[Snyk] Upgrade axios from 0.20.0 to 0.21.1 #65

snyk-bot · 2021-08-27T22:05:59Z

Snyk has created this PR to upgrade axios from 0.20.0 to 0.21.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 2 versions ahead of your current version.
The recommended version was released 8 months ago, on 2020-12-22.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	616/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.9	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: axios

0.21.1 - 2020-12-22
0.21.1 (December 21, 2020)

Fixes and Functionality:
- Hotfix: Prevent SSRF (#3410)
- Protocol not parsed when setting proxy config from env vars (#3070)
- Updating axios in types to be lower case (#2797)
- Adding a type guard for AxiosError (#2949)
Internal and Tests:
- Remove the skipping of the socket http test (#3364)
- Use different socket for Win32 test (#3375)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
- Daniel Lopretto timemachine3030@users.noreply.github.com
- Jason Kwok JasonHK@users.noreply.github.com
- Jay jasonsaayman@gmail.com
- Jonathan Foster jonathan@jonathanfoster.io
- Remco Haszing remcohaszing@gmail.com
- Xianming Zhong chinesedfan@qq.com
0.21.0 - 2020-10-23
0.21.0 (October 23, 2020)

Fixes and Functionality:
- Fixing requestHeaders.Authorization (#3287)
- Fixing node types (#3237)
- Fixing axios.delete ignores config.data (#3282)
- Revert "Fixing overwrite Blob/File type as Content-Type in browser. (#1773)" (#3289)
- Fixing an issue that type 'null' and 'undefined' is not assignable to validateStatus when typescript strict option is enabled (#3200)
Internal and Tests:
- Lock travis to not use node v15 (#3361)
Documentation:
- Fixing simple typo, existant -> existent (#3252)
- Fixing typos (#3309)
Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:
- Allan Cruz 57270969+Allanbcruz@users.noreply.github.com
- George Cheng Gerhut@GMail.com
- Jay jasonsaayman@gmail.com
- Kevin Kirsche Kev.Kirsche+GitHub@gmail.com
- Remco Haszing remcohaszing@gmail.com
- Taemin Shin cprayer13@gmail.com
- Tim Gates tim.gates@iress.com
- Xianming Zhong chinesedfan@qq.com
0.20.0 - 2020-08-21
Release of 0.20.0-pre as a full release with no other changes.

from axios GitHub release notes

Commit messages

Package name: axios

a64050a Releasing 0.21.1
d57cd97 Updating changelog for 0.21.1 release
8b0f373 Use different socket for Win32 test (#3375)
e426910 Protocol not parsed when setting proxy config from env vars (#3070)
c7329fe Hotfix: Prevent SSRF (#3410)
f472e5d Adding a type guard for `AxiosError` (#2949)
7688255 Remove the skipping of the `socket` http test (#3364)
820fe6e Updating axios in types to be lower case (#2797)
94ca24b Releasing 0.21.0
2130a0c Updating changelog for 0.21.0 release
fbdc150 Lock travis to not use node v15 (#3361)
3a8b87d Fixing an issue that type 'null' and 'undefined' is not assignable to validateStatus when typescript strict option is enabled (#3200)
9a78465 Revert "Fixing overwrite Blob/File type as Content-Type in browser. (#1773)" (#3289)
6d05b96 Fix typos (#3309)
fa36737 fix axios.delete ignores config.data (#3282)
b7e954e Fixing node types (#3237)
04d45f2 Fixing requestHeaders.Authorization (#3287)
e8c6e19 docs: Fix simple typo, existant -> existent (#3252)