Skip to content

Commit d7ddbde

Browse files
authored
fix: CVE-2025-58754 by upgrading axios dependency (#41295)
## Description https://github.com/appsmithorg/appsmith-ee/security/dependabot/438 Fixes CVE-2025-58754 ``` client % yarn why axios ├─ appsmith-rts@workspace:packages/rts │ └─ axios@npm:1.12.2 (via npm:^1.12.0) │ ├─ appsmith@workspace:. │ └─ axios@npm:1.12.2 (via npm:^1.12.0) │ └─ wait-on@npm:7.2.0 └─ axios@npm:1.12.2 (via npm:^1.12.0) ``` ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/18520882251> > Commit: 59f9b9b > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=18520882251&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 15 Oct 2025 08:31:04 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated axios to ^1.12.0 across the client, including the RTS package and resolution map, ensuring consistent dependency versions. * Improves overall stability and compatibility by incorporating upstream fixes and enhancements. * Reduces the risk of dependency conflicts in the client workspace. * No user-facing behavior changes are expected. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
1 parent ef79d5f commit d7ddbde

File tree

3 files changed

+10
-10
lines changed

3 files changed

+10
-10
lines changed

app/client/package.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@
110110
"assert-never": "^1.2.1",
111111
"astring": "^1.7.5",
112112
"async-mutex": "^0.5.0",
113-
"axios": "^1.8.3",
113+
"axios": "^1.12.0",
114114
"bfj": "^7.0.2",
115115
"camelcase": "^6.2.1",
116116
"classnames": "^2.3.1",
@@ -426,7 +426,7 @@
426426
"@blueprintjs/icons": "3.22.0",
427427
"@types/react": "^17.0.2",
428428
"postcss": "8.4.31",
429-
"axios": "^1.8.3",
429+
"axios": "^1.12.0",
430430
"esbuild": "^0.25.1",
431431
"path-to-regexp@^1.7.0": "1.9.0",
432432
"prismjs": "1.30.0",

app/client/packages/rts/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
"@opentelemetry/sdk-trace-node": "^1.27.0",
2424
"@opentelemetry/semantic-conventions": "^1.27.0",
2525
"@shared/ast": "workspace:^",
26-
"axios": "^1.8.3",
26+
"axios": "^1.12.0",
2727
"dotenv": "10.0.0",
2828
"express": "^4.20.0",
2929
"express-validator": "^6.14.2",

app/client/yarn.lock

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13605,7 +13605,7 @@ __metadata:
1360513605
"@types/node": "*"
1360613606
"@types/nodemailer": ^6.4.17
1360713607
"@types/readline-sync": ^1.4.8
13608-
axios: ^1.8.3
13608+
axios: ^1.12.0
1360913609
dotenv: 10.0.0
1361013610
express: ^4.20.0
1361113611
express-validator: ^6.14.2
@@ -13748,7 +13748,7 @@ __metadata:
1374813748
assert-never: ^1.2.1
1374913749
astring: ^1.7.5
1375013750
async-mutex: ^0.5.0
13751-
axios: ^1.8.3
13751+
axios: ^1.12.0
1375213752
babel-jest: ^27.4.2
1375313753
babel-loader: ^8.2.3
1375413754
babel-plugin-lodash: ^3.3.4
@@ -14416,14 +14416,14 @@ __metadata:
1441614416
languageName: node
1441714417
linkType: hard
1441814418

14419-
"axios@npm:^1.8.3":
14420-
version: 1.8.3
14421-
resolution: "axios@npm:1.8.3"
14419+
"axios@npm:^1.12.0":
14420+
version: 1.12.2
14421+
resolution: "axios@npm:1.12.2"
1442214422
dependencies:
1442314423
follow-redirects: ^1.15.6
14424-
form-data: ^4.0.0
14424+
form-data: ^4.0.4
1442514425
proxy-from-env: ^1.1.0
14426-
checksum: 85fc8ad7d968e43ea9da5513310637d29654b181411012ee14cc0a4b3662782e6c81ac25eea40b5684f86ed2d8a01fa6fc20b9b48c4da14ef4eaee848fea43bc
14426+
checksum: f0331594fe053a4bbff04104edb073973a3aabfad2e56b0aa18de82428aa63f6f0839ca3d837258ec739cb4528014121793b1649a21e5115ffb2bf8237eadca3
1442714427
languageName: node
1442814428
linkType: hard
1442914429

0 commit comments

Comments
 (0)