Skip to content

chore: Bump axios from 1.16.0 to 1.18.1#159

Merged
ernst-dev merged 1 commit into
mainfrom
dependabot/npm_and_yarn/axios-1.18.1
Jul 23, 2026
Merged

chore: Bump axios from 1.16.0 to 1.18.1#159
ernst-dev merged 1 commit into
mainfrom
dependabot/npm_and_yarn/axios-1.18.1

Conversation

@ernst-dev

Copy link
Copy Markdown
Member

Bumps axios from 1.16.0 to 1.18.1 to address multiple security vulnerabilities.

Lockfile-only change (transitive dependency; package-lock.json only). axios 1.18.x adds https-proxy-agent, so its agent-base/https-proxy-agent subtree entries are added.

Severity Advisory Summary
High GHSA-gcfj-64vw-6mp9 Node HTTP adapter can use inherited proxy after interceptor config cloning
Medium GHSA-f4gw-2p7v-4548 NO_PROXY bypass for 0.0.0.0 local addresses
Medium GHSA-xj6q-8x83-jv6g Prototype pollution auth subfields can inject Basic auth
  • Vulnerable versions: < 1.18.0Patched: 1.18.0 (bumped to 1.18.1)

Opened by roko-dependabot-handler on behalf of @ernst-dev to remediate Dependabot alerts that had no auto-generated fix.

@ernst-dev ernst-dev added the dependencies Pull requests that update a dependency file label Jul 23, 2026
@ernst-dev
ernst-dev requested a review from a team as a code owner July 23, 2026 11:54
@ernst-dev
ernst-dev requested review from georgylobko and removed request for a team July 23, 2026 11:54
@ernst-dev ernst-dev added the dependencies Pull requests that update a dependency file label Jul 23, 2026
@codecov

codecov Bot commented Jul 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (7300655) to head (eccc20b).

Additional details and impacted files
@@            Coverage Diff            @@
##              main      #159   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines           78        78           
  Branches        21        21           
=========================================
  Hits            78        78           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ernst-dev
ernst-dev added this pull request to the merge queue Jul 23, 2026
Merged via the queue into main with commit 26c0979 Jul 23, 2026
47 checks passed
@ernst-dev
ernst-dev deleted the dependabot/npm_and_yarn/axios-1.18.1 branch July 23, 2026 14:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants