Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(dependencies): Update axios dependency #149

Closed
wants to merge 1 commit into from

Conversation

DParkerGitlab
Copy link

axios has open CVEs for versions below 0.21.4. This project should use the latest patch version and not strictly require that version but allow future patch versions

PR Checklist

Please check if your PR fulfills the following requirements:

PR Type

What kind of change does this PR introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[x] Build related changes
[ ] CI related changes
[ ] Other... Please describe:

What is the current behavior?

Issue Number: #142
axios is pinned to 0.21.1 which has open CVEs. Downstream projects are forced to use this version which contains vulnerabilities.

What is the new behavior?

This does two things:

  1. Updates the version to 0.21.4
  2. Sets the semver notation to ^0.21.4 which will allow updates to new patch versions in the future without this repo needing to be updated.

Does this PR introduce a breaking change?

[ ] Yes
[x] No

Other information

axios has open CVEs for versions below 0.21.4. This project should use the latest patch version and not strictly require that version but allow future patch versions
@dknell
Copy link

dknell commented Sep 16, 2021

Can we get this reviewed and merged ASAP. This is critical for companies that need to stay within compliance in Snyk.

@kamilmysliwiec
Copy link
Member

Thanks for your contribution @DParkerGitlab and apologies for not looking at this sooner!

Sets the semver notation to ^0.21.4 which will allow updates to new patch versions in the future without this repo needing to be updated.

We decided to lock all internal dependencies of all NestJS packages (packages published under the @nestjs scope) to specific versions for security reasons. Normally, I'd have bumped the dep faster but I was on vacation last week! Sorry for the delay 🙏

Fixed in the latest version

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants