Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

📦 chore: Patch axios to address CVE-2025-27152 #6222

Merged
merged 2 commits into from
Mar 7, 2025

Conversation

danny-avila
Copy link
Owner

@danny-avila danny-avila commented Mar 7, 2025

Summary

I updated the axios dependency across multiple package files to address CVE-2025-27152 and removed the unused langchain package from the API to clean up the repository.

  • Bumped axios in api/package.json from 1.7.8 to ^1.8.2.
  • Upgraded @langchain/community in api/package.json from ^0.3.14 to ^0.3.34.
  • Added an axios override in the main package.json for version consistency.
  • Removed the langchain dependency from api/package.json since it is no longer used.
    • @langchain/community still uses the latest version of the now deprecated langchain dependency

Testing:

  • Ran npm install and verified that all package versions resolve correctly.
  • Executed local unit tests to confirm that no new warnings or errors are present.

Checklist:

  • My code adheres to the project’s style guidelines.
  • I have performed a self-review of my code.
  • I have written tests demonstrating that my changes are effective.
  • Local unit tests pass with my changes.
  • Dependent changes have been merged and published in downstream modules.

@danny-avila danny-avila merged commit dc8d5de into main Mar 7, 2025
6 checks passed
@danny-avila danny-avila deleted the chore/patch-axios branch March 7, 2025 17:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant