fix: upgrade kratos typescript client to axios v1.x [security]

This fixes https://nvd.nist.gov/vuln/detail/CVE-2023-45857 which is an issue discovered in Axios 0.8.1 through 1.5.1 that inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information. Signed-off-by: Lucian Buzzo <[email protected]>
ory · Nov 13, 2023 · 25136a9 · 25136a9
1 parent 39d9428
commit 25136a9
Show file tree

Hide file tree

Showing 2 changed files with 122 additions and 11 deletions.
diff --git a/clients/kratos/typescript/package-lock.json b/clients/kratos/typescript/package-lock.json
diff --git a/clients/kratos/typescript/package.json b/clients/kratos/typescript/package.json
@@ -18,10 +18,10 @@
     "prepare": "npm run build"
   },
   "dependencies": {
-    "axios": "^0.21.4"
+    "axios": "^1.0.0"
   },
   "devDependencies": {
     "@types/node": "^12.11.5",
     "typescript": "^3.6.4"
   }
-}
+}