Skip to content

Conversation

@aikido-autofix
Copy link

@aikido-autofix aikido-autofix bot commented Dec 6, 2025

Upgrading axios, tsup to address vulnerabilities. This update contains breaking changes.

2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2025-58754
HIGH
Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a...
AIKIDO-2025-10811
LOW
Affected versions of this package are vulnerable to DOM Clobbering due to insufficient validation of script tags in the URL resolution logic. The getImportMetaUrl function insecurely relies on document.currentScript and document.baseURI without proper sanitization, allowing attackers to inject...
⚠️ Changelog indicates breaking changes.

Potential breaking changes by upgrading axios from version 1.11.0 to 1.12.0 (CHANGELOG)

Version Description
1.12.0
params: '[' and ']' characters are now URL encoded in parameters, whereas they were previously excluded from encoding

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant