Bootstrap
Bootstrap 5.3.3 w/ Axios Cross-Site Request Forgery Vulnerability #39907
-
|
Bootstrap 5.3.3 - Uses Axios 0.24.0 Is there an "easy" way for us to fix this issue painlessly in bootstrap source on our end and/or is this a really big deal and should be opened as an issue on the twbs-bootstrap public feed page? How we got here, if it matters:Installed NPM and Node locally and am running through VS Code on Windows 10: Downloaded Bootstrap 5.3.3 Source code and unzipped to sub-folder under custom-bootstrap project folder. PS C:\custom-bootstrap> npm install C:\custom-bootstrap\bootstrap-source\bootstrap-5.3.3 --save-dev 218 packages are looking for funding 2 moderate severity vulnerabilities Some issues need review, and may require choosing Run npm audit reportaxios 0.8.1 - 0.27.2 2 moderate severity vulnerabilities Some issues need review, and may require choosing |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment
-
|
From our "node_modules/bundlewatch": {
"version": "0.3.3",
"resolved": "https://registry.npmjs.org/bundlewatch/-/bundlewatch-0.3.3.tgz",
"integrity": "sha512-qzSVWrZyyWXa546JpAPRPTFmnXms9YNVnfzB05DRJKmN6wRRa7SkxE4OgKQmbAY74Z6CM2mKAc6vwvd2R+1lUQ==",
"dev": true,
"dependencies": {
"axios": "^0.24.0",Bundlewatch is only used by our CI (or manually locally) to checks file sizes, ensuring bundled browser assets don't jump in file size; it's not embedded into the Bootstrap bundle files. |
Beta Was this translation helpful? Give feedback.
From our
package-lock.json, it can be seen thataxiosis a dependency coming frombundlewatch:Bundlewatch is only used by our CI (or manually locally) to checks file sizes, ensuring bundled browser assets don't jump in file size; it's not embedded into the Bootstrap bundle files.
IMO, there's no need on your end to fix this issue.