fix(deps): pin axios to 1.14.0 and fix brace-expansion audit vulnerability by Siddhant-K-code · Pull Request #363 · openfga/js-sdk

Siddhant-K-code · 2026-03-31T07:59:11Z

What

Pin axios from ^1.13.5 to 1.14.0 (exact version)
Regenerate package-lock.json to resolve [email protected] and patch a pre-existing brace-expansion vulnerability

Why

[email protected] was published via a supply chain attack, pulling in [email protected] — a malicious package that deploys a cross-platform RAT via a postinstall hook. 1.14.1 has since been unpublished from npm, but the previous ^1.13.5 range would have resolved to it while it was live.

Pinning to 1.14.0 (last known-safe release) makes the dependency explicit and immune to any future malicious patch-level publish in this range.

The lockfile regeneration also surfaces and fixes a pre-existing moderate vulnerability in brace-expansion (GHSA-f886-m6hf-6m8v) — bumped across all instances (1.1.12→1.1.13, 2.0.2→2.0.3, 5.0.4→5.0.5).

Reference: https://socket.dev/blog/axios-npm-package-compromised

Follow-up

Once the Axios maintainers publish a verified clean release post-1.14.0, the pin can be relaxed back to a range.

linux-foundation-easycla · 2026-03-31T07:59:22Z

The committers listed above are authorized under a signed CLA.

✅ login: Siddhant-K-code / name: Siddhant Khare (5d7ea15)

coderabbitai · 2026-03-31T07:59:28Z

Walkthrough

Updated the axios dependency in package.json from version range ^1.13.5 to fixed version 1.14.0. This changes npm's resolution strategy from potentially accepting newer minor and patch versions to pinning the exact version 1.14.0.

Changes

Cohort / File(s)	Summary
Dependency Update `package.json`	Updated `axios` dependency from `^1.13.5` to `1.14.0`, changing from flexible versioning to fixed version pinning.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the primary change: pinning axios to 1.14.0 to address a supply-chain security vulnerability. It is concise, specific, and clearly communicates the main objective of the PR.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

Pins axios to a known-safe version to prevent accidental installation of the compromised [email protected] via the previous caret range, improving supply-chain safety for this SDK.

Changes:

Change axios dependency spec from ^1.13.5 to the exact version 1.14.0.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Siddhant-K-code · 2026-03-31T08:07:56Z

Addressed the review comment from @copilot-pull-request-reviewer — package-lock.json has been regenerated and committed alongside package.json. It now resolves axios to 1.14.0 exactly, and plain-crypto-js is not present anywhere in the lockfile. Both files are in sync in the same commit (c4bef64).

socket-security · 2026-03-31T08:08:14Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	axios@1.13.6 ⏵ 1.14.0	^-6

View full report

codecov-commenter · 2026-03-31T08:09:28Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.80%. Comparing base (e783d1a) to head (5d7ea15).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #363   +/-   ##
=======================================
  Coverage   85.80%   85.80%           
=======================================
  Files          26       26           
  Lines        1268     1268           
  Branches      249      249           
=======================================
  Hits         1088     1088           
  Misses        110      110           
  Partials       70       70

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[email protected] was published via a supply chain attack and pulls in [email protected], a malicious package that deploys a RAT. The caret range ^1.13.5 would resolve to 1.14.1 on fresh installs. Pinning to 1.14.0 (the last known-safe release) until a verified clean version is available upstream. Also fixes a pre-existing moderate vulnerability in brace-expansion (GHSA-f886-m6hf-6m8v) surfaced by npm audit. Ref: https://socket.dev/blog/axios-npm-package-compromised

Siddhant-K-code requested a review from a team as a code owner March 31, 2026 07:59

Copilot AI review requested due to automatic review settings March 31, 2026 07:59

Copilot started reviewing on behalf of Siddhant-K-code March 31, 2026 07:59 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

Comment thread package.json

Siddhant-K-code force-pushed the fix/pin-axios-safe-version branch 2 times, most recently from 4eacf8e to c4bef64 Compare March 31, 2026 08:07

Siddhant-K-code force-pushed the fix/pin-axios-safe-version branch from c4bef64 to 5d7ea15 Compare March 31, 2026 08:14

Siddhant-K-code changed the title ~~fix(deps): pin axios to 1.14.0 to avoid compromised 1.14.1~~ fix(deps): pin axios to 1.14.0 and fix brace-expansion audit vulnerability Mar 31, 2026

Siddhant-K-code enabled auto-merge March 31, 2026 08:17

SoulPancake approved these changes Mar 31, 2026

View reviewed changes

Siddhant-K-code added this pull request to the merge queue Mar 31, 2026

Merged via the queue into openfga:main with commit 1a1639f Mar 31, 2026
16 checks passed

Siddhant-K-code deleted the fix/pin-axios-safe-version branch March 31, 2026 08:23

openfga-releaser-bot Bot mentioned this pull request Apr 29, 2026

release: v0.9.6 #392

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): pin axios to 1.14.0 and fix brace-expansion audit vulnerability#363

fix(deps): pin axios to 1.14.0 and fix brace-expansion audit vulnerability#363
Siddhant-K-code merged 1 commit into
openfga:mainfrom
Siddhant-K-code:fix/pin-axios-safe-version

Siddhant-K-code commented Mar 31, 2026 •

edited

Loading

Uh oh!

linux-foundation-easycla Bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Siddhant-K-code commented Mar 31, 2026

Uh oh!

socket-security Bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Mar 31, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Siddhant-K-code commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Follow-up

Uh oh!

linux-foundation-easycla Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Siddhant-K-code commented Mar 31, 2026

Uh oh!

socket-security Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov-commenter commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Siddhant-K-code commented Mar 31, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Mar 31, 2026 •

edited

Loading

coderabbitai Bot commented Mar 31, 2026 •

edited

Loading

socket-security Bot commented Mar 31, 2026 •

edited

Loading

codecov-commenter commented Mar 31, 2026 •

edited

Loading