Nest: Upgrade axios to > 18.0 to fix security vulnerability

[shusson]

Security vulnerability in axois <= 18.0.

See https://github.com/axios/axios/issues/1098#issuecomment-497424749.

Not sure if/how nestjs wants these issues. I'm guessing the repo also has security alerts set up.

[sajidali]

Got same report using snyk package. 👍 for report

[Toxicable]

Posting this here so others can find it easier

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ axios                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.18.1                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @nestjs/common                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @nestjs/common > axios                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/880                         │
└───────────────┴──────────────────────────────────────────────────────────────┘

[sajidali]

@kamilmysliwiec PR> https://github.com/nestjs/nest/pull/2311 seems to fix this issue. any plans for releasing it?

[arjunyel]

Automated fixes for next time 😄 https://github.blog/2019-05-23-introducing-new-ways-to-keep-your-code-secure/

[kamilmysliwiec]

Fixed in the latest release

[ugolas]

can you guys fix this also in 5.x.x ?

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.