Skip to content

Commit a0aefde

Browse files
authored
fix(e2e-tests): Pin axios to 1.13.5 to avoid compromised 1.14.1 (#906)
axios 1.14.1 contains a supply chain attack via the plain-crypto-js dependency. Pin to 1.13.5 to prevent accidental upgrades. See: https://x.com/feross/status/2038807290422370479
1 parent 136d4cf commit a0aefde

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

packages/e2e-tests/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
"@sentry/rollup-plugin": "5.1.1",
2020
"@sentry/vite-plugin": "5.1.1",
2121
"@sentry/webpack-plugin": "5.1.1",
22-
"axios": "^1.1.3"
22+
"axios": "1.13.5"
2323
},
2424
"devDependencies": {
2525
"@sentry-internal/eslint-config": "5.1.1",

yarn.lock

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2394,7 +2394,7 @@ available-typed-arrays@^1.0.5:
23942394
resolved "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.5.tgz#92f95616501069d07d10edb2fc37d3e1c65123b7"
23952395
integrity sha512-DMD0KiN46eipeziST1LPP/STfDU0sufISXmjSgvVsoU2tqxctQeASejWcfNtxYKqETM1UxQ8sp2OrSBWpHY6sw==
23962396

2397-
axios@*, axios@^1.1.3:
2397+
axios@*:
23982398
version "1.4.0"
23992399
resolved "https://registry.npmjs.org/axios/-/axios-1.4.0.tgz#38a7bf1224cd308de271146038b551d725f0be1f"
24002400
integrity sha512-S4XCWMEmzvo64T9GfvQDOXgYRDJ/wsSZc7Jvdgx5u1sd0JwsuPLqb3SYmusag+edF6ziyMensPVqLTSc1PiSEA==
@@ -2403,7 +2403,7 @@ axios@*, axios@^1.1.3:
24032403
form-data "^4.0.0"
24042404
proxy-from-env "^1.1.0"
24052405

2406-
axios@^1.12.0:
2406+
axios@1.13.5, axios@^1.12.0:
24072407
version "1.13.5"
24082408
resolved "https://registry.npmjs.org/axios/-/axios-1.13.5.tgz#5e464688fa127e11a660a2c49441c009f6567a43"
24092409
integrity sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==

0 commit comments

Comments
 (0)