chore(deps): update dependency axios to v0.28.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	0.21.2 → 0.28.0

---

Axios vulnerable to Server-Side Request Forgery

CVE-2020-28168 / GHSA-4w2v-q235-vp99

More information

Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-28168
• https://github.com/axios/axios/issues/3369
• https://github.com/axios/axios/commit/c7329fefc890050edd51e40e469a154d0117fc55
• https://snyk.io/vuln/SNYK-JS-AXIOS-1038255
• https://www.npmjs.com/package/axios
• https://www.npmjs.com/advisories/1594
• https://lists.apache.org/thread.html/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1f@%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a@%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rdfd2901b8b697a3f6e2c9c6ecc688fd90d7f881937affb5144d61d6e@%3Ccommits.druid.apache.org%3E
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/advisories/GHSA-4w2v-q235-vp99

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

axios Inefficient Regular Expression Complexity vulnerability

CVE-2021-3749 / GHSA-cph5-m8f7-6c5x

More information

Details

axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3749
• https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
• https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31
• https://www.npmjs.com/package/axios
• https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a@%3Cdev.druid.apache.org%3E
• https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103@​%3Ccommits.druid.apache.org%3E
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/advisories/GHSA-cph5-m8f7-6c5x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Axios Cross-Site Request Forgery Vulnerability

CVE-2023-45857 / GHSA-wf5p-g6vw-rhxx

More information

Details

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-45857
• https://github.com/axios/axios/issues/6006
• https://github.com/axios/axios/issues/6022
• https://github.com/axios/axios/pull/6028
• https://github.com/axios/axios/commit/96ee232bd3ee4de2e657333d4d2191cd389e14d0
• https://github.com/axios/axios/releases/tag/v1.6.0
• https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
• https://github.com/axios/axios/pull/6091
• https://github.com/axios/axios/commit/2755df562b9c194fba6d8b609a383443f6a6e967
• https://github.com/axios/axios/releases/tag/v0.28.0
• https://security.netapp.com/advisory/ntap-20240621-0006
• https://github.com/advisories/GHSA-wf5p-g6vw-rhxx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

axios/axios (axios)

v0.28.0

Compare Source

Release notes:

Bug Fixes

• fix(security): fixed CVE-2023-45857 by backporting withXSRFToken option to v0.x (#​6091)

Backports from v1.x:

• Allow null indexes on formSerializer and paramsSerializer v0.x (#​4961)
• Fixing content-type header repeated #​4745
• Fixed timeout error message for HTTP 4738
• Added axios.formToJSON method (#​4735)
• URL params serializer (#​4734)
• Fixed toFormData Blob issue on node>v17 #​4728
• Adding types for progress event callbacks #​4675
• Fixed max body length defaults #​4731
• Added data URL support for node.js (#​4725)
• Added isCancel type assert (#​4293)
• Added the ability for the url-encoded-form serializer to respect the formSerializer config (#​4721)
• Add string[] to AxiosRequestHeaders type (#​4322)
• Allow type definition for axios instance methods (#​4224)
• Fixed AxiosError stack capturing; (#​4718)
• Fixed AxiosError status code type; (#​4717)
• Adding Canceler parameters config and request (#​4711)
• fix(types): allow to specify partial default headers for instance creation (#​4185)
• Added blob to the list of protocols supported by the browser (#​4678)
• Fixing Z_BUF_ERROR when no content (#​4701)
• Fixed race condition on immediate requests cancellation (#​4261)
• Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an Axios instance #​4248
• Added generic AxiosAbortSignal TS interface to avoid importing AbortController polyfill (#​4229)
• Fix TS definition for AxiosRequestTransformer (#​4201)
• Use type alias instead of interface for AxiosPromise (#​4505)
• Include request and config when creating a CanceledError instance (#​4659)
• Added generic TS types for the exposed toFormData helper (#​4668)
• Optimized the code that checks cancellation (#​4587)
• Replaced webpack with rollup (#​4596)
• Added stack trace to AxiosError (#​4624)
• Updated AxiosError.config to be optional in the type definition (#​4665)
• Removed incorrect argument for NetworkError constructor (#​4656)

v0.27.2

Compare Source

Fixes and Functionality:

• Fixed FormData posting in browser environment by reverting #​3785 (#​4640)
• Enhanced protocol parsing implementation (#​4639)
• Fixed bundle size

v0.27.1

Compare Source

Fixes and Functionality:

• Removed import of url module in browser build due to huge size overhead and builds being broken (#​4594)
• Bumped follow-redirects to ^1.14.9 (#​4615)

v0.27.0

Compare Source

Breaking changes:

• New toFormData helper function that allows the implementor to pass an object and allow axios to convert it to FormData (#​3757)
• Removed functionality that removed the the Content-Type request header when passing FormData (#​3785)
• (*) Refactored error handling implementing AxiosError as a constructor, this is a large change to error handling on the whole (#​3645)
• Separated responsibility for FormData instantiation between transformRequest and toFormData (#​4470)
• (*) Improved and fixed multiple issues with FormData support (#​4448)

QOL and DevX improvements:

• Added a multipart/form-data testing playground allowing contributors to debug changes easily (#​4465)

Fixes and Functionality:

• Refactored project file structure to avoid circular imports (#​4515) & (#​4516)
• Bumped follow-redirects to ^1.14.9 (#​4562)

Internal and Tests:

• Updated dev dependencies to latest version

Documentation:

• Fixing incorrect link in changelog (#​4551)

Notes:

• (*) Please read these pull requests before updating, these changes are very impactful and far reaching.

v0.26.1

Compare Source

Fixes and Functionality:

• Refactored project file structure to avoid circular imports (#​4220)

v0.26.0

Compare Source

Fixes and Functionality:

• Fixed The timeoutErrorMessage property in config not work with Node.js (#​3581)
• Added errors to be displayed when the query parsing process itself fails (#​3961)
• Fix/remove url required (#​4426)
• Update follow-redirects dependency due to Vulnerability (#​4462)
• Bump karma from 6.3.11 to 6.3.14 (#​4461)
• Bump follow-redirects from 1.14.7 to 1.14.8 (#​4473)

v0.25.0

Compare Source

Breaking changes:

• Fixing maxBodyLength enforcement (#​3786)
• Don't rely on strict mode behaviour for arguments (#​3470)
• Adding error handling when missing url (#​3791)
• Update isAbsoluteURL.js removing escaping of non-special characters (#​3809)
• Use native Array.isArray() in utils.js (#​3836)
• Adding error handling inside stream end callback (#​3967)

Fixes and Functionality:

• Added aborted even handler (#​3916)
• Header types expanded allowing boolean and number types (#​4144)
• Fix cancel signature allowing cancel message to be undefined (#​3153)
• Updated type checks to be formulated better (#​3342)
• Avoid unnecessary buffer allocations (#​3321)
• Adding a socket handler to keep TCP connection live when processing long living requests (#​3422)
• Added toFormData helper function (#​3757)
• Adding responseEncoding prop type in AxiosRequestConfig (#​3918)

Internal and Tests:

• Adding axios-test-instance to ecosystem (#​3786)
• Optimize the logic of isAxiosError (#​3546)
• Add tests and documentation to display how multiple inceptors work (#​3564)
• Updating follow-redirects to version 1.14.7 (#​4379)

Documentation:

• Fixing changelog to show corrext pull request (#​4219)
• Update upgrade guide for https proxy setting (#​3604)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Jay
• Rijk van Zanten
• Kohta Ito
• Brandon Faulkner
• Stefano Magni
• enofan
• Andrey Pechkurov
• Doowonee
• Emil Broman
• Remco Haszing
• Black-Hole
• Wolfram Kriesing
• Andrew Ovens
• Paulo Renato
• Ben Carp
• Hirotaka Tagawa
• 狼族小狈
• C. Lewis
• Felipe Carvalho
• Daniel
• Gustavo Sales

v0.24.0

Compare Source

Breaking changes:

• Revert: change type of AxiosResponse to any, please read lengthy discussion here: (#​4141) pull request: (#​4186)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Jay
• Rodry
• Remco Haszing
• Isaiah Thomason

v0.23.0

Compare Source

Breaking changes:

• Distinguish request and response data types (#​4116)
• Change never type to unknown (#​4142)
• Fixed TransitionalOptions typings (#​4147)

Fixes and Functionality:

• Adding globalObject: 'this' to webpack config (#​3176)
• Adding insecureHTTPParser type to AxiosRequestConfig (#​4066)
• Fix missing semicolon in typings (#​4115)
• Fix response headers types (#​4136)

Internal and Tests:

• Improve timeout error when timeout is browser default (#​3209)
• Fix node version on CI (#​4069)
• Added testing to TypeScript portion of project (#​4140)

Documentation:

• Rename Angular to AngularJS (#​4114)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Jay
• Evan-Finkelstein
• Paweł Szymański
• Dobes Vandermeer
• Claas Augner
• Remco Haszing
• Evgeniy
• Dmitriy Mozgovoy

v0.22.0

Compare Source

Fixes and Functionality:

• Caseless header comparing in HTTP adapter (#​2880)
• Avoid package.json import fixing issues and warnings related to this (#​4041), (#​4065)
• Fixed cancelToken leakage and added AbortController support (#​3305)
• Updating CI to run on release branches
• Bump follow redirects version
• Fixed default transitional config for custom Axios instance; (#​4052)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Jay
• Matt R. Wilson
• Xianming Zhong
• Dmitriy Mozgovoy

v0.21.4

Compare Source

Fixes and Functionality:

• Fixing JSON transform when data is stringified. Providing backward compatibility and complying to the JSON RFC standard (#​4020)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Guillaume Fortaine
• Yusuke Kawasaki
• Dmitriy Mozgovoy

v0.21.3

Compare Source

Fixes and Functionality:

• Fixing response interceptor not being called when request interceptor is attached (#​4013)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Julian Hollmann

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @material-ui/core@4.9.14
npm error Found: react@17.0.2
npm error node_modules/react
npm error   react@"17.0.2" from the root project
npm error   peer react@"17.0.2" from @hot-loader/react-dom@17.0.2
npm error   node_modules/@hot-loader/react-dom
npm error     dev @hot-loader/react-dom@"17.0.2" from the root project
npm error   11 more (@testing-library/react, gatsby, gatsby-link, ...)
npm error
npm error Could not resolve dependency:
npm error peer react@"^16.8.0" from @material-ui/core@4.9.14
npm error node_modules/@material-ui/core
npm error   @material-ui/core@"4.9.14" from the root project
npm error   peer @material-ui/core@"^4.0.0" from @material-ui/icons@4.9.1
npm error   node_modules/@material-ui/icons
npm error     @material-ui/icons@"4.9.1" from the root project
npm error   1 more (@material-ui/lab)
npm error
npm error Conflicting peer dependency: react@16.14.0
npm error node_modules/react
npm error   peer react@"^16.8.0" from @material-ui/core@4.9.14
npm error   node_modules/@material-ui/core
npm error     @material-ui/core@"4.9.14" from the root project
npm error     peer @material-ui/core@"^4.0.0" from @material-ui/icons@4.9.1
npm error     node_modules/@material-ui/icons
npm error       @material-ui/icons@"4.9.1" from the root project
npm error     1 more (@material-ui/lab)
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-16T15_33_13_048Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-16T15_33_13_048Z-debug-0.log

[Copilot]

Pull request overview

This PR updates the axios dependency version to address known security advisories affecting older releases.

Changes:

• Bump axios from 0.21.2 to 0.28.0 in package.json.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.