Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump minimum axios version for web-api and webhook to avoid security vuln #2116

Merged
merged 1 commit into from
Dec 5, 2024

Conversation

hello-ashleyintech
Copy link
Contributor

Summary

As described in issue #2115, a major security vuln has been patched in Axios 1.7.8. Updating all packages that use this (web-api and webhook) so that minimum version is now 1.7.8.

Requirements (place an x in each [ ])

Copy link

codecov bot commented Dec 5, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 91.66%. Comparing base (6750da0) to head (bb90b24).
Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #2116   +/-   ##
=======================================
  Coverage   91.66%   91.66%           
=======================================
  Files          38       38           
  Lines       10317    10317           
  Branches      647      647           
=======================================
  Hits         9457     9457           
  Misses        848      848           
  Partials       12       12           
Flag Coverage Δ
cli-hooks 95.24% <ø> (ø)
cli-test 94.48% <ø> (ø)
oauth 77.39% <ø> (ø)
socket-mode 58.22% <ø> (ø)
web-api 96.88% <ø> (ø)
webhook 96.65% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Copy link
Member

@zimeg zimeg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with passing tests!

From other comments, I agree that interactive-message is alright to not update since it's deprecated 🙏

Going to respond on the initial issue with a quick question, but I'm still also wondering about best practices for keeping these packages updated - security updates seem important but having a lower minimum also seems good? 🤔

Feel free to merge and tag when the time is right! 🚀

@zimeg zimeg added semver:patch security pkg:web-api applies to `@slack/web-api` pkg:webhook applies to `@slack/webhook` dependencies Pull requests that update a dependency file labels Dec 5, 2024
@zimeg zimeg linked an issue Dec 5, 2024 that may be closed by this pull request
7 tasks
@hello-ashleyintech hello-ashleyintech merged commit 4cbe2cf into main Dec 5, 2024
57 checks passed
@hello-ashleyintech hello-ashleyintech deleted the ah-fix-issue-2115 branch December 5, 2024 20:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file pkg:web-api applies to `@slack/web-api` pkg:webhook applies to `@slack/webhook` security semver:patch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Medium vulnerability : Update Axios to 1.7.8
3 participants