Skip to content

Remove unused axios dependency with multiple CVEs#9

Open
Copilot wants to merge 2 commits intodependabot/npm_and_yarn/hono/node-server-1.19.11from
copilot/fix-axios-security-issue
Open

Remove unused axios dependency with multiple CVEs#9
Copilot wants to merge 2 commits intodependabot/npm_and_yarn/hono/node-server-1.19.11from
copilot/fix-axios-security-issue

Conversation

Copy link
Copy Markdown

Copilot AI commented Mar 2, 2026

axios was declared as a dependency but never imported or used — all HTTP calls go through Node's native fetch. The unused package carried multiple unpatched CVEs (SSRF via absolute URL, credential leakage, DoS via __proto__ and unbounded response size).

Changes

  • package.json / perplexity-ask/package.json: Remove axios from dependencies
  • package-lock.json: Updated to reflect removal

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

Summary by Sourcery

Remove an unused axios dependency from the project to reduce attack surface and align dependencies with actual runtime usage.

Enhancements:

  • Remove axios from root and perplexity-ask package manifests now that all HTTP calls use the native fetch API.

Build:

  • Regenerate package-lock.json to reflect removal of the axios dependency.

Co-authored-by: sfosss <147890625+sfosss@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix denial of service vulnerability in Axios mergeConfig Remove unused axios dependency with multiple CVEs Mar 2, 2026
@sfosss sfosss self-requested a review May 2, 2026 00:11
@sfosss sfosss marked this pull request as ready for review May 2, 2026 00:12
@sourcery-ai
Copy link
Copy Markdown

sourcery-ai Bot commented May 2, 2026

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR removes the unused axios runtime dependency (and its transitive tree with known CVEs) from the root and perplexity-ask package manifests, updating the lockfile accordingly so that all HTTP traffic continues to rely solely on Node’s native fetch API.

File-Level Changes

Change Details Files
Remove axios from runtime dependencies to eliminate unused, vulnerable package and its transitive tree.
  • Delete axios entry from the root package.json dependencies section.
  • Delete axios entry from perplexity-ask/package.json dependencies section.
  • Regenerate/update package-lock.json to remove axios and its transitive dependencies, keeping the lockfile consistent with the manifests.
package.json
perplexity-ask/package.json
package-lock.json

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link
Copy Markdown

@sourcery-ai sourcery-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@sfosss sfosss changed the base branch from main to dependabot/npm_and_yarn/hono/node-server-1.19.11 May 2, 2026 00:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants