hyperweb-io / hyperweb-io/telescope

Update axios dependency to fix security vulnerability

Open
#826 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
154
Forks
53
PR merge metrics
No merged PRs in 30d

Description

Hello,

I noticed that `@cosmology/lcd` depends on a vulnerable version of `axios` (1.0.0 - 1.11.0) which has a high severity security issue.

**Vulnerability details:**
- DoS attack through lack of data size check
- Advisory: https://github.com/advisories/GHSA-4hjh-wcwx-xvwj

**Current situation:**
- `@cosmology/lcd >=0.13.2` depends on vulnerable versions of axios
- We're currently using `@cosmology/lcd@^0.15.0`

**Request:**
Could you update `@cosmology/lcd` to use a secure version of axios (>= 1.12.0)?

**npm audit output:**
axios 1.0.0 - 1.11.0
Severity: high
Axios is vulnerable to DoS attack through lack of data size check
node_modules/axios
@cosmology/lcd >=0.13.2

Depends on vulnerable versions of axios

Thanks!

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.