Server-Side Request Forgery in axios (CVE-2024-39338) - update to axios 1.7.4 needed

[MikeMcC399]

Server-Side Request Forgery in axios reports a High Severity vulnerability in the npm package axios >= 1.3.2, <= 1.7.3

wait-on is currently configured with

wait-on/package.json

Lines 40 to 41 in a10322f

	"dependencies": {
	"axios": "^1.6.1",

To avoid use of vulnerable versions of axios, I suggest that wait-on update to axios@^1.7.4.

Workaround

For npm environments:

npm audit fix

[markrzen]

@jeffbski Any chance you would be interested in adding a contributor to this project to help keep it updated?

[MikeMcC399]

Related to this issue and addressed to @jeffbski

• Are you planning to update axios yourself to resolve this issue?
• If somebody else submits a PR to update axios would you review and merge it?

[MikeMcC399]

• Resolved by update [email protected] and other minor #162
• Released in https://github.com/jeffbski/wait-on/releases/tag/v8.0.0