Update Dashboard dependency on Axios #3625
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
webbnh
added
Dashboard
dbutenhof
approved these changes
Sep 25, 2024
There was a problem hiding this comment.
Yeah, in theory, I think both ^0.26.1 and ^0.28.0 should resolve to "the latest 0.*" version and we're just keeping it from bumping to the (theoretically incompatible) "1.0". In practice, both JavaScript and Python packages have a less than reliable reputation with regard to compatibility even across minor patch versions; but I also agree that at this point dumping the Dependabot warnings is a great goal and if anyone does need to build a new dashboard package they can worry about it then if there's a problem. 😁
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Addresses CVE-2023-45857 (and makes Dependabot shut up).
webbnh
force-pushed
the
axios-update
branch
from
c0875a6
to
d23985c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
After ten months, I finally got tired of the Dependabot warnings, so here's a PR to update the Dashboard's dependency on
axiosto at least the version which addresses CVE-2023-45857. (See also the GitHub advisory.)I assume (boldly) that when we actually build the Dashboard, we pull a safe version of
axios(since thepackage.jsonfile is specifying only the minimum -- not the "locked" -- version), so I don't think this issue actually affects us (and, even if it did, we run the Dashboard in limited quantities in what I think is a safe environment...), so I didn't bother to actually test this change. (For me, the definition of "working" will be the absence of Dependabot warnings....)