The version of axios that tron ​​is using seems to have a vulnerability. Should we consider upgrading?

[mycodeku]

I recently saw a vulnerability reported in axios, named CVE-2026-40175. It seems the axios package in the Tron package also has this vulnerability; should we consider upgrading it? Here is a link to the vulnerability description:https://nvd.nist.gov/vuln/detail/CVE-2026-40175

[Stan202310]

We will fix it in the next version. Stay tuned.

[Stan202310]

TronWeb v6.3.0 has been released, which fixes this issue.

[cbarlow1993]

@Stan202310 - unfortunately it still looks to be bundled with axios 1.15 and flagging alarms on package audits. Can we follow up with a fix to this?

[Stan202310]

@Stan202310 - unfortunately it still looks to be bundled with axios 1.15 and flagging alarms on package audits. Can we follow up with a fix to this?

This is a newly reported issue after the latest release. We’ll fix it in the next version.

[scottrepreneur]

• bump. looks like chore: fix npm audit vulnerabilities #706 addresses this

[Stan202310]

This vulnerability has been fixed in TronWeb v6.4.0. Feel free to try it out.