Update dependency axios to v0.21.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	0.18.0 -> 0.21.1

GitHub Vulnerability Alerts

CVE-2020-28168

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

---

Release Notes

axios/axios (axios)

v0.21.1

Compare Source

Fixes and Functionality:

• Hotfix: Prevent SSRF (#​3410)
• Protocol not parsed when setting proxy config from env vars (#​3070)
• Updating axios in types to be lower case (#​2797)
• Adding a type guard for AxiosError (#​2949)

Internal and Tests:

• Remove the skipping of the socket http test (#​3364)
• Use different socket for Win32 test (#​3375)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Daniel Lopretto <timemachine3030@​users.noreply.github.com>
• Jason Kwok [email protected]
• Jay [email protected]
• Jonathan Foster [email protected]
• Remco Haszing [email protected]
• Xianming Zhong [email protected]

v0.21.0

Compare Source

Fixes and Functionality:

• Fixing requestHeaders.Authorization (#​3287)
• Fixing node types (#​3237)
• Fixing axios.delete ignores config.data (#​3282)
• Revert "Fixing overwrite Blob/File type as Content-Type in browser. (#​1773)" (#​3289)
• Fixing an issue that type 'null' and 'undefined' is not assignable to validateStatus when typescript strict option is enabled (#​3200)

Internal and Tests:

• Lock travis to not use node v15 (#​3361)

Documentation:

• Fixing simple typo, existant -> existent (#​3252)
• Fixing typos (#​3309)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Allan Cruz [email protected]
• George Cheng [email protected]
• Jay [email protected]
• Kevin Kirsche [email protected]
• Remco Haszing [email protected]
• Taemin Shin <cprayer13@​gmail.com>
• Tim Gates [email protected]
• Xianming Zhong [email protected]

v0.20.0

Compare Source

Release of 0.20.0-pre as a full release with no other changes.

v0.19.2

Compare Source

• Remove unnecessary XSS check (#​2679) (see (#​2646) for discussion)

v0.19.1

Compare Source

Fixes and Functionality:

• Fixing invalid agent issue (#​1904)
• Fix ignore set withCredentials false (#​2582)
• Delete useless default to hash (#​2458)
• Fix HTTP/HTTPs agents passing to follow-redirect (#​1904)
• Fix ignore set withCredentials false (#​2582)
• Fix CI build failure (#​2570)
• Remove dependency on is-buffer from package.json (#​1816)
• Adding options typings (#​2341)
• Adding Typescript HTTP method definition for LINK and UNLINK. (#​2444)
• Update dist with newest changes, fixes Custom Attributes issue
• Change syntax to see if build passes (#​2488)
• Update Webpack + deps, remove now unnecessary polyfills (#​2410)
• Fix to prevent XSS, throw an error when the URL contains a JS script (#​2464)
• Add custom timeout error copy in config (#​2275)
• Add error toJSON example (#​2466)
• Fixing Vulnerability A Fortify Scan finds a critical Cross-Site Scrip… (#​2451)
• Fixing subdomain handling on no_proxy (#​2442)
• Make redirection from HTTP to HTTPS work ([#​2426](#​2426] and (#​2547)
• Add toJSON property to AxiosError type (#​2427)
• Fixing socket hang up error on node side for slow response. (#​1752)
• Alternative syntax to send data into the body (#​2317)
• Fixing custom config options (#​2207)
• Fixing set config.method after mergeConfig for Axios.prototype.request (#​2383)
• Axios create url bug (#​2290)
• Do not modify config.url when using a relative baseURL (resolves #​1628) (#​2391)
• Add typescript HTTP method definition for LINK and UNLINK (#​2444)

Internal:

• Revert "Update Webpack + deps, remove now unnecessary polyfills" (#​2479)
• Order of if/else blocks is causing unit tests mocking XHR. (#​2201)
• Add license badge (#​2446)
• Fix travis CI build #​2386
• Fix cancellation error on build master. #​2290 #​2207 (#​2407)

Documentation:

• Fixing typo in CHANGELOG.md: s/Functionallity/Functionality (#​2639)
• Fix badge, use master branch (#​2538)
• Fix typo in changelog #​2193
• Document fix (#​2514)
• Update docs with no_proxy change, issue #​2484 (#​2513)
• Fixing missing words in docs template (#​2259)
• 🐛Fix request finally documentation in README (#​2189)
• updating spelling and adding link to docs (#​2212)
• docs: minor tweak (#​2404)
• Update response interceptor docs (#​2399)
• Update README.md (#​2504)
• Fix word 'sintaxe' to 'syntax' in README.md (#​2432)
• upadating README: notes on CommonJS autocomplete (#​2256)
• Fix grammar in README.md (#​2271)
• Doc fixes, minor examples cleanup (#​2198)

v0.19.0

Compare Source

Fixes and Functionality:

• Unzip response body only for statuses != 204 (#​1129) - drawski
• Destroy stream on exceeding maxContentLength (fixes #​1098) (#​1485) - Gadzhi Gadzhiev
• Makes Axios error generic to use AxiosResponse (#​1738) - Suman Lama
• Fixing Mocha tests by locking follow-redirects version to 1.5.10 (#​1993) - grumblerchester
• Allow uppercase methods in typings. (#​1781) - Ken Powers
• Fixing .eslintrc without extension (#​1789) - Manoel
• Consistent coding style (#​1787) - Ali Servet Donmez
• Fixing building url with hash mark (#​1771) - Anatoly Ryabov
• This commit fix building url with hash map (fragment identifier) when parameters are present: they must not be added after #, because client cut everything after #
• Preserve HTTP method when following redirect (#​1758) - Rikki Gibson
• Add getUri signature to TypeScript definition. (#​1736) - Alexander Trauzzi
• Adding isAxiosError flag to errors thrown by axios (#​1419) - Ayush Gupta
• Fix failing SauceLabs tests by updating configuration - Emily Morehouse

Documentation:

• Add information about auth parameter to README (#​2166) - xlaguna
• Add DELETE to list of methods that allow data as a config option (#​2169) - Daniela Borges Matos de Carvalho
• Update ECOSYSTEM.md - Add Axios Endpoints (#​2176) - Renan
• Add r2curl in ECOSYSTEM (#​2141) - 유용우 / CX
• Update README.md - Add instructions for installing with yarn (#​2036) - Victor Hermes
• Fixing spacing for README.md (#​2066) - Josh McCarty
• Update README.md. - Change .then to .finally in example code (#​2090) - Omar Cai
• Clarify what values responseType can have in Node (#​2121) - Tyler Breisacher
• docs(ECOSYSTEM): add axios-api-versioning (#​2020) - Weffe
• It seems that responseType: 'blob' doesn't actually work in Node (when I tried using it, response.data was a string, not a Blob, since Node doesn't have Blobs), so this clarifies that this option should only be used in the browser
• Add issue templates - Emily Morehouse
• Update README.md. - Add Querystring library note (#​1896) - Dmitriy Eroshenko
• Add react-hooks-axios to Libraries section of ECOSYSTEM.md (#​1925) - Cody Chan
• Clarify in README that default timeout is 0 (no timeout) (#​1750) - Ben Standefer

v0.18.1

Compare Source

Security Fix:

• Destroy stream on exceeding maxContentLength (fixes #​1098) (#​1485) - Gadzhi Gadzhiev

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json