chore(deps): bump axios, @axelar-network/axelarjs-sdk and twilio#528
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): bump axios, @axelar-network/axelarjs-sdk and twilio#528dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [axios](https://github.com/axios/axios), [@axelar-network/axelarjs-sdk](https://github.com/axelarnetwork/axelarjs-sdk) and [twilio](https://github.com/twilio/twilio-node). These dependencies needed to be updated together. Updates `axios` from 1.6.0 to 1.18.1 - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.6.0...v1.18.1) Updates `@axelar-network/axelarjs-sdk` from 0.13.6 to 0.21.0 - [Release notes](https://github.com/axelarnetwork/axelarjs-sdk/releases) - [Changelog](https://github.com/axelarnetwork/axelarjs-sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/axelarnetwork/axelarjs-sdk/commits) Updates `twilio` from 3.84.1 to 6.0.2 - [Release notes](https://github.com/twilio/twilio-node/releases) - [Changelog](https://github.com/twilio/twilio-node/blob/main/CHANGES.md) - [Upgrade guide](https://github.com/twilio/twilio-node/blob/main/UPGRADE.md) - [Commits](twilio/twilio-node@3.84.1...6.0.2) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.1 dependency-type: direct:production - dependency-name: "@axelar-network/axelarjs-sdk" dependency-version: 0.21.0 dependency-type: direct:production - dependency-name: twilio dependency-version: 6.0.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 security issue
Security issues:
- LGPL-3.0-only: Open-source license can require releasing the entire application source (link)
Fixed security issues:
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="package-lock.json" line_range="41816-41838" />
<code_context>
</code_context>
<issue_to_address>
**security (license/rpc-websockets):** LGPL-3.0-only: Open-source license can require releasing the entire application source
This `LGPL-3.0-only` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+41816
to
+41838
| "node_modules/rpc-websockets": { | ||
| "version": "9.3.9", | ||
| "resolved": "https://registry.npmjs.org/rpc-websockets/-/rpc-websockets-9.3.9.tgz", | ||
| "integrity": "sha512-2iQDaTB4g5fDB2ihrTFSJSibCEuxaRi1q7qTW7ZO9/M5/TC+ToHA4D9/ffNLEbAoHNNrcdeP05oATNk44SKZXA==", | ||
| "license": "LGPL-3.0-only", | ||
| "dependencies": { | ||
| "@swc/helpers": "^0.5.11", | ||
| "@types/uuid": "^10.0.0", | ||
| "@types/ws": "^8.2.2", | ||
| "buffer": "^6.0.3", | ||
| "eventemitter3": "^5.0.1", | ||
| "uuid": "^14.0.0", | ||
| "ws": "^8.5.0" | ||
| }, | ||
| "funding": { | ||
| "type": "paypal", | ||
| "url": "https://paypal.me/kozjak" | ||
| }, | ||
| "optionalDependencies": { | ||
| "bufferutil": "^4.0.1", | ||
| "utf-8-validate": "^6.0.0" | ||
| } | ||
| }, |
Contributor
There was a problem hiding this comment.
security (license/rpc-websockets): LGPL-3.0-only: Open-source license can require releasing the entire application source
This LGPL-3.0-only open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps axios, @axelar-network/axelarjs-sdk and twilio. These dependencies needed to be updated together.
Updates
axiosfrom 1.6.0 to 1.18.1Changelog
Sourced from axios's changelog.
... (truncated)
Commits
a209bfbchore(release): prepare release 1.18.1 (#11027)fa6a55echore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)40e7be8docs: clarifies that request data is request-specific in axios (#11025)a446b39fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...cf1306adocs: add Deno to install instructions (#11023)b32880afix: incorrect use of error (#11021)1792edafix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)30499d6fix: various runtime crashes and type definition mismatches (#10959)20ce9c4fix(http): defer env proxy handling to Node (#10942)e64bcf9chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@axelar-network/axelarjs-sdkfrom 0.13.6 to 0.21.0Changelog
Sourced from @axelar-network/axelarjs-sdk's changelog.
... (truncated)
Commits
Maintainer changes
This version was pushed to npm by eng_axelar, a new releaser for
@axelar-network/axelarjs-sdksince your current version.Updates
twiliofrom 3.84.1 to 6.0.2Release notes
Sourced from twilio's releases.
... (truncated)
Changelog
Sourced from twilio's changelog.
... (truncated)
Upgrade guide
Sourced from twilio's upgrade guide.
... (truncated)
Commits
e9e5469Release 6.0.2fd93dfa[Librarian] Regenerated @ d39d243cf0f072a87b06d80cfd5d04f77cde8481 18d7938080...c4d7168Release 6.0.104a89ce[Librarian] Regenerated @ d39d243cf0f072a87b06d80cfd5d04f77cde8481 e2fda0239d...d6b406f[Librarian] Regenerated @ 40ca64a22aef42a337cb49d1d4e4c4f48ae3b6e4 21ed5806ef...3e96b64chore: mvr 6.0.0 release prep (#1186)447a23dRelease 5.13.26267242[Librarian] Regenerated @ 40ca64a22aef42a337cb49d1d4e4c4f48ae3b6e4 21ed5806ef...462c49dRelease 5.13.1764868e[Librarian] Regenerated @ 6e3b90a45885c596ade6b11ff7100254b15c9403 c02f66cc96...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for twilio since your current version.
Install script changes
This version adds
prepublishscript that runs during installation. Review the package contents before updating.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.