[Snyk] Fix for 8 vulnerabilities

[niravparikh05]

Snyk has created this PR to fix 8 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json
• yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncontrolled Recursion SNYK-JS-AXIOS-18060730	738
	Prototype Pollution SNYK-JS-AXIOS-18065351	738
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-18060165	708
	Uncontrolled Recursion SNYK-JS-AXIOS-18060167	708
	Prototype Pollution SNYK-JS-AXIOS-18060659	708
	Prototype Pollution SNYK-JS-AXIOS-18065349	708
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-18065353	708
	Prototype Pollution SNYK-JS-AXIOS-18065355	708

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Uncontrolled Recursion
🦉 Prototype Pollution

[niravparikh05]

This update includes a minor version bump for axios which contains multiple security-driven behavioral changes, and a no-op version normalization for @ory/kratos-client.

axios 1.6.8 → 1.18.0 (Medium Risk)

This upgrade spans multiple releases focused on hardening security. While there are no major API removals, the changes introduce stricter validation and behavior that could impact existing applications. Careful verification is recommended.

Key Changes & Potential Impacts:

• Stricter URL Validation: Malformed URLs (e.g., http:example.com without //) will now be rejected with an ERR_INVALID_URL error. Applications constructing URLs in a non-standard way may break. [1, 2]
• Redirect Header Safety: To prevent credential leakage, sensitive headers like Authorization may be stripped during cross-origin redirects. This is a security enhancement but could affect complex authentication flows involving redirects. [1, 2, 3]
• Proxy & Request Hardening: The update includes numerous fixes for prototype pollution and server-side request forgery (SSRF). These changes harden how configuration and proxy settings are handled, preventing values inherited from Object.prototype from affecting requests. [2, 9, 10]
• Body Length Enforcement: The fetch adapter now correctly enforces maxBodyLength and maxContentLength, which was previously ignored. Requests with large bodies using the fetch adapter may now fail if they exceed configured limits. [1, 2]

Recommendation:
Review and test application logic related to URL construction, requests that involve redirects (especially cross-origin), and requests made through a proxy. Ensure that tests cover scenarios with potentially malformed URLs and large request bodies.

@ory/kratos-client v25.4.0 → 25.4.0 (Low Risk)

This is a version normalization and not a functional change. The v prefix is a common convention in version control tags but does not signify a different package version.

Source: Axios GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.