Update dependencies to fix multiple critical/high vulnerabilities#2645
Update dependencies to fix multiple critical/high vulnerabilities#2645pjanczyk wants to merge 1 commit into
Conversation
| ); | ||
| assert.strictEqual(firstPutRequestResult.status, 204); | ||
| oldEtag = firstPutRequestResult.headers.etag; | ||
| oldEtag = firstPutRequestResult.headers.etag ?? ""; |
There was a problem hiding this comment.
etag was string in axios@0.27.0, but in 0.32.0 the type was changed to string | undefined
| options: { | ||
| requestId: "5c43f514-9598-421a-a8d3-7b55a08a10c9", | ||
| dataServiceVersion: "3.0" | ||
| }, |
There was a problem hiding this comment.
These headers don't look correct — axios doesn't support nested objects as headers.
axios@0.27.0 stringified it as options: [object Object]
axios@0.32.0 throws an error
I updated them to match other test cases.
There was a problem hiding this comment.
Pull request overview
This PR updates axios and several transitive npm dependencies to remediate multiple Trivy-reported CVEs, and adjusts table REST tests to match the updated HTTP client behavior.
Changes:
- Bump
axiosto0.32.0and add npmoverridesto force secure transitive versions (notablyform-data). - Refresh
package-lock.jsonto reflect the updated dependency graph. - Update table REST tests’ request headers/ETag handling to stay compatible with the upgraded dependencies.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| tests/table/apis/table.entity.rest.test.ts | Updates batch-request headers and tweaks ETag extraction logic in REST tests. |
| package.json | Pins axios to 0.32.0 and adds npm overrides for vulnerable transitives. |
| package-lock.json | Large dependency graph update reflecting upgraded direct/transitive packages. |
| ChangeLog.md | Adds an entry documenting the dependency/vulnerability updates. |
Comments suppressed due to low confidence (1)
tests/table/apis/table.entity.rest.test.ts:836
- Defaulting newEtag to "" when the response ETag header is missing can cause later If-Match test cases (where "new" is substituted) to pass/fail for the wrong reason. Prefer asserting the ETag header is present on success responses before updating newEtag.
);
if (testCase.expectSuccess) {
newEtag = testCaseRequestResult.headers.etag ?? "";
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ); | ||
| assert.strictEqual(firstPutRequestResult.status, 204); | ||
| oldEtag = firstPutRequestResult.headers.etag; | ||
| oldEtag = firstPutRequestResult.headers.etag ?? ""; |
|
@microsoft-github-policy-service agree |
Bump
axios(from0.27.0to0.32.0) and multiple transitive dependencies to address the following vulnerabilities reported by Trivy container image scanner:npm run testandnpm run test:in-memoryare passing locally.Resolves #2641.
Thanks for contribution! Please go through following checklist before sending PR.
PR Branch Destination
mainbranch.legacy-devbranch.Always Add Test Cases
Make sure test cases are added to cover the code change.
Add Change Log
Add change log for the code change in
Upcoming Releasesection inChangeLog.md.Development Guideline
Please go to CONTRIBUTION.md for steps about setting up development environment and recommended Visual Studio Code extensions.