chore(deps): override axios to ^1.15.2 to patch transitive 1.15.0#2419
Merged
jpgough-ms merged 2 commits intofinos:mainfrom May 6, 2026
Merged
Conversation
The hoisted root node_modules/axios was stuck at 1.15.0 (pulled in via axios-mock-adapter's `axios: ">= 0.17.0"` peer dep) even after PR finos#2417 bumped the workspace direct deps to 1.15.2. Workspace-only updates don't touch the root tree, so 10 Dependabot alerts (4 high) stayed open against the transitive copy: - GHSA-pf86-5x62-jrwf (high): Prototype Pollution Gadgets - GHSA-6chq-wfr3-2hj9 (high): Header Injection via Prototype Pollution - GHSA-pmwg-cvhr-8vh7 (high): NO_PROXY Bypass via 127.0.0.0/8 in 1.15.0 - GHSA-q8qp-cvcw-x6jj (high): Prototype Pollution in HTTP adapter - GHSA-445q-vr5w-6q77, GHSA-m7pr-hjqh-92cm, GHSA-xx6v-rp6x-q39c, GHSA-w9j2-pvgh-6h63, GHSA-3w6x-2g7m-8v23, GHSA-xhjh-pmcv-23jw Adding `axios: ^1.15.2` to the root overrides forces npm to resolve a single hoisted copy that satisfies every consumer. The lockfile now collapses calm-hub-ui/cli/shared nested copies into one root entry at 1.16.0, the highest match of the override. `npm audit` reports axios clean. Signed-off-by: Matthew Bain <matt@rocketstack.co>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses unresolved security alerts caused by a hoisted, transitive root axios install staying on a vulnerable version despite workspace-level bumps, by enforcing a safe minimum via root-level overrides.
Changes:
- Added a root
overridesentry foraxios(^1.15.2) to force the hoisted/root resolution off1.15.0. - Regenerated
package-lock.jsonsoaxiosis hoisted and resolved to1.16.0, collapsing prior per-workspace duplicate installs.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Adds a root overrides rule to force axios to a patched range. |
| package-lock.json | Updates the lockfile to reflect the new override/hoisting (root axios now resolves to 1.16.0). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jpgough-ms
approved these changes
May 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The hoisted root
node_modules/axioswas stuck at 1.15.0 even after #2417 bumped the workspace direct deps to 1.15.2. The root copy is pulled in to satisfyaxios-mock-adapter'saxios: ">= 0.17.0"peer dep, and--workspace-scoped installs don't update the root tree, so 10 Dependabot alerts (4 high-severity) stayed open against the transitive copy.This PR adds
axios: ^1.15.2to the rootoverridesblock inpackage.json. Afternpm install --package-lock-onlythe lockfile collapses the per-workspacecalm-hub-ui/,cli/, andshared/node_modules/axioscopies into a single hoisted root entry at 1.16.0 (the highest match for^1.15.2).npm auditreports axios clean afterwards. Same pattern as the existingpicomatch,serialize-javascript,qs,lodash, etc. overrides.Vulnerabilities resolved
validateStatusparseReviverWhy Dependabot didn't catch this on its own
Run 25385074152 was green but raised no PR: it inspected the workspace direct deps (already at 1.15.2 after #2417) and the GroupDependencySelector correctly filtered them out — but Dependabot doesn't re-probe the transitive root tree, so the still-vulnerable hoisted 1.15.0 was never seen.
Type of Change
Affected Components
cli/)calm/)calm-ai/)calm-hub/)calm-hub-ui/)calm-server/)calm-widgets/)docs/)shared/)calm-plugins/vscode/)Testing
Verified locally:
npm install --package-lock-only --ignore-scriptsregenerates the lockfile cleanlynode_modules/axiosresolves to 1.16.0, all four nested workspace copies collapse into the rootnpm auditreports axios clean (no remaining axios advisories); other unrelated package vulns are out of scopeChecklist