Skip to content

Updating follow-redirects to version 1.14.7#4379

Merged
jasonsaayman merged 1 commit intoaxios:masterfrom
guscsales:chore/update-follow-redirects
Jan 13, 2022
Merged

Updating follow-redirects to version 1.14.7#4379
jasonsaayman merged 1 commit intoaxios:masterfrom
guscsales:chore/update-follow-redirects

Conversation

@guscsales
Copy link
Copy Markdown

I notice the current version of [email protected] is using the [email protected] and recently was discovered a security vulnerability that was fixed on [email protected].

The overview of error is:

Affected versions of this package are vulnerable to Information Exposure by leaking the cookie header to a third party site in the process of fetching a remote URL with the cookie in the request body. If the response contains a location header, it will follow the redirect to another URL of a potentially malicious actor, to which the cookie would be exposed.

Here is the from follow-redirects commit with the fix that is currently on version 1.14.7: follow-redirects/follow-redirects@8b347cb.

@guscsales guscsales marked this pull request as ready for review January 12, 2022 15:04
@mrnonz
Copy link
Copy Markdown

mrnonz commented Jan 12, 2022

This line of code, I believe, will use the most recent patch version when installing.

"follow-redirects": "^1.14.4"

As a result, when you try to install Axios, it will resolve to [email protected] by default.

@guscsales
Copy link
Copy Markdown
Author

This line of code, I believe, will use the most recent patch version when installing.

"follow-redirects": "^1.14.4"

As a result, when you try to install Axios, it will resolve to [email protected] by default.

Hey, yes this works! Thanks for your comment. Is necessary to keep this PR just to update this library?

@radosek
Copy link
Copy Markdown

radosek commented Jan 12, 2022

You can use resolutions in your package.json

"resolutions": {
"axios/follow-redirects": "^1.14.4"
}

Then you can upgrade it with yarn with yarn upgrade-interactive --latest

@jasonsaayman
Copy link
Copy Markdown
Member

Cool thanks, I know you can do the resolutions and that it should install the latest, but I will still accept this PR as cutting a new release on axios will cause things like dependabot to send out notices to update, release should be out tonight :)

@DanSmit
Copy link
Copy Markdown

DanSmit commented Jan 13, 2022

Thanks for fixing this. Any idea on when it will be released?

@radosek
Copy link
Copy Markdown

radosek commented Jan 13, 2022

@jasonsaayman

This was more for other people that came across this and needed a fast solution due to security concerns from SNYK.
Thanks for your work!

@batalhao
Copy link
Copy Markdown

batalhao commented Jan 13, 2022

Hi @gussalesdev and team,

Thanks for fixing this.

@jasonsaayman
Copy link
Copy Markdown
Member

Thanks for fixing this. Any idea on when it will be released?

Will be in the next few hours

@citypaul
Copy link
Copy Markdown

Thanks for the quick fix everyone!

@fbritoferreira
Copy link
Copy Markdown

Thanks for fixing this. Any idea on when it will be released?

Will be in the next few hours

Seems like the release hasn't happened yet

@citypaul
Copy link
Copy Markdown

Any update on the release? We've had to point to the specific commit with the fix in it to unblock our pipeline at the moment.

@guillaumearnx
Copy link
Copy Markdown

guillaumearnx commented Jan 17, 2022

Any update ? Need to fix some modules on a big amount of servers .. 😅

@jasonsaayman
Copy link
Copy Markdown
Member

Released 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants