Skip to content

Commit 8f08fcb

Browse files
andreiborzaclaude
andauthored
fix(browser-tests): Pin axios to 1.13.5 to avoid compromised 1.14.1 (#20047)
axios 1.14.1 contains a supply chain attack via the plain-crypto-js dependency. This PR pins to 1.13.5 to prevent accidental upgrades. See: https://x.com/feross/status/2038807290422370479 Co-authored-by: Claude claude-opus-4-6 <noreply@anthropic.com>
1 parent 3815492 commit 8f08fcb

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

dev-packages/browser-integration-tests/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
"@sentry-internal/rrweb": "2.34.0",
6363
"@sentry/browser": "10.46.0",
6464
"@supabase/supabase-js": "2.49.3",
65-
"axios": "^1.12.2",
65+
"axios": "1.13.5",
6666
"babel-loader": "^10.1.1",
6767
"fflate": "0.8.2",
6868
"html-webpack-plugin": "^5.5.0",

yarn.lock

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11868,7 +11868,7 @@ aws-ssl-profiles@^1.1.2:
1186811868
resolved "https://registry.yarnpkg.com/aws-ssl-profiles/-/aws-ssl-profiles-1.1.2.tgz#157dd77e9f19b1d123678e93f120e6f193022641"
1186911869
integrity sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g==
1187011870

11871-
axios@^1.12.0, axios@^1.12.2:
11871+
axios@1.13.5, axios@^1.12.0:
1187211872
version "1.13.5"
1187311873
resolved "https://registry.yarnpkg.com/axios/-/axios-1.13.5.tgz#5e464688fa127e11a660a2c49441c009f6567a43"
1187411874
integrity sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==

0 commit comments

Comments
 (0)