Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix axios vulnerability #31

Merged
merged 1 commit into from
Jan 8, 2021
Merged

Fix axios vulnerability #31

merged 1 commit into from
Jan 8, 2021

Conversation

julianbei
Copy link
Contributor

Fixing the axios security vulnerability by upgrading the contentful libs.

 npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
# Run  npm install contentful@8.1.7  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Server-Side Request Forgery                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ axios                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ contentful                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ contentful > axios                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1594                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


# Run  npm update axios --depth 2  to resolve 1 vulnerability
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Server-Side Request Forgery                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ axios                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ contentful-management                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ contentful-management > axios                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1594                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


found 2 high severity vulnerabilities in 257 scanned packages
  run `npm audit fix` to fix 1 of them.
  1 vulnerability requires semver-major dependency updates.

@julianbei
Copy link
Contributor Author

Hi @lotas

First of all, thanks for your work and effort delivering this awesome lib to the opensource community.

will you merge this at some point?
We have a blocked CI because of the failing npm audit.
Cheers and thanks for all your work its great keep it up!
Julian

@lotas lotas merged commit d0872ba into lotas:master Jan 8, 2021
@lotas
Copy link
Owner

lotas commented Jan 8, 2021

@julianbei sure, forgot to merge it same day. Will make a new release also now.
Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants