[PR #826] [MERGED] chore(deps-dev): bump axios from 0.30.2 to 0.30.3 in /web #825

New issue

Closed

opened 2026-03-03 16:40:18 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 16:40:18 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/NdoleStudio/httpsms/pull/826
Author: @dependabot[bot]
Created: 2/20/2026
Status: ✅ Merged
Merged: 2/24/2026
Merged by: @AchoArnold

Base: main ← Head: dependabot/npm_and_yarn/web/axios-0.30.3

📝 Commits (1)

7a6a0c5 chore(deps-dev): bump axios from 0.30.2 to 0.30.3 in /web

📊 Changes

2 files changed (+18 additions, -17 deletions)

View changed files

📝 web/package.json (+1 -1)
📝 web/pnpm-lock.yaml (+17 -16)

📄 Description

Bumps axios from 0.30.2 to 0.30.3.

Release notes

Sourced from axios's releases.

Release notes - v0.30.3

This is a critical security maintenance release for the v0.x branch. It addresses a high-priority vulnerability involving prototype pollution that could lead to a Denial of Service (DoS).

Recommendation: All users currently on the 0.x release line should upgrade to this version immediately to ensure environment stability.

🛡️ Security Fixes

Backport: Fix DoS via proto key in merge config

Patched a vulnerability where specifically crafted configuration objects using the proto key could cause a Denial of Service during the merge process. - by @FeBe95 in [PR #7388](axios/axios#7388)

⚙️ Maintenance & CI

CI Infrastructure Update

Updated Continuous Integration workflows for the v0.x branch to maintain long-term support and build reliability. - by @jasonsaayman in [PR #7407](axios/axios#7407)

⚠️ Breaking Changes

Configuration Merging Behavior:

As part of the security fix, Axios now restricts the merging of the proto key within configuration objects. If your codebase relies on unconventional deep-merging patterns that target the object prototype via Axios config, those operations will now be blocked. This is a necessary change to prevent prototype pollution.

Full Changelog: v0.30.2...v0.30.3

Commits

f53bcf6 chore: release 0.30.2
3ddccd3 chore: remove publish as this wont work
9ef39d0 chore: try with npm token
4775de6 chore: fix version scheme
f96f26b chore: fix issues with using replace
ead45c2 chore: update the publish workflow to run on tag
8119265 chore: tag version as legacy on v0.x
9954985 chore: dispatch for first time
3f8b70f chore: final rename
c665584 chore: revert naming
Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
axios	[>= 1.a, < 2]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/NdoleStudio/httpsms/pull/826 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 2/20/2026 **Status:** ✅ Merged **Merged:** 2/24/2026 **Merged by:** [@AchoArnold](https://github.com/AchoArnold) **Base:** `main` ← **Head:** `dependabot/npm_and_yarn/web/axios-0.30.3` --- ### 📝 Commits (1) - [`7a6a0c5`](https://github.com/NdoleStudio/httpsms/commit/7a6a0c539d91a845b402bb4e74d0e202355d3114) chore(deps-dev): bump axios from 0.30.2 to 0.30.3 in /web ### 📊 Changes **2 files changed** (+18 additions, -17 deletions) <details> <summary>View changed files</summary> 📝 `web/package.json` (+1 -1) 📝 `web/pnpm-lock.yaml` (+17 -16) </details> ### 📄 Description Bumps [axios](https://github.com/axios/axios) from 0.30.2 to 0.30.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>Release notes - v0.30.3</h2> <p>This is a critical security maintenance release for the v0.x branch. It addresses a high-priority vulnerability involving prototype pollution that could lead to a Denial of Service (DoS).</p> <p>Recommendation: All users currently on the 0.x release line should upgrade to this version immediately to ensure environment stability.</p> <h2>🛡️ Security Fixes</h2> <ul> <li><strong>Backport: Fix DoS via <strong>proto</strong> key in merge config</strong> <ul> <li>Patched a vulnerability where specifically crafted configuration objects using the <strong>proto</strong> key could cause a Denial of Service during the merge process. - <em>by <a href="https://github.com/FeBe95"><code>@FeBe95</code></a> in [PR <a href="https://redirect.github.com/axios/axios/issues/7388">#7388</a>](<a href="https://redirect.github.com/axios/axios/pull/7388">axios/axios#7388</a>)</em></li> </ul> </li> </ul> <h2>⚙️ Maintenance & CI</h2> <ul> <li><strong>CI Infrastructure Update</strong> <ul> <li>Updated Continuous Integration workflows for the v0.x branch to maintain long-term support and build reliability. - <em>by <a href="https://github.com/jasonsaayman"><code>@jasonsaayman</code></a> in [PR <a href="https://redirect.github.com/axios/axios/issues/7407">#7407</a>](<a href="https://redirect.github.com/axios/axios/pull/7407">axios/axios#7407</a>)</em></li> </ul> </li> </ul> <h2>⚠️ Breaking Changes</h2> <p>Configuration Merging Behavior:</p> <p>As part of the security fix, Axios now restricts the merging of the <strong>proto</strong> key within configuration objects. If your codebase relies on unconventional deep-merging patterns that target the object prototype via Axios config, those operations will now be blocked. This is a necessary change to prevent prototype pollution.</p> <p>Full Changelog: <a href="https://github.com/axios/axios/compare/v0.30.2...v0.30.3">v0.30.2...v0.30.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/f53bcf6c3747652c9d3811dc0bbcd3674e21567a"><code>f53bcf6</code></a> chore: release 0.30.2</li> <li><a href="https://github.com/axios/axios/commit/3ddccd3bf478c8aab863f2fdd4a52461849eab45"><code>3ddccd3</code></a> chore: remove publish as this wont work</li> <li><a href="https://github.com/axios/axios/commit/9ef39d07245286df678c1a16e7b5769610ba8326"><code>9ef39d0</code></a> chore: try with npm token</li> <li><a href="https://github.com/axios/axios/commit/4775de601df704d8d4e7336a57b08a2e21de8ff4"><code>4775de6</code></a> chore: fix version scheme</li> <li><a href="https://github.com/axios/axios/commit/f96f26b2014404534424e765b83a1dbbd8cb091f"><code>f96f26b</code></a> chore: fix issues with using replace</li> <li><a href="https://github.com/axios/axios/commit/ead45c20b05ab32c26cb63d0f7a20e8b123d9f68"><code>ead45c2</code></a> chore: update the publish workflow to run on tag</li> <li><a href="https://github.com/axios/axios/commit/8119265e6ce71898d19448d30356789cccc2de56"><code>8119265</code></a> chore: tag version as legacy on v0.x</li> <li><a href="https://github.com/axios/axios/commit/995498519881c23ba97b42dda16bcadc0e4791a7"><code>9954985</code></a> chore: dispatch for first time</li> <li><a href="https://github.com/axios/axios/commit/3f8b70fdfc7903aa137ea4f6539cd00f5df97afb"><code>3f8b70f</code></a> chore: final rename</li> <li><a href="https://github.com/axios/axios/commit/c66558430e71cf0c113a2969355cde25cb159fff"><code>c665584</code></a> chore: revert naming</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v0.30.2...v0.30.3">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | axios | [>= 1.a, < 2] | </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axios&package-manager=npm_and_yarn&previous-version=0.30.2&new-version=0.30.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/NdoleStudio/httpsms/network/alerts). </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>