-
-
Notifications
You must be signed in to change notification settings - Fork 41
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(kitsu): update dependency axios to v0.28.1 to address CVE-2023-45857 #964
Conversation
74e35bf
to
95cfea6
Compare
2485367
to
bf41b9e
Compare
We might be able to remove this duplication by setting it in the axios.create object definition and avoid adding a utility function to the constructor |
After looking at it more closely it looks like axios 0.28.0 has a regression and isn't respecting config if |
I've subscribed to that issue, will likely leave this PR open until that backporting issue is resolved to avoid a potentially breaking change in serialisation when upgrading to the 0.28 major. |
Unfortunately doesn't seem like there's been any progress on that upstream issue yet :( |
bf41b9e
to
9b72793
Compare
Code Climate has analyzed commit 9b72793 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (100% is the threshold). This pull request will bring the total coverage in the repository to 100.0% (0.0% change). View more on Code Climate. |
Is this ready for review @justin-tay? |
This is now ready for review. Thanks! |
Released as 10.1.5 |
Closes #978
This bumps axios to 0.28.1 due to Axios Cross-Site Request Forgery Vulnerability.
The
size-limit
needed to be adjusted from13 kb
to14 kb
The
paramsSerializer
configuration needs to be an object withserialize
set to the function.