Azure / Azure/azure-functions-durable-js
Need to upgrade Axios dependency v1.7.9 in durable-functions
- Dominant language
- TypeScript
- Stars
- 142
- Forks
- 66
- Avg merge
- 3d 19h
- Merged PRs (30d)
- 4
Description
**Describe the bug**
“durable-functions“ 3.1.0 : [npm: durable-functions](https://www.npmjs.com/package/durable-functions/v/3.1.0)
This version forcibly restores "axios": "1.7.2" in NodeJs Azure function.
Expected to be restoring latest version of "axios": "1.7.9"due the “^” used in the versioning.
"^" is not playing the role of installing the latest Axios version in Azure function, but works locally.
**Required**: Axios versions below "1.7.2" has security vulnerability which is fixed in axios v1.7.4 +
Link: https://github.com/advisories/GHSA-8hc4-vh64-cxmj
**_Query_**: Why Axios is downgraded to to v 1.6,1 in “durable-functions“ v3.1.0 ?
**Investigative information**
- Durable Functions extension version: v3.1.0
- durable-functions npm module version:
- Language (JavaScript/TypeScript) and version: Typescript
- Node.js version: v22.13.1
***If deployed to Azure App Service***
**Steps to reproduce the behavior:**
1. Create a sample Node js project
2. Install durable-functions“ 3.1.0
3. Check "SampleNodeJsProject\node_modules\durable-functions\package.json"
4. Observe "axios": "^1.6.1" in "dependencies" section
- Development environment : Vs Code
Regards,
Shivanand B. Yarnal
Contributor guide
Research direction
Reproduce the issue by installing durable-functions 3.1.0 and inspecting its package.json, as described in the steps. Trace how the Axios dependency is declared and resolved, then verify that the package installs a non-vulnerable Axios version and that the dependency behavior matches the intended semver range.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100