Skip to content

Comments

ENG: Fixes Axios Security Issues and Fixes Example App to use Local Bad Magic build#110

Merged
TheNorthRemembers merged 2 commits intomainfrom
eng-axios-security
Sep 26, 2025
Merged

ENG: Fixes Axios Security Issues and Fixes Example App to use Local Bad Magic build#110
TheNorthRemembers merged 2 commits intomainfrom
eng-axios-security

Conversation

@TheNorthRemembers
Copy link
Collaborator

We had a few issues here

  • Axios was outdated in the yarn.lock for the example apps, and needed to be updated
  • The example app was broken because of using the latest published version and outdated types in dev. The example will now use the local build.
image image

version "0.24.0"
resolved "https://registry.yarnpkg.com/axios/-/axios-0.24.0.tgz#804e6fa1e4b9c5288501dd9dff56a7a0940d20d6"
integrity sha512-Q6cWsys88HoPgAaFAVUb0WpPk0O8iTeisR9IMqy9G8AbO4NlpVknrnQS03zzF9PGAWgO3cgletO3VjV/P7VztA==
axios@^1.8.2:
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this and the other Axios bumps below should clear the Highs 🙏

"private": true,
"dependencies": {
"badmagic": "latest",
"badmagic": "file:../",
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use the local build vs latest package publish

zlarsen
zlarsen previously approved these changes Sep 26, 2025
@socket-security
Copy link

socket-security bot commented Sep 26, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedscheduler@​0.23.21001007597100
Addedreact@​18.3.11001008597100
Addedreact-dom@​18.3.11001009297100

View full report

"chalk": "^5.3.0",
"cors": "^2.8.5",
"express": "^4.20.0"
"express": "^4.21.2"
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This gets rid of the path-to-regex alert

Copy link

@Scott-Christianson Scott-Christianson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

approve agaaaain

@zlarsen zlarsen self-requested a review September 26, 2025 16:57
@TheNorthRemembers TheNorthRemembers force-pushed the eng-axios-security branch 5 times, most recently from 55d7e63 to 511c13b Compare September 26, 2025 17:19
@TheNorthRemembers TheNorthRemembers merged commit 4a0c632 into main Sep 26, 2025
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants