Conversation
Bumps [axios](https://github.com/axios/axios) from 1.7.9 to 1.8.2. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.9...v1.8.2) --- updated-dependencies: - dependency-name: axios dependency-version: 1.8.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bump axios from 1.7.9 to 1.8.2
|
|
WalkthroughReplace TestFairy distribution in the React Native CI workflow with Firebase App Distribution for Android and iOS; add Firebase CLI setup using the Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant GH as GitHub Actions
participant FBCLI as Firebase CLI
participant FBA as Firebase App Distribution
rect rgb(235,245,255)
note over GH: Build artifacts (APK/IPA) produced and uploaded as GitHub artifacts
end
rect rgb(245,255,235)
GH->>FBCLI: Setup Firebase CLI (w9jds/setup-firebase@main)<br/>Auth with `firebase_token`
GH->>FBA: firebase appdistribution:distribute (Android APK)<br/>app: $FIREBASE_RESP_ANDROID_APP_ID, group: testers
FBA-->>GH: Distribution result (Android)
GH->>FBA: firebase appdistribution:distribute (iOS IPA)<br/>app: $FIREBASE_RESP_IOS_APP_ID, group: testers
FBA-->>GH: Distribution result (iOS)
end
note over GH: Release-notes and artifact upload steps remain unchanged
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. 📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 💡 Knowledge Base configuration:
You can enable these sources in your CodeRabbit configuration. ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (2)
.github/workflows/react-native-cicd.yml(1 hunks)package.json(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: test
- GitHub Check: Analyze (javascript-typescript)
| - name: 📦 Setup Firebase CLI | ||
| uses: w9jds/setup-firebase@main | ||
| with: | ||
| api-key: ${{ secrets.TESTFAIRY_API_KEY }} | ||
| file: ./ResgridRespond-prod.apk | ||
| groups: Resgrid | ||
| notify: on | ||
| tools-version: 11.9.0 | ||
| firebase_token: ${{ secrets.FIREBASE_TOKEN }} | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the Firebase setup action to a tag or SHA (avoid @main for supply-chain safety).
Inputs tools-version and firebase_token are valid for this action, but using @main is mutable. Prefer a tagged release (e.g., v1.0.0) or a commit SHA. (github.com)
- - name: 📦 Setup Firebase CLI
- uses: w9jds/setup-firebase@main
+ - name: 📦 Setup Firebase CLI
+ uses: w9jds/setup-firebase@v1.0.0
with:
tools-version: 11.9.0
firebase_token: ${{ secrets.FIREBASE_TOKEN }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: 📦 Setup Firebase CLI | |
| uses: w9jds/setup-firebase@main | |
| with: | |
| api-key: ${{ secrets.TESTFAIRY_API_KEY }} | |
| file: ./ResgridRespond-prod.apk | |
| groups: Resgrid | |
| notify: on | |
| tools-version: 11.9.0 | |
| firebase_token: ${{ secrets.FIREBASE_TOKEN }} | |
| - name: 📦 Setup Firebase CLI | |
| uses: w9jds/setup-firebase@v1.0.0 | |
| with: | |
| tools-version: 11.9.0 | |
| firebase_token: ${{ secrets.FIREBASE_TOKEN }} |
🤖 Prompt for AI Agents
.github/workflows/react-native-cicd.yml lines 279-284: the workflow uses the
mutable reference w9jds/setup-firebase@main which is unsafe for supply-chain
integrity; update the uses line to pin the action to a specific released tag or
commit SHA (for example replace @main with a stable tag like @v1.0.0 or an exact
commit SHA), commit the change, and optionally add a comment noting the chosen
tag/SHA and link to the action's releases so future maintainers can update
intentionally.
| - name: 📦 Upload Android artifact to Firebase App Distribution | ||
| if: (matrix.platform == 'android') | ||
| run: | | ||
| firebase appdistribution:distribute ./ResgridRespond-prod.apk --app ${{ secrets.FIREBASE_RESP_ANDROID_APP_ID }} --groups "testers" | ||
|
|
||
| - name: 📦 Upload iOS artifact to Firebase App Distribution | ||
| if: (matrix.platform == 'ios') | ||
| run: | | ||
| firebase appdistribution:distribute ./ResgridRespond-ios-adhoc.ipa --app ${{ secrets.FIREBASE_RESP_IOS_APP_ID }} --groups "testers" | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Gate Firebase distribution by buildType and attach release notes.
As written, these steps run on every matrix platform regardless of which artifact was built; manual runs like buildType=dev will fail because the prod files don’t exist. Also, it’s useful to include release notes in Firebase. The CLI supports --groups and --release-notes/--release-notes-file. (firebase.google.com)
Use the same build-type guards you used for the build steps and pass succinct notes inline:
- - name: 📦 Upload Android artifact to Firebase App Distribution
- if: (matrix.platform == 'android')
+ - name: 📦 Upload Android artifact to Firebase App Distribution
+ if: (matrix.platform == 'android' && (github.event.inputs.buildType == 'all' || github.event_name == 'push' || github.event.inputs.buildType == 'prod-apk'))
run: |
- firebase appdistribution:distribute ./ResgridRespond-prod.apk --app ${{ secrets.FIREBASE_RESP_ANDROID_APP_ID }} --groups "testers"
+ firebase appdistribution:distribute ./ResgridRespond-prod.apk \
+ --app ${{ secrets.FIREBASE_RESP_ANDROID_APP_ID }} \
+ --groups "testers" \
+ --release-notes "RN Android 10.${{ github.run_number }} • ${{ github.sha }}"
- - name: 📦 Upload iOS artifact to Firebase App Distribution
- if: (matrix.platform == 'ios')
+ - name: 📦 Upload iOS artifact to Firebase App Distribution
+ if: (matrix.platform == 'ios' && (github.event.inputs.buildType == 'all' || github.event_name == 'push' || github.event.inputs.buildType == 'ios-adhoc'))
run: |
- firebase appdistribution:distribute ./ResgridRespond-ios-adhoc.ipa --app ${{ secrets.FIREBASE_RESP_IOS_APP_ID }} --groups "testers"
+ firebase appdistribution:distribute ./ResgridRespond-ios-adhoc.ipa \
+ --app ${{ secrets.FIREBASE_RESP_IOS_APP_ID }} \
+ --groups "testers" \
+ --release-notes "RN iOS 10.${{ github.run_number }} • ${{ github.sha }}"Optional: If you prefer richer notes, generate RELEASE_NOTES.md earlier in the job and swap --release-notes for --release-notes-file RELEASE_NOTES.md. (firebase.google.com)
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: 📦 Upload Android artifact to Firebase App Distribution | |
| if: (matrix.platform == 'android') | |
| run: | | |
| firebase appdistribution:distribute ./ResgridRespond-prod.apk --app ${{ secrets.FIREBASE_RESP_ANDROID_APP_ID }} --groups "testers" | |
| - name: 📦 Upload iOS artifact to Firebase App Distribution | |
| if: (matrix.platform == 'ios') | |
| run: | | |
| firebase appdistribution:distribute ./ResgridRespond-ios-adhoc.ipa --app ${{ secrets.FIREBASE_RESP_IOS_APP_ID }} --groups "testers" | |
| - name: 📦 Upload Android artifact to Firebase App Distribution | |
| if: (matrix.platform == 'android' && (github.event.inputs.buildType == 'all' || github.event_name == 'push' || github.event.inputs.buildType == 'prod-apk')) | |
| run: | | |
| firebase appdistribution:distribute ./ResgridRespond-prod.apk \ | |
| --app ${{ secrets.FIREBASE_RESP_ANDROID_APP_ID }} \ | |
| --groups "testers" \ | |
| --release-notes "RN Android 10.${{ github.run_number }} • ${{ github.sha }}" | |
| - name: 📦 Upload iOS artifact to Firebase App Distribution | |
| if: (matrix.platform == 'ios' && (github.event.inputs.buildType == 'all' || github.event_name == 'push' || github.event.inputs.buildType == 'ios-adhoc')) | |
| run: | | |
| firebase appdistribution:distribute ./ResgridRespond-ios-adhoc.ipa \ | |
| --app ${{ secrets.FIREBASE_RESP_IOS_APP_ID }} \ | |
| --groups "testers" \ | |
| --release-notes "RN iOS 10.${{ github.run_number }} • ${{ github.sha }}" |
🤖 Prompt for AI Agents
.github/workflows/react-native-cicd.yml lines 285-294: the Firebase upload steps
run regardless of buildType and will fail when prod artifacts aren't present;
update each step's if-condition to gate on both platform and buildType (e.g.,
if: matrix.platform == 'android' && matrix.buildType == 'prod') so they only run
when the matching artifact was produced, and add a --release-notes argument (or
--release-notes-file RELEASE_NOTES.md if you generate that file earlier in the
job) to the firebase appdistribution:distribute commands to include succinct
release notes.
package.json
Outdated
| "@tanstack/react-query": "~5.52.1", | ||
| "app-icon-badge": "^0.1.2", | ||
| "axios": "~1.7.5", | ||
| "axios": "~1.8.2", |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Security: bump axios baseline to ≥1.8.3 (tilde on 1.8.2 can leave you on a vulnerable patch).
1.8.2 fixes CVE-2025-27152 (SSRF/credential leakage), but a follow-up fix recommends 1.8.3+ to address a bypass; set the floor to 1.8.3 to be safe and regenerate the lockfile. (nvd.nist.gov, security.snyk.io, advisories.gitlab.com)
Apply one of these minimal diffs:
- "axios": "~1.8.2",
+ "axios": "~1.8.3",Or, if you’re comfortable with minor bumps:
- "axios": "~1.8.2",
+ "axios": "^1.11.0",Run to confirm the resolved version in yarn.lock and catch older transitive axios versions:
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if fd yarn.lock >/dev/null 2>&1; then
rg -nP '"axios"\s*:\s*"[^"]+"' yarn.lock || true
rg -nP 'axios@' yarn.lock -n -C2
fi
# Show installed version from node_modules if present
node -e 'try{console.log(require("./node_modules/axios/package.json").version)}catch(e){process.exit(0)}'Length of output: 430
Security: Upgrade axios to ≥1.8.3 to mitigate CVE-2025-27152 bypass
The lockfile still shows axios@1.8.2, so the package.json bump hasn’t been applied yet. Please update and regenerate your lockfile to eliminate the vulnerable patch.
• In package.json (line 94), change:
- "axios": "~1.8.2",
+ "axios": "~1.8.3",– or, for a broader minor bump:
- "axios": "~1.8.2",
+ "axios": "^1.11.0",• After updating, run yarn install (or npm install) and verify with:
grep -nP '"axios"\s*:\s*"' yarn.lock
rg -nP 'axios@' yarn.lock -n -C2
node -e 'console.log(require("./node_modules/axios/package.json").version)'Ensure no older transitive references remain, then commit the updated lockfile.
🤖 Prompt for AI Agents
package.json lines 94-94: axios is pinned to ~1.8.2 which is vulnerable; update
the dependency to at least 1.8.3 (or a newer safe minor/major), run your package
manager to regenerate the lockfile (yarn install or npm install), verify the
installed axios version and that no transitive references to 1.8.2 remain (use
the suggested grep/rg/node checks or your package manager’s audit commands), and
commit the updated package.json and regenerated lockfile.
|
Approve |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
2 participants
Summary by CodeRabbit