Update dependency axios to v0.21.2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	0.21.1 → 0.21.2

---

axios Inefficient Regular Expression Complexity vulnerability

CVE-2021-3749 / GHSA-cph5-m8f7-6c5x

More information

Details

axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3749
• https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
• https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31
• https://www.npmjs.com/package/axios
• https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a@%3Cdev.druid.apache.org%3E
• https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103@​%3Ccommits.druid.apache.org%3E
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/advisories/GHSA-cph5-m8f7-6c5x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

axios/axios (axios)

v0.21.2

Compare Source

Fixes and Functionality:

• Updating axios requests to be delayed by pre-emptive promise creation (#​2702)
• Adding "synchronous" and "runWhen" options to interceptors api (#​2702)
• Updating of transformResponse (#​3377)
• Adding ability to omit User-Agent header (#​3703)
• Adding multiple JSON improvements (#​3688, #​3763)
• Fixing quadratic runtime and extra memory usage when setting a maxContentLength (#​3738)
• Adding parseInt to config.timeout (#​3781)
• Adding custom return type support to interceptor (#​3783)
• Adding security fix for ReDoS vulnerability (#​3980)

Internal and Tests:

• Updating build dev dependancies (#​3401)
• Fixing builds running on Travis CI (#​3538)
• Updating follow rediect version (#​3694, #​3771)
• Updating karma sauce launcher to fix failing sauce tests (#​3712, #​3717)
• Updating content-type header for application/json to not contain charset field, according do RFC 8259 (#​2154)
• Fixing tests by bumping karma-sauce-launcher version (#​3813)
• Changing testing process from Travis CI to GitHub Actions (#​3938)

Documentation:

• Updating documentation around the use of AUTH_TOKEN with multiple domain endpoints (#​3539)
• Remove duplication of item in changelog (#​3523)
• Fixing gramatical errors (#​2642)
• Fixing spelling error (#​3567)
• Moving gitpod metion (#​2637)
• Adding new axios documentation website link (#​3681, #​3707)
• Updating documentation around dispatching requests (#​3772)
• Adding documentation for the type guard isAxiosError (#​3767)
• Adding explanation of cancel token (#​3803)
• Updating CI status badge (#​3953)
• Fixing errors with JSON documentation (#​3936)
• Fixing README typo under Request Config (#​3825)
• Adding axios-multi-api to the ecosystem file (#​3817)
• Adding SECURITY.md to properly disclose security vulnerabilities (#​3981)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Sasha Korotkov
• Daniel Lopretto
• Mike Bishop
• Dmitriy Mozgovoy
• Mark
• Philipe Gouveia Paixão
• hippo
• ready-research
• Xianming Zhong
• Christopher Chrapka
• Brian Anglin
• Kohta Ito
• Ali Clark
• caikan
• Elina Gorshkova
• Ryota Ikezawa
• Nisar Hassan Naqvi
• Jake
• TagawaHirotaka
• Johannes Jarbratt
• Mo Sattler
• Sam Carlton
• Matt Czapliński
• Ziding Zhang

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: islanders-client/package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: @vue/cli-plugin-eslint@4.5.11
npm ERR! Found: eslint@7.20.0
npm ERR! node_modules/eslint
npm ERR!   peer eslint@">=7.5.0" from @babel/eslint-parser@7.12.16
npm ERR!   node_modules/@babel/eslint-parser
npm ERR!     dev @babel/eslint-parser@"^7.12.16" from the root project
npm ERR!   peer eslint@"^5.0.0 || ^6.0.0 || ^7.0.0" from @typescript-eslint/eslint-plugin@4.15.0
npm ERR!   node_modules/@typescript-eslint/eslint-plugin
npm ERR!     peer @typescript-eslint/eslint-plugin@"^4.4.0" from @vue/eslint-config-typescript@7.0.0
npm ERR!     node_modules/@vue/eslint-config-typescript
npm ERR!       dev @vue/eslint-config-typescript@"^7.0.0" from the root project
npm ERR!     dev @typescript-eslint/eslint-plugin@"^4.15.0" from the root project
npm ERR!   14 more (@typescript-eslint/experimental-utils, ...)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer eslint@">= 1.6.0 < 7.0.0" from @vue/cli-plugin-eslint@4.5.11
npm ERR! node_modules/@vue/cli-plugin-eslint
npm ERR!   dev @vue/cli-plugin-eslint@"~4.5.0" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: eslint@6.8.0
npm ERR! node_modules/eslint
npm ERR!   peer eslint@">= 1.6.0 < 7.0.0" from @vue/cli-plugin-eslint@4.5.11
npm ERR!   node_modules/@vue/cli-plugin-eslint
npm ERR!     dev @vue/cli-plugin-eslint@"~4.5.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-05-01T08_51_29_402Z-debug-0.log

File name: islanders-client/yarn.lock

Unknown Syntax Error: Unsupported option name ("--ignore-platform").

$ yarn install [--json] [--immutable] [--immutable-cache] [--check-cache] [--inline-builds] [--skip-builds]