[Snyk] Upgrade axios from 1.11.0 to 1.13.1 #8871

tingwai · 2025-11-24T23:33:21Z

Snyk has created this PR to upgrade axios from 1.11.0 to 1.13.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 5 versions ahead of your current version.
The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Command Injection SNYK-JS-GLOB-14040952	666	Proof of Concept
Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-12613773	666	Proof of Concept
Prototype Pollution SNYK-JS-JSYAML-13961110	666	No Known Exploit
Directory Traversal SNYK-JS-VITE-13644406	666	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	666	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	666	Proof of Concept
Relative Path Traversal SNYK-JS-VITE-12558116	666	Proof of Concept

Release notes

Package name: axios

1.13.1 - 2025-10-28
Release notes:

Bug Fixes
- http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)
Contributors to this release
- Anchal Singh
- Dmitriy Mozgovoy
1.13.0 - 2025-10-27
Release notes:

Bug Fixes
- fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
- resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)
Features
- http: add HTTP2 support; (#7150) (d676df7)
Contributors to this release
1.12.2 - 2025-09-14
Release notes:

Bug Fixes
- fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (#7030) (cf78825)
Contributors to this release
- Dmitriy Mozgovoy
- Noritaka Kobayashi
1.12.1 - 2025-09-12
Release notes:

Bug Fixes
- types: fixed env config types; (#7020) (b5f26b7)
Contributors to this release
- Dmitriy Mozgovoy
1.12.0 - 2025-09-11
Release notes:

Bug Fixes
- adding build artifacts (9ec86de)
- dont add dist on release (a2edc36)
- fetch-adapter: set correct Content-Type for Node FormData (#6998) (a9f47af)
- node: enforce maxContentLength for data: URLs (#7011) (945435f)
- package exports (#5627) (aa78ac2)
- params: removing '[' and ']' from URL encode exclude characters (#3316) (#5715) (6d84189)
- release pr run (fd7f404)
- types: change the type guard on isCancel (#5595) (0dbb7fd)
Features
- adapter: surface low‑level network error details; attach original error via cause (#6982) (78b290c)
- fetch: add fetch, Request, Response env config variables for the adapter; (#7003) (c959ff2)
- support reviver on JSON.parse (#5926) (2a97634), closes #5924
- types: extend AxiosResponse interface to include custom headers type (#6782) (7960d34)
Contributors to this release
1.11.0 - 2025-07-23
Release notes:

Bug Fixes
- form-data npm pakcage (#6970) (e72c193)
- prevent RangeError when using large Buffers (#6961) (a2214ca)
- types: resolve type discrepancies between ESM and CJS TypeScript declaration files (#6956) (8517aa1)
Contributors to this release

from axios GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Summary by cubic

Upgrade axios to 1.13.1 in the VS Code extension to address a Snyk-reported axios vulnerability and pull in upstream fixes. Improves security and stability with no app code changes.

Dependencies
- axios: ^1.2.5 → ^1.13.1 (extensions/vscode/package.json)

^{Written for commit f3cb5db. Summary will update automatically on new commits.}

Snyk has created this PR to upgrade axios from 1.11.0 to 1.13.1. See this package in npm: axios See this project in Snyk: https://app.snyk.io/org/continue-dev-inc.-default/project/7ff64b12-9373-49d8-a6a5-70de1609223c?utm_source=github&utm_medium=referral&page=upgrade-pr

github-actions · 2025-11-24T23:33:31Z

⚠️ PR Title Format

Your PR title doesn't follow the conventional commit format, but this won't block your PR from being merged. We recommend using this format for better project organization.

Expected Format:

<type>[optional scope]: <description>

Examples:

feat: add changelog generation support
fix: resolve login redirect issue
docs: update README with new instructions
chore: update dependencies

Valid Types:

feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert

This helps with:

📝 Automatic changelog generation
🚀 Automated semantic versioning
📊 Better project history tracking

This is a non-blocking warning - your PR can still be merged without fixing this.

github-actions · 2025-11-24T23:33:50Z

✅ Review Complete

Code Review Summary

⚠️ Continue configuration error. Please verify that the assistant exists in Continue Hub.

continue · 2025-11-24T23:34:07Z

No documentation updates needed - this is a straightforward security dependency upgrade for axios that doesn't affect user-facing features or require configuration changes.

cubic-dev-ai

1 issue found across 1 file

Prompt for AI agents (all 1 issues)


Understand the root cause of the following 1 issues and fix them.


<file name="extensions/vscode/package.json">

<violation number="1" location="extensions/vscode/package.json:736">
`package.json` now declares axios ^1.13.1 but `extensions/vscode/package-lock.json` still locks `node_modules/axios` to version 1.11.0, so installing dependencies keeps the vulnerable release and the security upgrade in this PR never takes effect.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

extensions/vscode/package.json

…nyk-upgrade-6975e61dcfff92a9d30cc91467ad899f

sestinj · 2025-11-26T19:49:33Z

🎉 This PR is included in version 1.36.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

sestinj · 2025-11-26T20:42:09Z

🎉 This PR is included in version 1.7.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

tingwai requested a review from a team as a code owner November 24, 2025 23:33

tingwai requested review from Patrick-Erichsen and removed request for a team November 24, 2025 23:33

github-project-automation bot added this to Issues and PRs Nov 24, 2025

github-project-automation bot moved this to Todo in Issues and PRs Nov 24, 2025

dosubot bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Nov 24, 2025

cubic-dev-ai bot reviewed Nov 24, 2025

View reviewed changes

extensions/vscode/package.json Show resolved Hide resolved

RomneyDa added 2 commits November 25, 2025 11:42

Merge branch 'main' of https://github.com/continuedev/continue into s…

b60a1bd

…nyk-upgrade-6975e61dcfff92a9d30cc91467ad899f

fix: package lock update

f3cb5db

RomneyDa approved these changes Nov 25, 2025

View reviewed changes

github-project-automation bot moved this from Todo to In Progress in Issues and PRs Nov 25, 2025

dosubot bot added the lgtm This PR has been approved by a maintainer label Nov 25, 2025

RomneyDa merged commit 78f904b into main Nov 25, 2025
54 of 58 checks passed

github-project-automation bot moved this from In Progress to Done in Issues and PRs Nov 25, 2025

RomneyDa deleted the snyk-upgrade-6975e61dcfff92a9d30cc91467ad899f branch November 25, 2025 21:08

github-actions bot locked and limited conversation to collaborators Nov 25, 2025

sestinj added the released label Nov 26, 2025

[Snyk] Upgrade axios from 1.11.0 to 1.13.1 #8871

[Snyk] Upgrade axios from 1.11.0 to 1.13.1 #8871

Uh oh!

Conversation

tingwai commented Nov 24, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Snyk has created this PR to upgrade axios from 1.11.0 to 1.13.1.

Issues fixed by the recommended upgrade:

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Features

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Features

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Summary by cubic

Uh oh!

github-actions bot commented Nov 24, 2025

⚠️ PR Title Format

Expected Format:

Examples:

Valid Types:

Uh oh!

github-actions bot commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Uh oh!

continue bot commented Nov 24, 2025

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sestinj commented Nov 26, 2025

Uh oh!

sestinj commented Nov 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tingwai commented Nov 24, 2025 •

edited by cubic-dev-ai bot

Loading

github-actions bot commented Nov 24, 2025 •

edited

Loading