Bump axios from 1.5.0 to 1.6.4

[semgrep-box-scans]

Summary

Upgrades axios from 1.5.0 to 1.6.4.

Vulnerability details

mferdinand@box.com requested this Autofix PR for this finding.

Affected versions of this package are vulnerable to Prototype Pollution via the formDataToJSON function.

References: axios/axios@3c0c11c,axios/axios#6167,https://github.com/axios/axios/releases/tag/v1.6.4

Upgrade guidance

✨ Semgrep thinks this is safe to upgrade ✅

3 functions in use unchanged
axios.create
• src/postmanAPI.js:8
• src/postmanAPI.js:61
• src/postmanAPI.js:123
• src/postmanAPI.js:187
axios.put
• src/OldDeployBulk.js:25
• src/OldDeployBulk.js:38
axios
• src/OldDeployBulk.js:15
• src/OldDeployBulk.js:25
• src/OldDeployBulk.js:38

axios references

Release notes

Sourced from axios's releases.

Release v1.6.4

Release notes:

Bug Fixes

• security: fixed formToJSON prototype pollution vulnerability; (#6167) (3c0c11c)
• security: fixed security vulnerability in follow-redirects (#6163) (75af1cd)

Contributors to this release

• Jay
• Dmitriy Mozgovoy
• Guy Nesher

Release v1.6.3

Release notes:

Bug Fixes

• Regular Expression Denial of Service (ReDoS) (#6132) (5e7ad38)

Contributors to this release

• Jay
• Willian Agostini
• Dmitriy Mozgovoy

Release v1.6.2

Release notes:

Features

• withXSRFToken: added withXSRFToken option as a workaround to achieve the old withCredentials behavior; (#6046) (cff9967)

PRs

• feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #6046 )

📢 This PR added 'withXSRFToken' option as a replacement for old withCredentials behaviour. 
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.

Contributors to this release

• Dmitriy Mozgovoy
• Ng Choon Khon (CK)
• Muhammad Noman

Release v1.6.1

Release notes:

Bug Fixes

... (truncated)

Changelog

Sourced from axios's changelog.

1.6.4 (2024-01-03)

Bug Fixes

• security: fixed formToJSON prototype pollution vulnerability; (#6167) (3c0c11c)
• security: fixed security vulnerability in follow-redirects (#6163) (75af1cd)

Contributors to this release

• Jay
• Dmitriy Mozgovoy
• Guy Nesher

1.6.3 (2023-12-26)

Bug Fixes

• Regular Expression Denial of Service (ReDoS) (#6132) (5e7ad38)

Contributors to this release

• Jay
• Willian Agostini
• Dmitriy Mozgovoy

1.6.2 (2023-11-14)

Features

• withXSRFToken: added withXSRFToken option as a workaround to achieve the old withCredentials behavior; (#6046) (cff9967)

PRs

• feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #6046 )

📢 This PR added 'withXSRFToken' option as a replacement for old withCredentials behaviour.
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.

Contributors to this release

• Dmitriy Mozgovoy
• Ng Choon Khon (CK)
• Muhammad Noman

1.6.1 (2023-11-08)

... (truncated)

Commits

• 8790b8e chore(release): v1.6.4 (#6173)
• 0ad520d chore(ci): fix notify action; (#6172)
• 3c0c11c fix(security): fixed formToJSON prototype pollution vulnerability; (#6167)
• 75af1cd fix(security): fixed security vulnerability in follow-redirects (#6163)
• 90864b3 docs: update logos
• 1542719 docs: updated headline sponsors
• b15b918 chore(release): v1.6.3 (#6151)
• b76cce0 chore(ci): added branches filter for notify action; (#6084)
• 5e7ad38 fix: Regular Expression Denial of Service (ReDoS) (#6132)
• 8befb86 docs: update alloy link (#6145)
• Additional commits viewable in compare view

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​axios@​1.5.0 ⏵ 1.6.4				+2

View full report