Skip to content

fix(e2e-tests): Pin axios to 1.13.5 to avoid compromised 1.14.1#906

Merged
andreiborza merged 1 commit intomainfrom
ab/pin-axios
Mar 31, 2026
Merged

fix(e2e-tests): Pin axios to 1.13.5 to avoid compromised 1.14.1#906
andreiborza merged 1 commit intomainfrom
ab/pin-axios

Conversation

@andreiborza
Copy link
Copy Markdown
Member

axios 1.14.1 contains a supply chain attack via the plain-crypto-js dependency. Pin to 1.13.5 to prevent accidental upgrades.

See: https://x.com/feross/status/2038807290422370479

axios 1.14.1 contains a supply chain attack via the plain-crypto-js
dependency. Pin to 1.13.5 to prevent accidental upgrades.

See: https://x.com/feross/status/2038807290422370479
@github-actions
Copy link
Copy Markdown

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).


New Features ✨

  • Use crypto.randomUUID rather than uuid by timfish in #892

Bug Fixes 🐛

  • (e2e-tests) Pin axios to 1.13.5 to avoid compromised 1.14.1 by andreiborza in #906
  • Add missing webpack5 entrypoint in webpack-plugin by brunodccarvalho in #905

Internal Changes 🔧

  • Vite integration tests by timfish in #899
  • Webpack integration tests by timfish in #904
  • Isolate integration test package installs by timfish in #902
  • Pin GitHub Actions to full-length commit SHAs by joshuarli in #900
  • Rollup integration tests by timfish in #897
  • New integration tests by timfish in #896
  • Remove lerna by timfish in #895
  • Migrate to Vitest by timfish in #894

🤖 This preview updates automatically when you update the PR.

@andreiborza andreiborza enabled auto-merge (squash) March 31, 2026 06:16
@andreiborza andreiborza merged commit a0aefde into main Mar 31, 2026
55 of 56 checks passed
@andreiborza andreiborza deleted the ab/pin-axios branch March 31, 2026 07:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants