fix(core): upgrade axios to 1.12.0 to address CVE-2025-58754 #32712
+88
−64
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
View your CI Pipeline Execution ↗ for commit 733d322
☁️ Nx Cloud last updated this comment at |
JamesHenry
approved these changes
Sep 12, 2025
|
@JamesHenry I totally agree. Just feel like it's always a good idea to address security advisories even though Nx doesn't have a public-facing API so a DOS attack vector is not relevant here. |
|
@terrymun Sorry you need to redo your commit to match the required conventions (you can see what I did to the PR title). We have a precommit hook to catch this so you must have bypassed it? |
There was a problem hiding this comment.
Nx Cloud is proposing a fix for your failed CI:
chore(repo): upgrade axios to 1.12.0 to address CVE-2025-58754
We verified this fix by re-running @nx/nx-source:check-commit.
Suggested Fix changes
diff --git a/package.json b/package.json
index 8be780920a1..da86c04ccd0 100644
--- a/package.json
+++ b/package.json
@@ -367,7 +367,7 @@
"@types/three": "^0.166.0",
"@yarnpkg/lockfile": "^1.1.0",
"@yarnpkg/parsers": "3.0.2",
- "axios": "^1.8.3",
+ "axios": "^1.12.0",
"classnames": "^2.5.1",
"cliui": "^8.0.1",
"clsx": "^2.0.0",
diff --git a/packages/create-nx-workspace/package.json b/packages/create-nx-workspace/package.json
index 149c7492679..9888fff5f3d 100644
--- a/packages/create-nx-workspace/package.json
+++ b/packages/create-nx-workspace/package.json
@@ -30,14 +30,14 @@
},
"homepage": "https://nx.dev",
"dependencies": {
+ "axios": "^1.12.0",
"chalk": "^4.1.0",
"enquirer": "~2.3.6",
"flat": "^5.0.2",
"ora": "5.3.0",
"tmp": "~0.2.1",
"tslib": "^2.3.0",
- "yargs": "^17.6.2",
- "axios": "^1.8.3"
+ "yargs": "^17.6.2"
},
"publishConfig": {
"access": "public"
diff --git a/packages/nx/package.json b/packages/nx/package.json
index d56a59f2522..c5fb5185786 100644
--- a/packages/nx/package.json
+++ b/packages/nx/package.json
@@ -41,7 +41,7 @@
"@yarnpkg/lockfile": "^1.1.0",
"@yarnpkg/parsers": "3.0.2",
"@zkochan/js-yaml": "0.0.7",
- "axios": "^1.8.3",
+ "axios": "^1.12.0",
"chalk": "^4.1.0",
"cli-cursor": "3.1.0",
"cli-spinners": "2.6.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 76d8e6baadb..a554c13f431 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -82,8 +82,8 @@
specifier: 3.0.2
version: 3.0.2
axios:
- specifier: ^1.8.3
- version: 1.10.0
+ specifier: ^1.12.0
+ version: 1.12.0
classnames:
specifier: ^2.5.1
version: 2.5.1
@@ -2593,8 +2593,8 @@
packages/create-nx-workspace:
dependencies:
axios:
- specifier: ^1.8.3
- version: 1.10.0
+ specifier: ^1.12.0
+ version: 1.12.0
chalk:
specifier: ^4.1.0
version: 4.1.2
@@ -3252,8 +3252,8 @@
specifier: 0.0.7
version: 0.0.7
axios:
- specifier: ^1.8.3
- version: 1.10.0
+ specifier: ^1.12.0
+ version: 1.12.0
chalk:
specifier: ^4.1.0
version: 4.1.2
@@ -12730,8 +12730,8 @@
peerDependencies:
axios: 0.x || 1.x
- [email protected]:
- resolution: {integrity: sha512-/1xYAC4MP/HEG+3duIhFr4ZQXR4sQXOIe+o6sdqzeykGLx6Upp/1p8MHqhINOvGeP7xyNHe7tsiJByc4SSVUxw==}
+ [email protected]:
+ resolution: {integrity: sha512-oXTDccv8PcfjZmPGlWsPSwtOJCZ/b6W5jAMCNcfwJbCzDckwG0jrYJFaWH1yvivfCXjVzV/SPDEhMB3Q+DSurg==}
[email protected]:
resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==}
@@ -30480,7 +30480,7 @@
'@module-federation/third-party-dts-extractor': 0.18.0
adm-zip: 0.5.16
ansi-colors: 4.1.3
- axios: 1.10.0
+ axios: 1.12.0
chalk: 3.0.0
fs-extra: 9.1.0
isomorphic-ws: 5.0.0([email protected])
@@ -32416,8 +32416,8 @@
'@nx/[email protected]':
dependencies:
'@napi-rs/wasm-runtime': 0.2.4
- axios: 1.10.0
- axios-retry: 4.5.0([email protected])
+ axios: 1.12.0
+ axios-retry: 4.5.0([email protected])
chalk: 4.1.2
enquirer: 2.4.1
ora: 5.4.1
@@ -37406,12 +37406,12 @@
[email protected]: {}
- [email protected]([email protected]):
+ [email protected]([email protected]):
dependencies:
- axios: 1.10.0
+ axios: 1.12.0
is-retry-allowed: 2.2.0
- [email protected]:
+ [email protected]:
dependencies:
follow-redirects: 1.15.9([email protected])
form-data: 4.0.4
@@ -46699,7 +46699,7 @@
'@yarnpkg/lockfile': 1.1.0
'@yarnpkg/parsers': 3.0.2
'@zkochan/js-yaml': 0.0.7
- axios: 1.10.0
+ axios: 1.12.0
chalk: 4.1.2
cli-cursor: 3.1.0
cli-spinners: 2.6.1
⚙️ An Nx Cloud workspace admin can disable these reviews in workspace settings.
|
@JamesHenry Whoops, my bad! I pushed with |
FrozenPandaz
approved these changes
Sep 12, 2025
|
Changes look good to me.. the CI failures look unrelated other than the commit message? Hopefully it passes once you update your commit 🤞 |
b331afb to
67ab37e
Compare
|
@FrozenPandaz @JamesHenry Thanks for the tips. I've fixed the incorrect commit message and pushed. Hope it will pass CI checks now :) |
JamesHenry
approved these changes
Sep 12, 2025
67ab37e to
733d322
Compare
|
@terrymun If you hit some flake again better to ping us to rerun rather than force push up, because the workflows won't run without our approval anyway |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Current Behavior
Nx is currently using a vulnerable version of axios (<1.12.0) which has a reported high-level vulnerability CVE-2025-58754. This is being flagged by GitHub Advanced Security on a Nx-powered monorepo:
Expected Behavior
Nx should be using a patched version of axios (≥1.12.0) that addresses said vulnerability.
Related Issue(s)
Fixes #