rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump axios override to 1.16.0 for security fixes

Browse Source 
Pulls fixes for the cluster of advisories filed against 1.15.0:
prototype-pollution gadgets in resolveConfig/mergeConfig, CRLF
injection in headers and multipart bodies, no_proxy bypass via
RFC 1122 loopback subnet and IP aliases, parseReviver tampering,
withXSRFToken cross-origin leakage, validateStatus auth bypass,
and AxiosURLSearchParams null-byte injection. Addressed across
axios 1.15.1, 1.15.2, and 1.16.0.

axios is only present as a transitive peer dep (ibm-cloud-sdk-core);
the override forces a single 1.16.0 resolution.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-05-05 17:29:09 +02:00
parent d0141c8dcf
commit 23bf204ae7
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package.json
View File

@@ -37,7 +37,7 @@
"@langchain/community": "^1.1.25",
"lodash": "^4.18.1",
"lodash-es": "^4.18.1",
"axios": "^1.15.0"
"axios": "^1.16.0"
},
"license": "MIT",
"packageManager": "npm@11.8.0",