Skip to content

fix(deps): vuln axios (minor → 1.21.0) [example/package.json] #1525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
gh-worker-campaigns-3e9aa4 wants to merge 1 commit into from
Closed

fix(deps): vuln axios (minor → 1.21.0) [example/package.json] #1525

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion example/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
"@react-navigation/bottom-tabs": "^6.3.1",
"@react-navigation/native": "^6.1.18",
"@react-navigation/stack": "^6.2.1",
"axios": "1.20.0",
"axios": "1.21.0",

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the global Axios resolution too

The root package.json still forces every Axios request to 1.18.0 through its resolutions entry, so this workspace dependency remains on the vulnerable release despite declaring 1.21.0; the resulting lockfile confirms this by containing only an axios@npm:1.18.0 package entry. Update the global resolution and regenerate the lockfile so installs actually receive the security fix.

Useful? React with 👍 / 👎.

@datadog-datadog-us1-prod datadog-datadog-us1-prod Bot Nov 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Update the root Axios resolution so the upgrade takes effect

Yarn installs still resolve Axios to 1.18.0 because the root package.json overrides every Axios dependency with resolutions.axios. The lockfile also contains only Axios 1.18.0, so this declaration does not apply the intended security update. Update the root resolution and regenerate the lockfile to install 1.21.0.

React: 👍 useful · 👎 wrong · 😕 unclear · 👀 right, but not acting on it

What each reaction means
  • 👍 Useful: correct, and you're fixing it or will.
  • 👎 Wrong: the finding is incorrect, for example the bug can't happen or the code was misread.
  • 😕 Unclear: you can't tell what it means or why it matters.
  • 👀 Right, not acting: correct, but intended, out of scope for this PR, a known risk, or too minor.

🤖 Bits Code Review · Open Bits AI session

"react": "18.3.1",
"react-native": "0.76.9",
"react-native-crash-tester": "0.2.3",
Expand Down
32 changes: 16 additions & 16 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3221,8 +3221,8 @@ __metadata:
linkType: hard

"@npmcli/arborist@npm:^9.1.8":
version: 9.9.2
resolution: "@npmcli/arborist@npm:9.9.2"
version: 9.9.3
resolution: "@npmcli/arborist@npm:9.9.3"
dependencies:
"@gar/promise-retry": ^1.0.0
"@isaacs/string-locale-compare": ^1.1.0
Expand Down Expand Up @@ -3260,7 +3260,7 @@ __metadata:
walk-up-path: ^4.0.0
bin:
arborist: bin/index.js
checksum: f6f8e646db1c490f3a9623a972553607e038ed83cf5ad4edd3240b73774acfcdbdc739e5555cff20b79838d091767038db642d4c1a06bc3715968faaf98dfd6d
checksum: ab7dbd565bfc7787aa3a6830315ce7e817ec26c38aed65aeaba724a7800b9c7e60271b19d53df79684c63880255c3dfb831cec307c3a0a76632c5dd573ec7f53
languageName: node
linkType: hard

Expand Down Expand Up @@ -6798,15 +6798,15 @@ __metadata:
linkType: hard

"bin-links@npm:^6.0.0":
version: 6.0.2
resolution: "bin-links@npm:6.0.2"
version: 6.0.3
resolution: "bin-links@npm:6.0.3"
dependencies:
cmd-shim: ^8.0.0
npm-normalize-package-bin: ^5.0.0
proc-log: ^6.0.0
read-cmd-shim: ^6.0.0
write-file-atomic: ^7.0.0
checksum: 0a4b6d084f8e7073c2f5c03579d79b24ac492bd9cd3f8b723b65f724e707771caeb6c3e9aa54df782ea9f94bda741f8ae792bf945668fea88bc1f8a6c534ba05
checksum: d10a90354cc967cedbb04a23cefd7ff2f11b6d5dec6d90122ab3c5601991dff1bbd7fabd09cd51dae67a1391dc59d1db72f1f1c20b2130d372494c3405a083c9
languageName: node
linkType: hard

Expand Down Expand Up @@ -7088,9 +7088,9 @@ __metadata:
linkType: hard

"caniuse-lite@npm:^1.0.30001806":
version: 1.0.30001815
resolution: "caniuse-lite@npm:1.0.30001815"
checksum: eab81396e1dc5434c05ae105e91a8f1b9e1070d702a014ac7056ab6a3e1870f567efe387456d5cc087b4c7c83bc13e55292f0a066327cd668321ea739aefa2ed
version: 1.0.30001820
resolution: "caniuse-lite@npm:1.0.30001820"
checksum: ae129c8d6c46e908711da12435d90e3a5655e9925ab1c677f9fdf4bac1f1b7585f2ec2b7056dbe3959e672c8c28f7dadef56024b029192da63e1eb648e119bc2
languageName: node
linkType: hard

Expand Down Expand Up @@ -8046,7 +8046,7 @@ __metadata:
"@react-navigation/native": ^6.1.18
"@react-navigation/stack": ^6.2.1
"@rnx-kit/metro-resolver-symlinks": ^0.1.36
axios: 1.20.0
axios: 1.21.0
babel-plugin-module-resolver: ^4.0.0
patch-package: ^8.0.1
postinstall-postinstall: ^2.1.0
Expand Down Expand Up @@ -8566,9 +8566,9 @@ __metadata:
linkType: hard

"electron-to-chromium@npm:^1.5.393":
version: 1.5.452
resolution: "electron-to-chromium@npm:1.5.452"
checksum: 4855b93fa1e328afb013ad96d8f86bacd2148868795ce378204538d524f7021c5c259a279f68296f030f225caa6e428566538c551aecd3d3b96f884346f3a94e
version: 1.5.472
resolution: "electron-to-chromium@npm:1.5.472"
checksum: b9ba7d35fb624b184a763e4e42d47dce10dd8b4b33e80119536429e1adcf41dc5e897c9bc8ade856a154445aa1cf38bbf31b859d68255a18491b567c48b3537b
languageName: node
linkType: hard

Expand Down Expand Up @@ -13937,9 +13937,9 @@ __metadata:
linkType: hard

"node-releases@npm:^2.0.51":
version: 2.0.58
resolution: "node-releases@npm:2.0.58"
checksum: 37045b20bbdd9e3bd7103ada92601566c4ed8ec3d0270c4006a6c21a55acb167d21027e65a1cbf39ed64bb63c392bdc12c5a140e2366e1246656d6c0cf8554be
version: 2.0.63
resolution: "node-releases@npm:2.0.63"
checksum: b658ac8c68d065db783fa2484e0fddc0cdc9b7d89254a292a08c02ee565ddcf6c88915e371d334219aaecadd1f3379fe5ec68144144c5543f0dca0b4cf84112a
languageName: node
linkType: hard

Expand Down
Loading