DavidWells / DavidWells/analytics
Dependency Security: Axios Cross-Site Request Forgery Vulnerability
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 2.7k
- Forks
- 267
- PR merge metrics
- No merged PRs in 30d
Description
There is a Axios Cross-Site Request Forgery Vulnerability dependency in the @analytics/segment plugin.
Dependabot is stating: @analytics/segment@1.1.3 requires axios@^0.21.1 via a transitive dependency on analytics-node@3.5.0
(https://github.com/DavidWells/analytics/blob/master/packages/analytics-plugin-segment/package.json#L56)
Looks like analytics-node is a deprecated repo with no more support.
analytics-node suggests using this repo instead: https://github.com/segmentio/analytics-next/tree/master/packages/node#readme
Any way you can replace analytics-node with analytics-next?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with packages/analytics-plugin-segment/package.json at the dependency reference mentioned in the issue, then compare the deprecated analytics-node package with analytics-next's node package documentation. Check the Segment plugin's integration points and existing validation before changing the dependency. Done means the plugin no longer pulls the vulnerable axios version and its existing behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100