fix(deps): bump axios 1.11.0 → 1.19.0 (clears 29 findings) by izzywdev · Pull Request #754 · izzywdev/FuzeFront

izzywdev · 2026-08-20T05:22:22Z

📋 Description

First item off the #747 triage list, sequenced first because it is by far the largest single win: one dependency bump in one manifest clears 29 fixable findings.

Every axios finding in the repo was concentrated in fuzefront-website/frontend/package-lock.json, pinned at 1.11.0 by a ^1.7.9 range. Fix floor was >=1.18.0; npm resolved 1.19.0.

Refs #747.

🔄 Type of Change

🐛 Bug fix (non-breaking change which fixes an issue)

🔧 Implementation Details

-    "axios": "^1.7.9",
+    "axios": "^1.19.0",

Regenerated with npm install --package-lock-only, so the change is the lockfile plus that one range — no node_modules churn.

Minor-version bump within axios v1, so semver-compatible. axios is used here only by the marketing website frontend, not the platform runtime.

🧪 Testing

Verified by rescanning the manifest at the exact config CI now uses (--severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --scanners vuln --ignore-unfixed) rather than assuming the bump worked:

	before	after
axios findings	29	0
total in this manifest	35	6

The 6 remaining are react-router (4) and @remix-run/router (2) — the deliberately-deferred major bump, tracked in #747 and explicitly not batched here.

node scripts/gate-toolchain.mjs — passes
node scripts/check-workspace-deps.mjs — passes
node scripts/check-dockerfile-lockfile.mjs — passes
Both JSON files parse
Diff confined to the intended manifest

Bonus

Carries one transitive fix that was its own line item on the triage list: follow-redirects 1.15.9 → 1.16.0.

Code Quality

Self-review of code completed
Code follows conventional commit format

📌 Incidental finding — filed separately, not fixed here

npm normalised this manifest's duplicate engines block down to one. Both copies were identical, so nothing changes behaviourally.

But 36 manifests repo-wide carry the same duplication, and gate-toolchain is structurally blind to it: JSON.parse silently keeps the last occurrence, so the gate sees one valid value and passes. If the two copies ever diverge, behaviour depends on which parser reads the file — npm, the gate, and any tooling that reads raw text could disagree.

Not widened into this PR; being filed on its own.

Caveat

The before/after counts come from a cached vulnerability DB dated 2026-08-16 (live pull returns ghcr.io: DENIED in this environment). CI runs a fresh DB, so exact numbers may shift — but axios going to zero is a version fact, not a DB-dependent one.

Generated by Claude Code

Clears 29 of the fixable Trivy findings in a single manifest — the largest single win on the #747 triage list, and the reason it was sequenced first. All axios findings in the repo were concentrated in this one lockfile (fuzefront-website/frontend), pinned at 1.11.0 by a '^1.7.9' range. The fix floor was >=1.18.0; npm resolved 1.19.0. Verified by rescanning the manifest at the same config CI now uses (--severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --scanners vuln --ignore-unfixed): axios findings 29 -> 0. The 6 findings that remain there are react-router (4) and @remix-run/router (2) — the deliberately-deferred major bump, tracked separately in #747. Carries one bonus transitive fix: follow-redirects 1.15.9 -> 1.16.0, which was its own line item on the triage list. npm also normalised this manifest's duplicate 'engines' block down to one. Both copies were identical so nothing changes behaviourally — but 36 manifests repo-wide share that duplication and gate-toolchain cannot see it, since JSON.parse silently keeps the last key. Filed separately rather than widened into this PR. Refs #747.

github-actions · 2026-08-20T05:30:50Z

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.

…xpress@4/body-parser@2 regression (#838) Re-measured #747 from latest master (axios #754, tar+dead-lockfile #813, and the 7-manifest minor/patch backlog #814 were already merged). Re-verified every "needs a major" claim against the currently-installed major line per the methodology correction in the issue (Trivy's FixedVersion spans release branches; max() over it overstates the required bump) — using `npm audit` against isolated pinned-version fixtures as a stand-in for Trivy, which this sandbox cannot reach (ghcr.io/aquasec denied, same as the issue's own note). Root cause found while re-measuring: root package.json's `body-parser` override (from #814) was `">=1.20.6"` with NO upper bound — the exact express@4 + body-parser incident this repo's CLAUDE.md already documents as having happened once before. It had silently jumped `backend/applications`'s express@4.22.2 to body-parser@2.3.0 (a major, breaking API line) instead of the intended 1.20.6 patch. Bounded it to `<2`, matching every other manifest's copy of this same override, and it correctly resolved back down to 1.20.6. Also found and fixed: package-lock.json's `packages[""]` never mirrors package.json's `overrides` field in this repo's lockfiles (confirmed on 5 manifests) — this is *why* a plain `npm install --package-lock-only` silently no-ops on a new override (per the issue's warning): npm's fast-path "up to date" check trusts a lockfile that already looks internally consistent, and without the mirror it never rechecks deeply-nested exact-pinned subtrees. Re-synced the mirror after every scoped `npm update <pkg> --package-lock-only` in this PR; a plain (non-scoped) install strips it again, so do not run one after this without re-syncing. Genuinely fixed (same-major, `npm update <pkg> --package-lock-only`, package-scoped, no bare tree-wide update): - root: undici 7.28.0 -> 7.29.0 (dev-only, via wrangler/miniflare) - root + services/{sms,email,billing}-service: qs 6.11.0 -> 6.15.3 (new bounded override; was transitive via express@4.19.2's exact "6.11.0" pin, npm's override engine wasn't cascading into it — 4 nested trees inside root's own workspace lockfile needed a direct hand-patch to real, registry-verified 1.20.6/6.15.3 metadata after `npm update`/`dedupe` repeatedly no-opped on them; a real peer conflict on express-rate-limit across backend/backend-applications/security-service blocks a full `npm dedupe` from reconciling this on its own) - root + services/{chat,email,notification,selection-list}-service (nested in root's own lockfile): body-parser 1.20.2 -> 1.20.6 (same patch, alongside the major-regression fix above) - fuzefront-website/frontend: ws 8.18.3 -> 8.21.3 (new bounded override; dev dependency via jsdom, clears a HIGH DoS CVE plus the MEDIUM from #747) Confirmed already fixed by #813/#814, no action: axios, tar, tar-fs, ip-address, lodash, validator, morgan, follow-redirects, @remix-run/router, @tootallnate/once (2.0.1 has no CVE — the 3.0.1 major floated in #747 was never actually required). Confirmed genuinely blocked on a major (left as-is, evidence below): - uuid 9.0.1 (root, services/email-service, services/billing-service): the 9.x line has no further release (9.0.0-beta.0, 9.0.0, 9.0.1 — nothing since); the fix requires >=11.1.1. - react-router(-dom) 6.30.6 in fuzefront-website/frontend: already the maximum safe 6.x fix (clears GHSA-9jcx-v3wj-wh4m and GHSA-2j2x-hqr9-3h42); 2 of the original 4 CVEs (GHSA-wrjc-x8rr-h8h6, GHSA-337j-9hxr-rhxg) require >=7.18.0 and were correctly never claimed fixable in #747's corrected telling. root/ and frontend/'s own react-router are unaffected — both already on v7 (7.18.2 / 7.18.0) as a pre-existing, unrelated dependency choice, not part of this CVE backlog. Verified: `npm install --package-lock-only` (root and all 4 touched sub-manifests) is idempotent post-fix (stable content hash across repeat runs); `npm ls <pkg> --package-lock-only --workspaces` confirms every target package now resolves to the intended version tree-wide; `node --eval JSON.parse(...)` on all 5 touched package-lock.json files. No `npm ci` / build run in this sandbox (disk-constrained, no network to a full registry mirror) — CI's own `npm ci` + build + gate-toolchain matrix is the remaining verification surface once this PR is up. Claude-Session: https://claude.ai/code/session_013tMciHkPE8To7V67CsgKKc Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

izzywdev added the auto-merge Enable squash auto-merge once CI passes label Aug 20, 2026 — with Claude

izzywdev mentioned this pull request Aug 20, 2026

36 manifests have duplicate "engines" keys — and gate-toolchain is structurally blind to it #755

Open

github-actions Bot enabled auto-merge (squash) August 20, 2026 05:24

izzywdev merged commit 9fdfb73 into master Aug 26, 2026
66 checks passed

izzywdev deleted the claude/deps-axios-bump branch August 26, 2026 05:05

izzywdev mentioned this pull request Aug 26, 2026

fix(deps): clear the minor/patch CVE backlog across 7 manifests #814

Merged

This was referenced Aug 27, 2026

fix(deps): clear remaining #747 LOW/MEDIUM CVE backlog + fix live body-parser@2 regression #838

Merged

Triage: 54 LOW/MEDIUM dependency findings restored to code scanning by full-severity Trivy #747

Open

Navigation Menu

fix(deps): bump axios 1.11.0 → 1.19.0 (clears 29 findings) - #754

fix(deps): bump axios 1.11.0 → 1.19.0 (clears 29 findings)#754
izzywdev merged 1 commit into
masterfrom
claude/deps-axios-bump

izzywdev commented Aug 20, 2026

Uh oh!

github-actions Bot commented Aug 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

izzywdev commented Aug 20, 2026

📋 Description

🔄 Type of Change

🔧 Implementation Details

🧪 Testing

Bonus

Code Quality

📌 Incidental finding — filed separately, not fixed here

Caveat

Uh oh!

github-actions Bot commented Aug 20, 2026

Automated code review (gate-code-review)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants