dependabot[bot] opened a new pull request, #3387:
URL: https://github.com/apache/apisix-dashboard/pull/3387
Bumps [axios](https://github.com/axios/axios) from 1.13.6 to 1.15.2.
Release notes
Sourced from https://github.com/axios/axios/releases";>axios's releases.
v1.15.2
This release delivers prototype-pollution hardening for the Node HTTP
adapter, adds an opt-in allowedSocketPaths allowlist to mitigate
SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships
supply-chain hardening across CI and security docs.
🔒 Security Fixes
Prototype Pollution Hardening (HTTP Adapter): Hardened
the Node HTTP adapter and
resolveConfig/mergeConfig/validator paths to read
only own properties and use null-prototype config objects, preventing polluted
auth, baseURL, socketPath,
beforeRedirect, and insecureHTTPParser from
influencing requests. (https://redirect.github.com/axios/axios/issues/10779";>#10779)
SSRF via socketPath: Rejects non-string
socketPath values and adds an opt-in
allowedSocketPaths config option to restrict permitted Unix domain
socket paths, returning AxiosError
ERR_BAD_OPTION_VALUE on mismatch. (https://redirect.github.com/axios/axios/issues/10777";>#10777)
Supply-chain Hardening: Added .npmrc with
ignore-scripts=true, lockfile lint CI, non-blocking reproducible
build diff, scoped CODEOWNERS, expanded
SECURITY.md/THREATMODEL.md with provenance
verification (npm audit signatures), 60-day resolution policy, and
maintainer incident-response runbook. (https://redirect.github.com/axios/axios/issues/10776";>#10776)
🚀 New Features
allowedSocketPaths Config Option: New
request config option (and TypeScript types) to allowlist Unix domain socket
paths used by the Node http adapter; backwards compatible when unset.
(https://redirect.github.com/axios/axios/issues/10777";>#10777)
🐛 Bug Fixes
Keep-alive Socket Memory Leak: Installs a single
per-socket error listener tracking the active request via
kAxiosSocketListener/kAxiosCurrentReq, eliminating
per-request listener accumulation, MaxListenersExceededWarning,
and linear heap growth under concurrent or long-running keep-alive workloads
(fixes https://redirect.github.com/axios/axios/issues/10780";>#10780).
(https://redirect.github.com/axios/axios/issues/10788";>#10788)
🔧 Maintenance & Chores
Changelog: Updated CHANGELOG.md with
v1.15.1 release notes. (https://redirect.github.com/axios/axios/issues/10781";>#10781)
https://github.com/axios/axios/compare/v1.15.1...v1.15.2";>Full
Changelog
v1.15.1
This release ships a coordinated set of security hardening fixes across
headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution
vectors, alongside a broad sweep of bug fixes, test migrations, and
threat-model documentation updates.
🔒 Security Fixes
Header Injection Hardening: Tightened validation and
sanitisation across request header construction to close the header-injection
attack surface. (https://redirect.github.com/axios/axios/issues/10749";>#10749)
CRLF Stripping in Multipart Headers: Correctly strips
CR/LF from multipart header values to prevent injection via field names and
filenames. (https://redirect.github.com/axios/axios/issues/10758";>#10758)
Prototype Pollution / Auth Bypass: Replaced unsafe
in checks with hasOwnProperty to prevent
authentication bypass via prototype pollution on config objects, with
additional regression tests. (https://redirect.github.com/axios/axios/issues/10761";>#10761,
https://redirect.github.com/axios/axios/issues/10760";>#10760)
withXSRFToken Truthy Bypass:
Short-circuits on any truthy non-boolean value, so an ambiguous config no
longer silently leaks the XSRF token cross-origin. (https://redirect.github.com/axios/axios/issues/10762";>#10762)
maxBodyLength With Zero Redirects:
Enforces maxBodyLength even when maxRedirects is set
to 0, closing a bypass path for oversized request bodies.
(https://redirect.github.com/axios/axios/issues/10753";>#10753)
Streamed Response maxContentLength Bypass:
Applies maxContentLength to streamed responses that previously
bypassed the cap. (https://redirect.github.com/axios/axios/issues/10754";>#10754)
Follow-up CVE Completion: Completes an earlier
incomplete CVE fix to fully close the regression window. (https://redirect.github.com/axios/axios/issues/10755";>#10755)
🚀 New Features
AI-Based Docs Translations: Initial scaffold for
AI-assisted translations of the documentation site. (https://redirect.github.com/axios/axios/issues/10705";>#10705)
Location Request Header Type: Adds
Location to CommonRequestHeadersList for accurate
typing of redirect-aware requests. (https://redirect.github.com/axios/axios/issues/7528";>#7528)
🐛 Bug Fixes
FormData Handling: Removes Content-Type
when no boundary is present on FormData fetch requests, supports
multi-select fields, ca
