Commit 713a292
committed
fix: upgrade axios to >=1.12.0 to address CVE-2025-58754 DoS vulnerability
Adds a pnpm workspace override to force axios to >=1.12.0, eliminating
the vulnerable axios@1.10.0 brought in transitively via
mintlify -> @mintlify/scraping -> @mintlify/common -> @mintlify/models.
The vulnerability (GHSA-4hjh-wcwx-xvwj) allowed an attacker to supply
a large data: URI causing unbounded memory allocation and process crash
(DoS), bypassing maxContentLength/maxBodyLength guards.
https://claude.ai/code/session_0141PZwEdnJ66b38QFWNtgrY1 parent af5a52a commit 713a292
2 files changed
Lines changed: 6 additions & 13 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2 | 2 | | |
3 | 3 | | |
4 | 4 | | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
5 | 8 | | |
6 | 9 | | |
7 | 10 | | |
| |||
0 commit comments