Update dependency axios to v1.6.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
axios (source)	1.3.6 -> 1.6.0

Test plan: CI should pass with updated dependencies. No review required: this is an automated dependency update PR.

Test plan: CI should pass with updated dependencies.

GitHub Vulnerability Alerts

CVE-2023-45857

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

---

Release Notes

axios/axios (axios)

v1.6.0

Compare Source

Bug Fixes

• CSRF: fixed CSRF vulnerability CVE-2023-45857 (#​6028) (96ee232)
• dns: fixed lookup function decorator to work properly in node v20; (#​6011) (5aaff53)
• types: fix AxiosHeaders types; (#​5931) (a1c8ad0)

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

Contributors to this release

• Dmitriy Mozgovoy
• Valentin Panov
• Rinku Chaudhari

1.5.1 (2023-09-26)

Bug Fixes

• adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
• formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
• headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
• types: removed duplicated code (9e62056)

Contributors to this release

• Dmitriy Mozgovoy
• David Dallas
• Sean Sattler
• Mustafa Ateş Uzun
• Przemyslaw Motacki
• Michael Di Prisco

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

v1.5.1

Compare Source

Bug Fixes

• adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
• formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
• headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
• types: removed duplicated code (9e62056)

Contributors to this release

• Dmitriy Mozgovoy
• David Dallas
• Sean Sattler
• Mustafa Ateş Uzun
• Przemyslaw Motacki
• Michael Di Prisco

v1.5.0

Compare Source

Bug Fixes

• adapter: make adapter loading error more clear by using platform-specific adapters explicitly (#​5837) (9a414bb)
• dns: fixed cacheable-lookup integration; (#​5836) (b3e327d)
• headers: added support for setting header names that overlap with class methods; (#​5831) (d8b4ca0)
• headers: fixed common Content-Type header merging; (#​5832) (8fda276)

Features

• export getAdapter function (#​5324) (ca73eb8)
• export: export adapters without unsafe prefix (#​5839) (1601f4a)

Contributors to this release

• Dmitriy Mozgovoy
• 夜葬
• Jonathan Budiman
• Michael Di Prisco

v1.4.0

Compare Source

Bug Fixes

• formdata: add multipart/form-data content type for FormData payload on custom client environments; (#​5678) (bbb61e7)
• package: export package internals with unsafe path prefix; (#​5677) (df38c94)

Features

• dns: added support for a custom lookup function; (#​5339) (2701911)
• types: export AxiosHeaderValue type. (#​5525) (726f1c8)

Performance Improvements

• merge-config: optimize mergeConfig performance by avoiding duplicate key visits; (#​5679) (e6f7053)

Contributors to this release

• Dmitriy Mozgovoy
• Arthur Fiorette
• PIYUSH NEGI

1.3.6 (2023-04-19)

Bug Fixes

• types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
• utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)

Contributors to this release

• Dmitriy Mozgovoy
• Michael Di Prisco

1.3.5 (2023-04-05)

Bug Fixes

• headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
• params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)

Contributors to this release

• Dmitriy Mozgovoy

1.3.4 (2023-02-22)

Bug Fixes

• blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
• http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)

Contributors to this release

• Dmitriy Mozgovoy
• lcysgsg
• Michael Di Prisco

1.3.3 (2023-02-13)

Bug Fixes

• formdata: added a check to make sure the FormData class is available in the browser's global scope; (#​5545) (a6dfa72)
• formdata: fixed setting NaN as Content-Length for form payload in some cases; (#​5535) (c19f7bf)
• headers: fixed the filtering logic of the clear method; (#​5542) (ea87ebf)

Contributors to this release

• Dmitriy Mozgovoy
• 陈若枫

1.3.2 (2023-02-03)

Bug Fixes

• http: treat http://localhost as base URL for relative paths to avoid ERR_INVALID_URL error; (#​5528) (128d56f)
• http: use explicit import instead of TextEncoder global; (#​5530) (6b3c305)

Contributors to this release

• Dmitriy Mozgovoy

1.3.1 (2023-02-01)

Bug Fixes

• formdata: add hotfix to use the asynchronous API to compute the content-length header value; (#​5521) (96d336f)
• serializer: fixed serialization of array-like objects; (#​5518) (08104c0)

Contributors to this release

• Dmitriy Mozgovoy

---

Configuration

📅 Schedule: Branch creation - "" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.