[Snyk] Security upgrade axios from 1.3.3 to 1.6.0 #1490

New Issue

MrUnknownDE · 2026-04-05T16:27:46+02:00

MrUnknownDE commented

2026-04-05 16:27:46 +02:00

Originally created by @simlarsen on 11/20/2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- Workflow/package.json
- Workflow/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Cross-site Request Forgery (CSRF) SNYK-JS-AXIOS-6032459	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: axios

The new version differs by 46 commits.

f7adacd chore(release): v1.6.0 (#6031)
9917e67 chore(ci): fix release-it arg; (#6032)
96ee232 fix(CSRF): fixed CSRF vulnerability CVE-2023-45857 (#6028)
7d45ab2 chore(tests): fixed tests to pass in node v19 and v20 with `keep-alive` enabled; (#6021)
5aaff53 fix(dns): fixed lookup function decorator to work properly in node v20; (#6011)
a48a63a chore(docs): added AxiosHeaders docs; (#5932)
a1c8ad0 fix(types): fix AxiosHeaders types; (#5931)
2ac731d chore(docs): update readme.md (#5889)
88fb52b chore(release): v1.5.1 (#5920)
e410779 fix(adapters): improved adapters loading logic to have clear error messages; (#5919)
bc9af51 fix(formdata): fixed automatic addition of the `Content-Type` header for FormData in non-browser environments; (#5917)
4c89f25 fix(headers): allow `content-encoding` header to handle case-insensitive values (#5890) (#5892)
ae00391 docs(paramsSerializer config within request config): update documentation for paramsSerializer
a989ccd Change isNaN to Number.isNaN
b5b7760 docs: fix CommonJS usage note
9e62056 fix(types): removed duplicated code
6365751 chore(release): v1.5.0 (#5838)
1601f4a feat(export): export adapters without `unsafe` prefix (#5839)
dff74ae docs: linting documentation notes (#5791)
ca73eb8 feat: export getAdapter function (#5324)
9a414bb fix(adapter): make adapter loading error more clear by using platform-specific adapters explicitly (#5837)
b3e327d fix(dns): fixed `cacheable-lookup` integration; (#5836)
8fda276 fix(headers): fixed common Content-Type header merging; (#5832)
d8b4ca0 fix(headers): added support for setting header names that overlap with class methods; (#5831)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Request Forgery (CSRF)

*Originally created by @simlarsen on 11/20/2023* This PR was automatically created by Snyk using the credentials of a real user. <h3>Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.</h3> #### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - Workflow/package.json - Workflow/package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **676/1000** **Why?** Proof of Concept exploit, Has a fix available, CVSS 7.1 | Cross-site Request Forgery (CSRF) [SNYK-JS-AXIOS-6032459](https://snyk.io/vuln/SNYK-JS-AXIOS-6032459) | No | Proof of Concept (*) Note that the real score may have changed since the PR was raised. <details> <summary>Commit messages</summary> <details> <summary>Package name: axios</summary> The new version differs by 46 commits. <ul> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/f7adacdbaa569281253c8cfc623ad3f4dc909c60">f7adacd</a> chore(release): v1.6.0 (#6031)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/9917e67cbb6c157382863bad8c741de58e3f3c2b">9917e67</a> chore(ci): fix release-it arg; (#6032)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/96ee232bd3ee4de2e657333d4d2191cd389e14d0">96ee232</a> fix(CSRF): fixed CSRF vulnerability CVE-2023-45857 (#6028)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/7d45ab2e2ad6e59f5475e39afd4b286b1f393fc0">7d45ab2</a> chore(tests): fixed tests to pass in node v19 and v20 with `keep-alive` enabled; (#6021)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/5aaff532a6b820bb9ab6a8cd0f77131b47e2adb8">5aaff53</a> fix(dns): fixed lookup function decorator to work properly in node v20; (#6011)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/a48a63ad823fc20e5a6a705f05f09842ca49f48c">a48a63a</a> chore(docs): added AxiosHeaders docs; (#5932)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/a1c8ad008b3c13d53e135bbd0862587fb9d3fc09">a1c8ad0</a> fix(types): fix AxiosHeaders types; (#5931)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/2ac731d60545ba5c4202c25fd2e732ddd8297d82">2ac731d</a> chore(docs): update readme.md (#5889)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/88fb52b5fad7aabab0532e7ad086c5f1b0178905">88fb52b</a> chore(release): v1.5.1 (#5920)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/e4107797a7a1376f6209fbecfbbce73d3faa7859">e410779</a> fix(adapters): improved adapters loading logic to have clear error messages; (#5919)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/bc9af51b1886d1b3529617702f2a21a6c0ed5d92">bc9af51</a> fix(formdata): fixed automatic addition of the `Content-Type` header for FormData in non-browser environments; (#5917)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/4c89f25196525e90a6e75eda9cb31ae0a2e18acd">4c89f25</a> fix(headers): allow `content-encoding` header to handle case-insensitive values (#5890) (#5892)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/ae003913a39f3bdf9bbbd8f71a1ed681fd044d8b">ae00391</a> docs(paramsSerializer config within request config): update documentation for paramsSerializer</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/a989ccdc1a672171e9b45d3f02edc260109a607c">a989ccd</a> Change isNaN to Number.isNaN</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/b5b776037300ad1e0f800e95e33552030e641887">b5b7760</a> docs: fix CommonJS usage note</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/9e6205630e1c9cf863adf141c0edb9e6d8d4b149">9e62056</a> fix(types): removed duplicated code</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/6365751ba6725cc283f7364b9ee6ca9917e9737c">6365751</a> chore(release): v1.5.0 (#5838)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/1601f4a27a81ab47fea228f1e244b2c4e3ce28bf">1601f4a</a> feat(export): export adapters without `unsafe` prefix (#5839)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/dff74ae374b75ad1b99cb1050fe4a4c52cf4b9f5">dff74ae</a> docs: linting documentation notes (#5791)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/ca73eb878df0ae2dace81fe3a7f1fb5986231bf1">ca73eb8</a> feat: export getAdapter function (#5324)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/9a414bb6c81796a95c6c7fe668637825458e8b6d">9a414bb</a> fix(adapter): make adapter loading error more clear by using platform-specific adapters explicitly (#5837)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/b3e327dcc9277bdce34c7ef57beedf644b00d628">b3e327d</a> fix(dns): fixed `cacheable-lookup` integration; (#5836)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/8fda2766b1e6bcb72c3fabc146223083ef13ce17">8fda276</a> fix(headers): fixed common Content-Type header merging; (#5832)</li> <li><a href="https://snyk.io/redirect/github/axios/axios/commit/d8b4ca0ea5f2f05efa4edfe1e7684593f9f68273">d8b4ca0</a> fix(headers): added support for setting header names that overlap with class methods; (#5831)</li> </ul> <a href="https://snyk.io/redirect/github/axios/axios/compare/d9ebf8fb3ab2e6d277626d72bcf5580e2a6e795b...f7adacdbaa569281253c8cfc623ad3f4dc909c60">See the full diff</a> </details> </details> Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiI1NzcyOGJiNS1kZjYxLTRiNjYtOWMyNC1hODRiZTg3NTc3NTIiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjU3NzI4YmI1LWRmNjEtNGI2Ni05YzI0LWE4NGJlODc1Nzc1MiJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/oneuptime-RsC2nshvQ2Vnr35jHvMnMP/project/eab19927-9a5d-47a0-a67d-cb1a7d0ecbac?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/oneuptime-RsC2nshvQ2Vnr35jHvMnMP/project/eab19927-9a5d-47a0-a67d-cb1a7d0ecbac?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"57728bb5-df61-4b66-9c24-a84be8757752","prPublicId":"57728bb5-df61-4b66-9c24-a84be8757752","dependencies":[{"name":"axios","from":"1.3.3","to":"1.6.0"}],"packageManager":"npm","projectPublicId":"eab19927-9a5d-47a0-a67d-cb1a7d0ecbac","projectUrl":"https://app.snyk.io/org/oneuptime-RsC2nshvQ2Vnr35jHvMnMP/project/eab19927-9a5d-47a0-a67d-cb1a7d0ecbac?utm_source=github&utm_medium=referral&page=fix-pr","type":"user-initiated","patch":[],"vulns":["SNYK-JS-AXIOS-6032459"],"upgrade":["SNYK-JS-AXIOS-6032459"],"isBreakingChange":false,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[676],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Cross-site Request Forgery (CSRF)](https://learn.snyk.io/lesson/csrf-attack/?loc=fix-pr)

MrUnknownDE closed this issue

2026-04-05 16:27:46 +02:00

Sign in to join this conversation.

Branches Tags

master

release

snyk-fix-0aa85871afc5c8eee83a20407bd9e063

new-dash

probe-runner

better-logs

merge-ui

api-ref-refactor

safe-vm

tf-demo

dash-chunk

mult-slack

episode-resolve

feat/homepage-seo-v2

seo/compare-pages-homepage-optimize

tf-sets

vite-build

alert-grouping-product

oneuptime-fix-exception-5f43cb12

deprecate-telemetry-service

oneuptime-fix-exception-b77cfaf1

workflow-ui-update

chore/bump-version-9.2.5-1764859493

chore/bump-version-9.2.5-1764857051

state-change

postmortem

chore/bump-version-9.1.3-1764685359

pricing-compare

use-cases

dashboard-logs

incident-declared-at

agent-lib

scim-patch-fix

files-notes

dropdown-labels

revoke-token

refresh-sessions

oneuptime-ssl

telemetry-attr

nativewind

oneuptime-mobile-app

timepkr

cert-kube

new-log-ui

ms-temas-bot

span-improve

teams-integration

cert-manager

final-ms-teams

new-markdown

scim-update

probe-proxy-impl

probe-proxy-url

fb-whatsapp

whatsapp-integration

ms-teams-conn

copilot-plus

vs-code-copilot

ms-teams

server-bucket-size

sp-scim

scim

probe-queue

queue-work

keda-autoscaler

otel-keda

telemetry-queue

otel-queue

mobile-responsive

add-state-to-title

file-tf

snyk-fix-21d325191a83f6e495f02680309be6df

new-terraform-provider

tf-provider

msp-server

announcement-templates

optmize-esbuild

ms-teams-workspace-integration

run-as-non-root

fix/team-member-service-test-error

feature/msteams-integration-backend

optmize-dash

split-dashboard

feature/responsive-navbar

feat/mobile-responsive-sidemenu

mobile-navbar

mobile-ui

fix-recurring-events

fix-monitor-test

snyk-fix-6d5b446d98eb30ad7cc48664f26e8dd3

snyk-fix-5f2a25c13d925a6df331a8db1b4b6bc3

snyk-fix-82cf608c1e34aadeec1e40be2dd7692c

snyk-fix-28fb72b74f8e210b21994c9d4a749db4

snyk-fix-9dd32ce4170d36a0032a14eca7bcc974

snyk-fix-33cfbfb6119028a909c55ae0b6f42134

snyk-fix-0d6c626395070c0bf0647893fd4ad82c

telemetry-decorator

snyk-fix-9dcd00f3db77cda7a8a956ad4c744638

snyk-fix-39e89b36dc9e401d2beb27cf134cb8f8

manual-workflow

sp-api

snyk-fix-476babcac00c78674ae2231bc91de4f0

snyk-fix-aba76b601f35a212295c529b373457fa

slack-app

otel-collector-queue-size

scheduled-maintenance-feed

add-proxy-to-server-monitor

snyk-fix-129563dbc737d32bc6bb8e3311b8bb86

metrics-monitor

snyk-fix-b3faaf7e1b0131c254a19d461fdfa12f

snyk-fix-49a541156a8e299f9158ecc2e1ce3e4e

snyk-fix-6fed1c2110e88e596893df3351740515

snyk-fix-7f3c8e70773dfe11ea8caed8e34b2573

snyk-fix-2643b617b033d0cbf19291b6ad7776a4

snyk-fix-1219e1241120fcf13feb7bc0b54e18e3

merge-monitor-metrics

dashboarding

oneuptime-copilot-oneuptime-copilot-improve-comments-ZlPvy

oneuptime-copilot-oneuptime-copilot-improve-comments-vThJD

oneuptime-copilot-oneuptime-copilot-improve-comments-veTFM

snyk-fix-1230088cdc5e6714c07c4043881095db

sp-custom-cert

realtime

snyk-fix-2267fc7afa5dd1aadc03bda66d835a26

snyk-fix-82eb97bf3553f75fcdec629b2375d091

snyk-fix-0ff1eeedd26324c34c4b6446c78d93ab

snyk-fix-7a5cb77d5e30b278d6086cc6ec7563dd

snyk-fix-80a68103cb676782e141f18725deae71

oneuptime-copilot-oneuptime-copilot-add-spans-Dcefh

oneuptime-copilot-oneuptime-copilot-improve-comments-YRJKG

oneuptime-copilot-oneuptime-copilot-improve-comments-PBqVE

snyk-fix-6390d5be9d2dcbe507da6d19b87bb581

oneuptime-copilot-oneuptime-copilot-improve-comments-dnfTZ

copilot-main

error-tracking

snyk-fix-616369b0f1423d8113422a2b0ea1798a

snyk-fix-ecde2433ac879fc83fcb7fbaef849ca2

snyk-fix-1436684cb4b974b4b38ec0de7c27678b

snyk-fix-929b1416ccb03655ff400075fc126a5d

merge-dir

snyk-upgrade-bc55cc4a3bed3c919d5253c5ccb89569

oneuptime-copilot-oneuptime-copilot-improve-comments-NXaNT

oneuptime-copilot-oneuptime-copilot-improve-comments-MhFUX

oneuptime-copilot-oneuptime-copilot-improve-comments-eHoNt

oneuptime-copilot-oneuptime-copilot-improve-comments-BWpyo

landing-page

clickhouse-optimization

attributes-cache

snyk-upgrade-b1d7fc785c4b347f9540423872d4f7eb

snyk-upgrade-b12f9d5ede2ce54b392c16e1398efc0d

snyk-upgrade-90863abe750274199042129d216ec458

snyk-upgrade-24742a40cc66c0ff20127c49b31c5b92

status-page-reports

monitor-reports

oneuptime-app-oneuptime-app-improve-comments-wPkHZ

oneuptime-app-oneuptime-app-improve-comments-zheFq

oneuptime-app-oneuptime-app-improve-comments-yGblU

oneuptime-app-oneuptime-app-improve-comments-XvJyI

oneuptime-app-oneuptime-app-improve-comments-Iigpp

oneuptime-app-oneuptime-app-improve-comments-BLqEd

oneuptime-app-oneuptime-app-improve-comments-BSWXD

oneuptime-app-oneuptime-app-improve-comments-iDNIR

oneuptime-app-oneuptime-app-improve-comments-FPiCN

oneuptime-app-oneuptime-app-improve-comments-hfdRa

oneuptime-app-oneuptime-app-improve-comments-yEhKY

oneuptime-app-oneuptime-app-improve-comments-iOjcB

oneuptime-app-oneuptime-app-improve-comments-tFtyx

oneuptime-app-oneuptime-app-improve-comments-sBvxI

oneuptime-app-oneuptime-app-improve-comments-IXAhB

oneuptime-app-oneuptime-app-improve-comments-YtccK

oneuptime-app-oneuptime-app-improve-comments-QCnqA

oneuptime-app-oneuptime-app-improve-comments-NMjBi

oneuptime-app-oneuptime-app-improve-comments-lDSQP

oneuptime-app-oneuptime-app-improve-comments-YdAAE

oneuptime-app-oneuptime-app-improve-comments-JVpQw

oneuptime-app-oneuptime-app-improve-comments-DncIm

oneuptime-app-oneuptime-app-improve-comments-iBzpC

oneuptime-app-oneuptime-app-improve-comments-GkOnn

telemetry-backend

snyk-upgrade-818024a85e0cd5b743112ffb7f513123

snyk-upgrade-2f9ef5e24aa83032721fce51c3a0b0ca

oneuptime-app-oneuptime-app-refactor-code-nDOMw

oneuptime-app-oneuptime-app-refactor-code-nzaSs

oneuptime-app-oneuptime-app-refactor-code-TIxRv

oneuptime-app-oneuptime-app-refactor-code-Llyxi

oneuptime-app-oneuptime-app-refactor-code-lfIez

oneuptime-app-oneuptime-app-improve-comments-FLlpf

oneuptime-app-oneuptime-app-improve-comments-DaGfY

oneuptime-app-oneuptime-app-improve-comments-XaYkK

oneuptime-app-oneuptime-app-fix-grammar-and-spelling-CDFoR

ai-copilot-main

oneuptime-app-oneuptime-app-fix-grammar-and-spelling-hueYU

oneuptime-app-oneuptime-app-fix-grammar-and-spelling-HQfro

oneuptime-app-oneuptime-app-fix-grammar-and-spelling-JVpKF

oneuptime-app-oneuptime-app-fix-grammar-and-spelling-mSRcD

oneuptime-app-oneuptime-app-fix-grammar-and-spelling-NXSdG

oneuptime-app-oneuptime-app-fix-grammar-and-spelling-CYFVx

oneuptime-app-oneuptime-app-improve-comments-UsHIA

oneuptime-app-oneuptime-app-improve-comments-ZBFjb

oneuptime-app-oneuptime-app-improve-comments-ggYpS

oneuptime-app-oneuptime-app-improve-comments-YUFeh

eval-over-time

oneuptime-app-oneuptime-app-improve-comments-LkJYk

ai-main-70b

eslint

oneuptime-app-test-branch-11

oneuptime-app-test-branch-10

oneuptime-app-test-branch-7

oneuptime-app-test-branch-6

test-branch

nz/metric-detail

ext-postgres

perms-refactor

filter-refactor

group-by

greenlock-refactor

attributes

react-app

otel

snyk-upgrade-3677f1da0f20b9341d779856ea606cce

snyk-upgrade-324862099bddfa90e5e0e06eb934c162

renovate/node-16.x-lockfile

snyk-upgrade-ac717665d10b7db0ddb20de9bdaf435b

snyk-upgrade-7b7ea7a1c722d2b7f48e290063771f7b

snyk-upgrade-520b5a017b5e7985121ef90b57317068

renovate/stripe-react-stripe-js-1.x-lockfile

renovate/heroicons-react-2.x-lockfile

renovate/headlessui-react-1.x-lockfile

renovate/clickhouse-clickhouse-server-23.x

snyk-upgrade-8a1c1f353568dcbc7b2c3e4beec4a6b7

snyk-upgrade-affb0a1678b57ae5a6f3183f5e8d302d

renovate/vm2-3.x-lockfile

renovate/start-server-and-test-1.x-lockfile

renovate/chrome-launcher-0.x-lockfile

renovate/mikepenz-release-changelog-builder-action-3.x

renovate/npm-xmldom-vulnerability

monitor-groups

feature-flags

logging

admin-dashboard

update-deps

metered-plan

fix-status-page-refresh

owner-emails

owners-in-form

monitoring

fix-small-issues

single-docker-container

workflow-fix

staus-page-fix

slack_workflow

emails

fix/ping-monitor-ipv6

fix-typescript-errors

issue/160-add-setup-alert

143-fix-github-actions-jobs-dont-run-on-prs-from-forked-repo

142-github-actions-build-job-to-run-home-tests

147-form-containers

131-add-styling-for-account-in-topbar

chore/setup-sonar-cloud-#21

96-css-for-login-page

97-css-login-page

35-write-docker-build-job-for-helmchart

ts-migrate

monitor-box

feature-github-actions-3

feature-github-actions

feature-github-actions-2

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/oneuptime#1490