ryanrosello-og / playwright-slack-report / 24389489373

81%

push

github

[WIP] Fix axios hostname normalization bypass issue (#387)

* Initial plan

* fix(security): upgrade @slack/web-api to 7.15.1 to resolve axios CVEs

Upgrade @slack/web-api from ^7.14.1 to ^7.15.1 which depends on
axios@^1.15.0 (patched). Add resolutions field to pin axios >= 1.15.0
as a safety net.

Fixes:
- GHSA-3p68-rc4w-qgx5 (Axios NO_PROXY Hostname Normalization Bypass / SSRF)
- GHSA-fvcv-3m26-pcqx (Axios Unrestricted Cloud Metadata Exfiltration)

Agent-Logs-Url: https://github.com/ryanrosello-og/playwright-slack-report/sessions/ae6d565e-b2d9-48db-8485-bdfced370095

Co-authored-by: ryanrosello-og <50574915+ryanrosello-og@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: ryanrosello-og <50574915+ryanrosello-og@users.noreply.github.com>

189 of 248 branches covered (76.21%)

Branch coverage included in aggregate %.

303 of 359 relevant lines covered (84.4%)

12.98 hits per line