[PR #4943] [MERGED] chore: bump vulnerable dependencies #4998

New issue

Closed

opened 2026-03-17 02:29:12 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:29:12 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/4943
Author: @AndrewBastin
Created: 3/27/2025
Status: ✅ Merged
Merged: 3/27/2025
Merged by: @jamesgeorge007

Base: next ← Head: fix/security-patches

📝 Commits (2)

648c708 chore: bump axios to 1.8.2 to clear a package cve
40b5418 chore: pin @babel/runtime and caddy build deps to resolve their cves

📊 Changes

10 files changed (+70 additions, -87 deletions)

View changed files

📝 package.json (+2 -1)
📝 packages/hoppscotch-agent/package.json (+1 -1)
📝 packages/hoppscotch-cli/package.json (+1 -1)
📝 packages/hoppscotch-common/package.json (+1 -1)
📝 packages/hoppscotch-kernel/package.json (+1 -1)
📝 packages/hoppscotch-selfhost-desktop/package.json (+1 -1)
📝 packages/hoppscotch-selfhost-web/package.json (+1 -1)
📝 packages/hoppscotch-sh-admin/package.json (+1 -1)
📝 pnpm-lock.yaml (+57 -78)
📝 prod.Dockerfile (+4 -1)

📄 Description

This PR intends to update some of the dependencies in the Hoppscotch dependency chain that have published CVEs.

What's changed

Bump and unify axios versions to 1.8.2 across all workspace packages.
Bump @babel/runtime to 7.26.10
Bump Caddy's build dependency (golang.org/x/net)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/4943 **Author:** [@AndrewBastin](https://github.com/AndrewBastin) **Created:** 3/27/2025 **Status:** ✅ Merged **Merged:** 3/27/2025 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `fix/security-patches` --- ### 📝 Commits (2) - [`648c708`](https://github.com/hoppscotch/hoppscotch/commit/648c7086ad15dcbfea86651cdec377a354d9e999) chore: bump axios to 1.8.2 to clear a package cve - [`40b5418`](https://github.com/hoppscotch/hoppscotch/commit/40b54189e074246b73c868fc2fc738626e04a2be) chore: pin @babel/runtime and caddy build deps to resolve their cves ### 📊 Changes **10 files changed** (+70 additions, -87 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+2 -1) 📝 `packages/hoppscotch-agent/package.json` (+1 -1) 📝 `packages/hoppscotch-cli/package.json` (+1 -1) 📝 `packages/hoppscotch-common/package.json` (+1 -1) 📝 `packages/hoppscotch-kernel/package.json` (+1 -1) 📝 `packages/hoppscotch-selfhost-desktop/package.json` (+1 -1) 📝 `packages/hoppscotch-selfhost-web/package.json` (+1 -1) 📝 `packages/hoppscotch-sh-admin/package.json` (+1 -1) 📝 `pnpm-lock.yaml` (+57 -78) 📝 `prod.Dockerfile` (+4 -1) </details> ### 📄 Description This PR intends to update some of the dependencies in the Hoppscotch dependency chain that have published CVEs. ### What's changed 1. Bump and unify axios versions to 1.8.2 across all workspace packages. 2. Bump @babel/runtime to 7.26.10 3. Bump Caddy's build dependency (`golang.org/x/net`) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>