Skip to content

Conversation

@whitelisab
Copy link
Contributor

Summary

Addresses two issues:

  • Explicitly bump axios version to stable version to address security vulnerabilities
  • Add a shared .npmrc config to add npm as the registry for @contentful scoped packages

Description

The package-lock.json file was already updated to 12.2.2 for axios, this now explicitly sets it in the package.json file. Also adding the .npmrc to ensure that packages are installed from the correct registry.

Motivation and Context

Addresses: #2567

Todos

  • Implemented feature
  • Feature with pending implementation

Screenshots (if appropriate):

@whitelisab whitelisab requested a review from a team as a code owner September 26, 2025 16:59
*.dockerignore

# NPM config
.npmrc
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm, this could be trouble if someone puts one of their npmrc files that has credentials in them. Im not sure what else to do though so more of just a thought.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, it's a good thought. We do have a shared .npmrc in several of our other public repos (like contentful-migration), so I'm ok making the change here and I think something to just be mindful of.

@whitelisab whitelisab merged commit 3f2fc25 into master Sep 26, 2025
7 checks passed
@whitelisab whitelisab deleted the fix/dx-422-dx-423 branch September 26, 2025 17:20
@contentful-automation
Copy link
Contributor

🎉 This PR is included in version 11.8.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants