security: upgrade axios to fix CVE-2021-3749

[oldhill]

Summary

Upgrade axios to fix CVE-2021-3749

Testing Plan

After upgrade, yarn audit shows no high severity vulnerabilities

Breaking Change

[ ] Yes
[x] No

No breaking changes in this upgrade according to the axios release notes: https://github.com/axios/axios/releases

testnet graffiti / username

oldhill0x12345

[NullSoldier]

I'll test this manually and we can get it in. paged-request is the only reason we need that resolves. We should submit a PR to https://github.com/jonschlinkert/paged-request/blob/master/package.json as well

[oldhill]

✅ upstream PR opened: jonschlinkert/paged-request#6

[NullSoldier]

Lint is failing here, I think the PR needs to be rebased.

Also this introduces a warning that I don't know what to do about, because it's right that paged-request is now using an invalid library version but the security alert says not to use the old one, so.

warning Resolution field "axios@0.22.0" is incompatible with requested version "axios@^0.21.1"

[NullSoldier]

I closed the PR by accident, reopened.

[NullSoldier]

I rebased the PR.

[oldhill]

@NullSoldier that rebase doesn't look like it worked, I am guessing bc my branch is on a fork- changed files on this PR are now just a vers bump https://github.com/iron-fish/ironfish/pull/874/files

[oldhill]

Here is my upgrade commit that was lost in the force push of master: 66694f5

[oldhill]

Lint is failing here, I think the PR needs to be rebased.

Also this introduces a warning that I don't know what to do about, because it's right that paged-request is now using an invalid library version but the security alert says not to use the old one, so.

warning Resolution field "axios@0.22.0" is incompatible with requested version "axios@^0.21.1"

The CVE is patched in version 0.21.2 of axios - I can upgrade to that version instead to get rid of this warning, since axios@^0.21.1 should be compatible with all 0.21.xx versions

[oldhill]

Just pushed a change to upgrade to a compatible point release of axios this warning should be solved now
warning Resolution field "axios@0.22.0" is incompatible with requested version "axios@^0.21.1"

[NullSoldier]

Ok approved, it's merging now! Sorry about the borked rebase.

[oldhill]

Awesome thank you!