axios 0.17.1 , 0.18.0 is showing a minor security issue

[yashwanthkumarsuruneni]

Describe the bug
Running the snyk scan on my project

To Reproduce
Steps to reproduce the behavior:

1. Run the snyk scan on your node_modules

Expected behavior
The scan shouldn't show any security vulnerabilities

Screenshots

[manueliglesias]

Hi @yashwanthkumarsuruneni

Thanks for bringing this to our attention.

I see the issue has been reported (axios/axios#1098) in the axios repo and a fix has been merged to master.

For now, we need to wait for it to be released and then adjust our dependency if needed.

[rowanu]

Great to see you guys across this 😄

Very keen to see this dependency updated when possible, because Security.

[jessedoyle]

Hi @manueliglesias - It looks like version 0.19.0 of axios has been released: https://github.com/axios/axios/releases/tag/v0.19.0. Just FYI!

Edit:

In the future what do you think about relaxing the restriction on axios?

Because the definition uses the caret operator and that the dependency is pre 1.0.0, npm won't allow upgrading to the next minor version to respect semantic versioning.

[github-actions]

This issue has been automatically locked since there hasn't been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.