[4.x]: upgrade vulnerable axios 0.27.2

[d--j]

What happened?

Description

axios 0.27.2 has these two vulnerabilities:

• Regular Expression Denial of Service (ReDoS) in axios/axios axios/axios#6131
• GHSA-wf5p-g6vw-rhxx

Please upgrade axios to 0.28.1

cms/package.json

Line 36 in 4b05a2f

"axios": "^0.27.2",

At least GHSA-wf5p-g6vw-rhxx has been fixed in there. axios/axios#6131 has only been fixed in 1.6.3 but upgrading to this version would probably be a breaking change and it is "only" a ReDoS attack.

Steps to reproduce

1. Navigate to the following URL: https://example.com/admin/login
2. Open the browser's built in developer tools
3. Enter the following string into the JavaScript console: axios.VERSION
4. Note that the application includes a version of Axios 0.27.2 which has known security issues associated with it

Craft CMS version

4.10.7

PHP version

No response

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

No response

[brandonkelly]

Thanks for reporting that! I’ve updated Axios to 0.28.1 for the next Craft 4 release. (Craft 5 is already running 1.6.5.)