Azure / Azure/azure-functions-durable-js

Need to upgrade Axios dependency v1.7.9 in durable-functions

Open
#625 0 comments 1 reaction 0 assignees View on GitHub
dependencies P1
Dominant language
TypeScript
Stars
142
Forks
66
Avg merge
3d 19h
Merged PRs (30d)
4

Description

**Describe the bug**
“durable-functions“ 3.1.0 : [npm: durable-functions](https://www.npmjs.com/package/durable-functions/v/3.1.0)
This version forcibly restores "axios": "1.7.2" in NodeJs Azure function.
Expected to be restoring latest version of "axios": "1.7.9"due the “^” used in the versioning.
"^" is not playing the role of installing the latest Axios version in Azure function, but works locally.

**Required**: Axios versions below "1.7.2" has security vulnerability which is fixed in axios v1.7.4 +
Link: https://github.com/advisories/GHSA-8hc4-vh64-cxmj

**_Query_**: Why Axios is downgraded to to v 1.6,1 in “durable-functions“ v3.1.0 ?

**Investigative information**

- Durable Functions extension version: v3.1.0
- durable-functions npm module version:
- Language (JavaScript/TypeScript) and version: Typescript
- Node.js version: v22.13.1

***If deployed to Azure App Service***

**Steps to reproduce the behavior:**

1. Create a sample Node js project
2. Install durable-functions“ 3.1.0
3. Check "SampleNodeJsProject\node_modules\durable-functions\package.json"
4. Observe "axios": "^1.6.1" in "dependencies" section

- Development environment : Vs Code

Regards,

Shivanand B. Yarnal

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue by installing durable-functions 3.1.0 and inspecting its package.json, as described in the steps. Trace how the Axios dependency is declared and resolved, then verify that the package installs a non-vulnerable Axios version and that the dependency behavior matches the intended semver range.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.