.2
npm ERR! Found: webpack@3.12.0
npm ERR! node_modules/webpack
npm ERR!   dev webpack@"3.12.0" from the root project
npm ERR!   peer webpack@">=2" from babel-loader@8.0.6
npm ERR!   node_modules/babel-loader
npm ERR!     dev babel-loader@"^8.0.6" from the root project
npm ERR!   5 more (extract-text-webpack-plugin, ...)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer webpack@"^4.0.0 || ^5.0.0" from css-loader@3.4.2
npm ERR! node_modules/css-loader
npm ERR!   css-loader@"^3.4.2" from the root project
npm ERR!   peer css-loader@"*" from vue-loader@13.7.3
npm ERR!   node_modules/vue-loader
npm ERR!     dev vue-loader@"^13.7.3" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: webpack@5.88.2
npm ERR! node_modules/webpack
npm ERR!   peer webpack@"^4.0.0 || ^5.0.0" from css-loader@3.4.2
npm ERR!   node_modules/css-loader
npm ERR!     css-loader@"^3.4.2" from the root project
npm ERR!     peer css-loader@"*" from vue-loader@13.7.3
npm ERR!     node_modules/vue-loader
npm ERR!       dev vue-loader@"^13.7.3" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! 
npm ERR! For a full report see:
npm ERR! /tmp/worker/8d1444/a1eda3/cache/others/npm/_logs/2023-08-08T21_25_40_071Z-eresolve-report.txt

npm ERR! A complete log of this run can be found in: /tmp/worker/8d1444/a1eda3/cache/others/npm/_logs/2023-08-08T21_25_40_071Z-debug-0.log

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication