[Snyk] Upgrade axios from 0.25.0 to 1.7.4

[aravindvnair99]

Snyk has created this PR to upgrade axios from 0.25.0 to 1.7.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

• The recommended version is 48 versions ahead of your current version.

• The recommended version was released on 21 days ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Cross-site Request Forgery (CSRF) SNYK-JS-AXIOS-6032459	676	Proof of Concept
	Improper Input Validation SNYK-JS-FOLLOWREDIRECTS-6141137	676	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-6124857	676	Proof of Concept
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	676	Proof of Concept

Release notes

Package name: axios

• 1.7.4 - 2024-08-13
  

  Release notes:

  Bug Fixes

  • sec: CVE-2024-39338 (#6539) (#6543) (6b6b605)
  • sec: disregard protocol-relative URL to remediate SSRF (#6539) (07a661a)

  Contributors to this release

  • Lev Pachmanov
  • Đỗ Trọng Hải
• 1.7.3 - 2024-08-01
  

  Release notes:

  Bug Fixes

  • adapter: fix progress event emitting; (#6518) (e3c76fc)
  • fetch: fix withCredentials request config (#6505) (85d4d0e)
  • xhr: return original config on errors from XHR adapter (#6515) (8966ee7)

  Contributors to this release

  • Dmitriy Mozgovoy
  • Valerii Sidorenko
  • prianYu
• 1.7.2 - 2024-05-21
  

  Release notes:

  Bug Fixes

  • fetch: enhance fetch API detection; (#6413) (4f79aef)

  Contributors to this release

  • Dmitriy Mozgovoy
• 1.7.1 - 2024-05-20
  

  Release notes:

  Bug Fixes

  • fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#6410) (733f15f)

  Contributors to this release

  • Dmitriy Mozgovoy
• 1.7.0 - 2024-05-19
  

  Release notes:

  Features

  • adapter: add fetch adapter; (#6371) (a3ff99b)

  Bug Fixes

  • core/axios: handle un-writable error stack (#6362) (81e0455)

  Contributors to this release

  • Dmitriy Mozgovoy
  • Jay
  • Alexandre ABRIOUX
• 1.7.0-beta.2 - 2024-05-19
  

  Release notes:

  Bug Fixes

  • fetch: capitalize HTTP method names; (#6395) (ad3174a)
  • fetch: fix & optimize progress capturing for cases when the request data has a nullish value or zero data length (#6400) (95a3e8e)
  • fetch: fix headers getting from a stream response; (#6401) (870e0a7)

  Contributors to this release

  • Dmitriy Mozgovoy
• 1.7.0-beta.1 - 2024-05-07
  

  Release notes:

  Bug Fixes

  • core/axios: handle un-writable error stack (#6362) (81e0455)
  • fetch: fix cases when ReadableStream or Response.body are not available; (#6377) (d1d359d)
  • fetch: treat fetch-related TypeError as an AxiosError.ERR_NETWORK error; (#6380) (bb5f9a5)

  Contributors to this release

  • Alexandre ABRIOUX
  • Dmitriy Mozgovoy

  Install

  npm i axios@next
  

• 1.7.0-beta.0 - 2024-04-28
  

  Release notes:

  Features

  • adapter: add fetch adapter; (#6371) (a3ff99b)

  Contributors to this release

  • Dmitriy Mozgovoy
  • Jay

  Install

  npm i axios@next
  

• 1.6.8 - 2024-03-15
  

  Release notes:

  Bug Fixes

  • AxiosHeaders: fix AxiosHeaders conversion to an object during config merging (#6243) (2656612)
  • import: use named export for EventEmitter; (7320430)
  • vulnerability: update follow-redirects to 1.15.6 (#6300) (8786e0f)

  Contributors to this release

  • Jay
  • Dmitriy Mozgovoy
  • Mitchell
  • Emmanuel
  • Lucas Keller
  • Aditya Mogili
  • Miroslav Petrov
• 1.6.7 - 2024-01-25
• 1.6.6 - 2024-01-24
• 1.6.5 - 2024-01-05
• 1.6.4 - 2024-01-03
• 1.6.3 - 2023-12-26
• 1.6.2 - 2023-11-14
• 1.6.1 - 2023-11-08
• 1.6.0 - 2023-10-26
• 1.5.1 - 2023-09-26
• 1.5.0 - 2023-08-26
• 1.4.0 - 2023-04-27
• 1.3.6 - 2023-04-19
• 1.3.5 - 2023-04-05
• 1.3.4 - 2023-02-22
• 1.3.3 - 2023-02-13
• 1.3.2 - 2023-02-03
• 1.3.1 - 2023-02-01
• 1.3.0 - 2023-01-31
• 1.2.6 - 2023-01-28
• 1.2.5 - 2023-01-26
• 1.2.4 - 2023-01-24
• 1.2.3 - 2023-01-17
• 1.2.2 - 2022-12-29
• 1.2.1 - 2022-12-05
• 1.2.0 - 2022-11-22
• 1.2.0-alpha.1 - 2022-11-10
• 1.1.3 - 2022-10-15
• 1.1.2 - 2022-10-07
• 1.1.1 - 2022-10-07
• 1.1.0 - 2022-10-06
• 1.0.0 - 2022-10-04
• 1.0.0-alpha.1 - 2022-05-31
• 0.28.1 - 2024-03-28
  

  Release notes:

  Release notes:

  Bug Fixes

  • fix(backport): custom params serializer support (#6263)
  • fix(backport): uncaught ReferenceError req is not defined (#6307)
• 0.28.0 - 2024-02-12
• 0.27.2 - 2022-04-27
• 0.27.1 - 2022-04-26
• 0.27.0 - 2022-04-25
• 0.26.1 - 2022-03-09
• 0.26.0 - 2022-02-13
• 0.25.0 - 2022-01-18

from axios GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[guardrails]

⚠️ We detected 7 security issues in this pull request:

Insecure File Management (1)

Severity	Details	Docs
High	Title: Path Traversal from user input Spot-the-Hole/functions/index.js Line 562 in a06ce33 path.join(os.tmpdir(), path.basename(req.files.file[0].fieldname)),	📚

More info on how to fix Insecure File Management in JavaScript.

---

Insecure Use of Crypto (1)

Severity	Details	Docs
Medium	Title: Insecure use of random generator Spot-the-Hole/functions/index.js Line 204 in a06ce33 result += characters.charAt(Math.floor(Math.random() * charactersLength));	📚

More info on how to fix Insecure Use of Crypto in JavaScript.

---

Vulnerable Libraries (5)

Severity	Details
Critical	pkg:npm/@tensorflow/tfjs-node@3.14.0 upgrade to: > 3.14.0
High	pkg:npm/firebase-functions@4.2.1 upgrade to: > 4.2.1
Critical	pkg:npm/firebase-admin@11.3.0 upgrade to: > 11.3.0
N/A	pkg:npm/ejs@3.1.7 upgrade to: 3.1.10
High	pkg:npm/busboy@0.3.1 upgrade to: > 0.3.1

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[stale]

Automatically marked as stale due to lack of recent activity. Will be closed if no further activity occurs. Thank you for your contributions.

[stale]

Automatically closed due to lack of recent activity. Tag @aravindvnair99 to reopen. Thank you for your contributions.