Bump axios from 1.7.2 to 1.7.4 in /docs - #88
Conversation
Bumps [axios](https://github.com/axios/axios) from 1.7.2 to 1.7.4. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.2...v1.7.4) --- updated-dependencies: - dependency-name: axios dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
|
Unfortunately, the affected dependency is transitively imported. Best course of action would be to wait for the direct dependency to update 😄 |
|
I'm not sure we should merge this and keep dependabot tbh, since it's only for the docs and would clutter the commit history. What do you think? |
|
I wouldn't merge this either. Especially because it modifies the lock file only. I opened up the PR from dependabot mainly to raise the concern from my comment above. When it comes to security vulnerabilities, though, I'm not sure how far an issue with the docs server could affect the entire CB service, but since we're dockerized plus the issue relates to SSRF, I don't think it's that crucial in our particular case. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
apply: per-VC preflight (authed keystores listing plus a builder_config probe on an enumerated key, so a 404 means missing keymanager-APIs #88 support rather than key-elsewhere), POST per projected key with 202/404/ 403 handling, exit non-zero unless each key is accepted by exactly one VC (zero acceptors errors; several is a duplicate-key slashing alarm). --dry-run prints, --emit writes per-key JSON plus a manifest, --prune POSTs {} (spec-equal to DELETE) for stored-but-unprojected keys. check: read-only canonical comparison with tiered findings and --fail-on; fields the projection omits resolve to VC config on GET and are skipped rather than flagged as drift.
axum mock VC covering: partitioned-key happy path (POST body equals the projected doc), 401 preflight, missing-#88 detection, zero-acceptor non-zero result, duplicate-key slashing alarm, 403 config-file-managed, prune body exactly {}, dry-run/emit sending nothing, canonical check (reordered entries + uppercase hex + VC-resolved fields produce no drift), drift + unroutable auth_data + duplicate-key findings.
…support A transport error or 5xx on the probe is its own error, never evidence of no support; an empty-keystore VC warns and POSTs anyway (the 404/405 responses answer the support question).
2 participants
Bumps axios from 1.7.2 to 1.7.4.
Release notes
Sourced from axios's releases.
Changelog
Sourced from axios's changelog.
Commits
abd24a7chore(release): v1.7.4 (#6544)6b6b605fix(sec): CVE-2024-39338 (#6539) (#6543)07a661afix(sec): disregard protocol-relative URL to remediate SSRF (#6539)c6cce43chore(release): v1.7.3 (#6521)e3c76fcfix(adapter): fix progress event emitting; (#6518)85d4d0efix(fetch): fix withCredentials request config (#6505)92cd8edchore(github): update ISSUE_TEMPLATE.md (#6519)8966ee7fix(xhr): return original config on errors from XHR adapter (#6515)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.