Skip to content

Commit 72114de

Browse files
committed
fix: add npm override for axios to address CVE-2025-58754
Axios versions prior to 1.9.1 are vulnerable to Denial of Service via massive data schemas (CVE-2025-58754). The vulnerable version (1.9.0) is pulled as a transitive dependency from @edx/frontend-platform. Adding an npm override forces resolution to a patched version without changing the frontend-platform version, avoiding breaking changes.
1 parent 89d5d3c commit 72114de

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

package.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,5 +96,8 @@
9696
}
9797
],
9898
"normalizeFilenames": "^.+?(\\..+?)\\.\\w+$"
99+
},
100+
"overrides": {
101+
"axios": "^1.9.1"
99102
}
100103
}

0 commit comments

Comments
 (0)