Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor(dependencies): axios to 1.7.4 #2861

Merged
merged 1 commit into from
Aug 15, 2024
Merged

Conversation

golobitch
Copy link
Collaborator

Our builds are failing due to Trivy scanner. Trivy scanner actually found that our Axios version v1.6.8 has a vulnerability - CVE-2024-39338. This was fixed in version 1.7.4, hence, the upgrade.

fix #2860

Changes proposed in this pull request

  • Upgrade axios

Context

fixes #2860

Checklist

  • Related issues linked using fixes #number
  • Tests added/updated
  • Documentation added
  • Make sure that all checks pass
  • Bruno collection updated

Copy link

netlify bot commented Aug 14, 2024

Deploy Preview for brilliant-pasca-3e80ec canceled.

Name Link
🔨 Latest commit af7aa5e
🔍 Latest deploy log https://app.netlify.com/sites/brilliant-pasca-3e80ec/deploys/66bd1f95652d110008430a55

@github-actions github-actions bot added pkg: backend Changes in the backend package. pkg: frontend Changes in the frontend package. pkg: auth Changes in the GNAP auth package. labels Aug 14, 2024
Our builds are failing due to Trivy scanner. Trivy scanner actually found that our Axios version
v1.6.8 has a vulnerability - CVE-2024-39338. This was fixed in version 1.7.4, hence, the upgrade.

fix #2860
@golobitch golobitch force-pushed the feature/axios-upgrade branch from 6b63a8e to af7aa5e Compare August 14, 2024 21:20
@golobitch golobitch requested a review from BlairCurrey August 14, 2024 21:29
@golobitch golobitch self-assigned this Aug 14, 2024
Copy link
Contributor

@BlairCurrey BlairCurrey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder why renovate bot didntbump this... looks like there were plenty of releases over the past ~6 months since 1.6.8 came out.

https://github.com/interledger/rafiki/pulls?q=is%3Apr+author%3Aapp%2Frenovate++axios

@sabineschaller sabineschaller merged commit a2c44a5 into main Aug 15, 2024
42 checks passed
@sabineschaller sabineschaller deleted the feature/axios-upgrade branch August 15, 2024 07:18
sabineschaller pushed a commit that referenced this pull request Aug 15, 2024
Our builds are failing due to Trivy scanner. Trivy scanner actually found that our Axios version
v1.6.8 has a vulnerability - CVE-2024-39338. This was fixed in version 1.7.4, hence, the upgrade.

fix #2860
oana-lolea added a commit that referenced this pull request Jan 14, 2025
* feat(backend): make keys unique

* fix: only make keys unique per wallet address

* fix(frontend): It is ambiguous on what scale is the withdrawal and deposit input (#2817)

* fix(frontend): asset scale consistency in liquidity dialogs.

* Ensure asset scale consistency when displaying and withdrawing liquidity by adding asset info to the liquidity dialog component and updating the input handling in Rafiki Admin UI.
---------

Co-authored-by: Blair Currey <12960453+BlairCurrey@users.noreply.github.com>

* chore: sync docs and readmes (#2830)

* fix: getting the localenv docs and readme in sync

* chore: updated MASE screenshots

* chore: updating the code block language identifier to have consistent approach through the docs

* chore(deps): update dependency @apollo/client to ^3.11.2 (#2822)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* feat(frontend): ux improvements to liquidity dialog component (#2839)

* fixed(frontend) asset page now retains page scroll position.

* feat(frontend) added autofocus to liquidity dialog input

* feat(fronted) made eslint happy

* feat(docker): switch to alpine3.19 (#2842)

* feat(auth): build with alpine3.19

* feat(backend): build with alpine3.19

* feat(frontend): build with alpine3.19

* bump(localenv): docker image to alpine 3.19

* fix(auth): interact redirect (#2832)

* fix(auth): interact redirect

* fix(auth): session cookie not expiring in browser

* fix(auth): session expiration time unit

---------

Co-authored-by: Blair Currey <12960453+BlairCurrey@users.noreply.github.com>

* feat(interaction): return grantId (#2843)

* feat(auth): return granId for the grant lookup via interaction id

* test(auth): check grantId is returned for grant lookup via interaction id

* docs(openapi): auth return grantId for grant lookup via interaction id

* feat(outgoing-payment): add grantId to admin api (#2841)

* feat(backend): support for returning grantId when querying outgoing payment

When querying outgoing payment, either single one, or list of them via pagination, etc., it will be
possible to also get a grantId under which the outgoing

* test(outgoing-payment): check if grantId is returned

* docs(bruno): include grantId when fetching outgoing payment

* feat(auth): soft delete access tokens and grant accesses (#2837)

* feat(auth): set session expiry based on interaction expiry env (#2851)

* feat(localenv): span metrics generation (#2849)

* feat(localenv): add span metric generation

- adds configuration that generates span metrics from tempo traces
- can see new `traces_spanmetrics_bucket` etc. in local grafana dashboard

* feat(localenv): add gql resolver metric

* chore(localenv): give panel title

* chore(deps): update dependency @types/node to ^20.14.15 (#2838)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): update dependency @apollo/client to ^3.11.4 (#2845)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* feat(2737): add fees as metric for outgoing payment. (#2831)

* feat(2737): add fees as metric for outgoing payment.

* feat(2737): rename to payment_fees.

* feat(2737): test case updates.

* feat(2737): formatting.

* feat(2737): re-order test cases. Move fee collector.

* feat(2737): dashboard and doc updates.

* feat(2737): merged with main.

* feat(2737): review feedback applied from @JoblersTune.

* feat(2737): review feedback applied from @mkurapov.

* feat(2737): additional tests for covert of assets and rates.

* feat(2737): additional tests ensuring the increment counter was called.

* feat(2737): additional tests ensuring the increment counter was called.

* feat(2737): readme.

* refactor(dependencies): axios to 1.7.4 (#2861)

Our builds are failing due to Trivy scanner. Trivy scanner actually found that our Axios version
v1.6.8 has a vulnerability - CVE-2024-39338. This was fixed in version 1.7.4, hence, the upgrade.

fix #2860

* chore: add tests and better error handling

* chore: formatting

* fix: build

* fix: add camelcase quotes and make `up` async

* chore: keep latest version of key

* fix: formatting

* Added unrevoke wallet address key query resolver

* Updated migration and removed unrevoked resolver

* Checkstyle fix

* Updated walletAddressKey deletion migration, removed unnecessary test for walletAddressKey service

* Use ctid instead of createdAt to determine which rows are deleted

* Fixed typo

* Delete the least recent rows that have the same kid and are unrevoked

* Updated delete script

* Added revoked false back

* Delete only the active keys

---------

Co-authored-by: Emanuel Palestino <75344407+Emanuel-Palestino@users.noreply.github.com>
Co-authored-by: Blair Currey <12960453+BlairCurrey@users.noreply.github.com>
Co-authored-by: Sarah Jones <sarah38186@gmail.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Tadej Golobic <tadej@interledger.org>
Co-authored-by: Nathan Lie <lie4nathan@gmail.com>
Co-authored-by: Jason Bruwer <koekiebox@users.noreply.github.com>
Co-authored-by: Oana Lolea <oana.lolea@breakpointit.eu>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pkg: auth Changes in the GNAP auth package. pkg: backend Changes in the backend package. pkg: frontend Changes in the frontend package.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[BUG] CVE-2024-39338
3 participants