Bump axios from 0.21.1 to 1.8.2

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
         with:
-            node-version: 12
+            node-version: 22
       - run: yarn install --ignore-scripts
       - run: yarn run lint
 
@@ -24,7 +24,7 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        node-version: [12]
+        node-version: [22]
         os: [ubuntu-latest]
 
     steps:

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [6.49.2] - 2025-06-03
+### Fixed
+- Bumped `axios` to newest version without vuln CVE-2025-27152
+
 ## [6.49.1] - 2025-04-30
 ### Fixed
 - Add yarn.lock changes from previous release
@@ -1856,7 +1860,7 @@ instead
 - `HttpClient` now adds `'Accept-Encoding': 'gzip'` header by default.
 
 
-[Unreleased]: https://github.com/vtex/node-vtex-api/compare/v6.45.22...HEAD
+[Unreleased]: https://github.com/vtex/node-vtex-api/compare/v6.48.1-beta.4...HEAD
 [6.45.15]: https://github.com/vtex/node-vtex-api/compare/v6.45.14...v6.45.15
 [6.45.14]: https://github.com/vtex/node-vtex-api/compare/v6.45.13...v6.45.14
 [6.45.13]: https://github.com/vtex/node-vtex-api/compare/v6.45.12...v6.45.13

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "6.49.1",
+  "version": "6.49.2",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
@@ -55,7 +55,7 @@
     "agentkeepalive": "^4.0.2",
     "apollo-server-errors": "^2.2.1",
     "archiver": "^3.0.0",
-    "axios": "^0.21.1",
+    "axios": "^1.8.4",
     "axios-retry": "^3.1.2",
     "bluebird": "^3.5.4",
     "chalk": "^2.4.2",

src/HttpClient/middlewares/cache.ts

@@ -15,7 +15,7 @@ const cacheableStatusCodes = [200, 203, 204, 206, 300, 301, 404, 405, 410, 414,
 
 export const cacheKey = (config: AxiosRequestConfig) => {
   const {baseURL = '', url = '', params, headers} = config
-  const locale = headers[LOCALE_HEADER]
+  const locale = headers?.[LOCALE_HEADER]
 
   const encodedBaseURL = baseURL.replace(/\//g, '\\')
   const encodedURL = url.replace(/\//g, '\\')
@@ -97,7 +97,7 @@ export const cacheMiddleware = ({ type, storage, asyncSet }: CacheOptions) => {
     const { rootSpan: span, tracer, logger } = ctx.tracing ?? {}
 
     const key = cacheKey(ctx.config)
-    const segmentToken = ctx.config.headers[SEGMENT_HEADER]
+    const segmentToken = ctx.config.headers?.[SEGMENT_HEADER]
     const keyWithSegment = key + segmentToken
 
     span?.log({
@@ -153,7 +153,10 @@ export const cacheMiddleware = ({ type, storage, asyncSet }: CacheOptions) => {
       span?.setTag(CACHE_RESULT_TAG, CacheResult.STALE)
       const validateStatus = addNotModified(ctx.config.validateStatus!)
       if (cachedEtag && validateStatus(response.status as number)) {
-        ctx.config.headers['if-none-match'] = cachedEtag
+        ctx.config.headers = {
+          ...ctx.config.headers,
+          'if-none-match': cachedEtag
+        }
         ctx.config.validateStatus = validateStatus
       }
     } else {
@@ -229,7 +232,7 @@ export const cacheMiddleware = ({ type, storage, asyncSet }: CacheOptions) => {
             etag,
             expiration,
             response: {data: cacheableData, headers, status},
-            responseEncoding,
+            responseEncoding: responseEncoding as any,
             responseType,
           })
         if (asyncSet) {

src/HttpClient/middlewares/request/index.ts

@@ -1,5 +1,5 @@
 import { AxiosRequestConfig } from 'axios'
-import buildFullPath from 'axios/lib/core/buildFullPath'
+import buildFullPath from '../../../utils/buildFullPath'
 import { Limit } from 'p-limit'
 import { stringify } from 'qs'
 import { toLower } from 'ramda'
@@ -47,7 +47,7 @@ export const defaultsMiddleware = ({ baseURL, rawHeaders, params, timeout, retri
       ...ctx.config,
       headers: {
         ...headers,
-        ...renameBy(toLower, ctx.config.headers),
+        ...renameBy(toLower, ctx.config.headers as any),
       },
       params: {
         ...params,

src/HttpClient/middlewares/request/setupAxios/interceptors/tracing/spanSetup.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance, AxiosRequestConfig, AxiosResponse } from 'axios'
-import buildFullPath from 'axios/lib/core/buildFullPath'
+import buildFullPath from '../../../../../../utils/buildFullPath'
 import { Span } from 'opentracing'
 import { ROUTER_CACHE_HEADER } from '../../../../../../constants'
 import { CustomHttpTags, OpentracingTags } from '../../../../../../tracing/Tags'
@@ -12,7 +12,7 @@ export const injectRequestInfoOnSpan = (span: Span | undefined, http: AxiosInsta
     [OpentracingTags.HTTP_URL]: buildFullPath(config.baseURL, http.getUri(config)),
   })
 
-  span?.log({ 'request-headers': cloneAndSanitizeHeaders(config.headers) })
+  span?.log({ 'request-headers': cloneAndSanitizeHeaders(config.headers as any) })
 }
 
 // Response may be undefined in case of client timeout, invalid URL, ...

src/HttpClient/typings.ts

@@ -48,7 +48,7 @@ export interface RequestConfig extends AxiosRequestConfig, RequestTracingConfig
   memoizeable?: boolean
   inflightKey?: InflightKeyGenerator
   forceMaxAge?: number
-  responseEncoding?: BufferEncoding
+  responseEncoding?: BufferEncoding | string
   nullIfNotFound?: boolean
   ignoreRecorder?: boolean
 }

src/axios.d.ts

@@ -0,0 +1,237 @@
+declare module 'axios/index' {}
+
+declare module 'axios' {
+  export interface AxiosTransformer {
+    (data: any, headers?: any): any;
+  }
+
+  export interface AxiosAdapter {
+    (config: AxiosRequestConfig): AxiosPromise<any>;
+  }
+
+  export interface AxiosBasicCredentials {
+    username: string;
+    password: string;
+  }
+
+  export interface AxiosProxyConfig {
+    host: string;
+    port: number;
+    auth?: {
+      username: string;
+      password: string;
+    };
+    protocol?: string;
+  }
+
+  export type Method =
+    | 'get' | 'GET'
+    | 'delete' | 'DELETE'
+    | 'head' | 'HEAD'
+    | 'options' | 'OPTIONS'
+    | 'post' | 'POST'
+    | 'put' | 'PUT'
+    | 'patch' | 'PATCH'
+    | 'link' | 'LINK'
+    | 'unlink' | 'UNLINK';
+
+  export type ResponseType =
+    | 'arraybuffer'
+    | 'blob'
+    | 'document'
+    | 'json'
+    | 'text'
+    | 'stream';
+
+  // Tipos de cabeçalho
+  export type RawAxiosRequestHeaders = Record<string, any>;
+  export type RawAxiosResponseHeaders = Record<string, any>;
+  export interface AxiosHeaders extends Record<string, any> {
+    set(headerName: string, value: string): AxiosHeaders;
+    get(headerName: string): string | undefined;
+    delete(headerName: string): boolean;
+    clear(): AxiosHeaders;
+    toJSON(): Record<string, any>;
+    [key: string]: any;
+  }
+
+  export interface AxiosRequestConfig {
+    url?: string;
+    method?: Method;
+    baseURL?: string;
+    transformRequest?: AxiosTransformer | AxiosTransformer[];
+    transformResponse?: AxiosTransformer | AxiosTransformer[];
+    headers?: RawAxiosRequestHeaders;
+    params?: any;
+    paramsSerializer?: (params: any) => string;
+    data?: any;
+    timeout?: number;
+    timeoutErrorMessage?: string;
+    withCredentials?: boolean;
+    adapter?: AxiosAdapter;
+    auth?: AxiosBasicCredentials;
+    responseType?: ResponseType;
+    responseEncoding?: string;
+    xsrfCookieName?: string;
+    xsrfHeaderName?: string;
+    onUploadProgress?: (progressEvent: any) => void;
+    onDownloadProgress?: (progressEvent: any) => void;
+    maxContentLength?: number;
+    maxBodyLength?: number;
+    validateStatus?: (status: number) => boolean;
+    maxRedirects?: number;
+    socketPath?: string | null;
+    httpAgent?: any;
+    httpsAgent?: any;
+    proxy?: AxiosProxyConfig | false;
+    cancelToken?: CancelToken;
+    decompress?: boolean;
+    transitional?: any;
+    signal?: any;
+    insecureHTTPParser?: boolean;
+    [key: string]: any; // Para permitir qualquer propriedade adicional
+  }
+
+  export interface InternalAxiosRequestConfig extends AxiosRequestConfig {
+    headers: AxiosHeaders | RawAxiosRequestHeaders;
+    [key: string]: any; // Para permitir propriedades adicionais como 'tracing'
+  }
+
+  export interface AxiosResponse<T = any> {
+    data: T;
+    status: number;
+    statusText: string;
+    headers: RawAxiosResponseHeaders;
+    config: AxiosRequestConfig;
+    request?: any;
+  }
+
+  // Define AxiosError como uma classe para fazer instanceof funcionar
+  export class AxiosError<T = any> extends Error {
+    config: AxiosRequestConfig;
+    code?: string;
+    request?: any;
+    response?: AxiosResponse<T>;
+    isAxiosError: boolean;
+    status?: number;
+
+    constructor(
+      message?: string,
+      code?: string,
+      config?: AxiosRequestConfig,
+      request?: any,
+      response?: AxiosResponse<T>
+    );
+
+    toJSON(): object;
+
+    // Métodos estáticos para criar instâncias de AxiosError
+    static from<T = any>(
+      error: Error,
+      code?: string,
+      config?: AxiosRequestConfig,
+      request?: any,
+      response?: AxiosResponse<T>,
+      customProps?: Record<string, any>
+    ): AxiosError<T>;
+  }
+
+  export interface AxiosPromise<T = any> extends Promise<AxiosResponse<T>> {
+  }
+
+  export interface CancelStatic {
+    new (message?: string): Cancel;
+  }
+
+  export interface Cancel {
+    message: string;
+  }
+
+  export interface Canceler {
+    (message?: string): void;
+  }
+
+  export interface CancelTokenStatic {
+    new (executor: (cancel: Canceler) => void): CancelToken;
+    source(): CancelTokenSource;
+  }
+
+  export interface CancelToken {
+    promise: Promise<Cancel>;
+    reason?: Cancel;
+    throwIfRequested(): void;
+  }
+
+  export interface CancelTokenSource {
+    token: CancelToken;
+    cancel: Canceler;
+  }
+
+  export interface AxiosInterceptorManager<V> {
+    use(onFulfilled?: (value: V) => V | Promise<V>, onRejected?: (error: any) => any): number;
+    eject(id: number): void;
+    clear(): void;
+  }
+
+  export interface AxiosInstance {
+    (config: AxiosRequestConfig): AxiosPromise;
+    (url: string, config?: AxiosRequestConfig): AxiosPromise;
+    defaults: AxiosRequestConfig;
+    interceptors: {
+      request: AxiosInterceptorManager<AxiosRequestConfig>;
+      response: AxiosInterceptorManager<AxiosResponse>;
+    };
+    getUri(config?: AxiosRequestConfig): string;
+    request<T = any, R = AxiosResponse<T>>(config: AxiosRequestConfig): Promise<R>;
+    get<T = any, R = AxiosResponse<T>>(url: string, config?: AxiosRequestConfig): Promise<R>;
+    delete<T = any, R = AxiosResponse<T>>(url: string, config?: AxiosRequestConfig): Promise<R>;
+    head<T = any, R = AxiosResponse<T>>(url: string, config?: AxiosRequestConfig): Promise<R>;
+    options<T = any, R = AxiosResponse<T>>(url: string, config?: AxiosRequestConfig): Promise<R>;
+    post<T = any, R = AxiosResponse<T>>(url: string, data?: any, config?: AxiosRequestConfig): Promise<R>;
+    put<T = any, R = AxiosResponse<T>>(url: string, data?: any, config?: AxiosRequestConfig): Promise<R>;
+    patch<T = any, R = AxiosResponse<T>>(url: string, data?: any, config?: AxiosRequestConfig): Promise<R>;
+  }
+
+  export interface AxiosStatic extends AxiosInstance {
+    create(config?: AxiosRequestConfig): AxiosInstance;
+    Cancel: CancelStatic;
+    CancelToken: CancelTokenStatic;
+    isCancel(value: any): boolean;
+    all<T>(values: (T | Promise<T>)[]): Promise<T[]>;
+    spread<T, R>(callback: (...args: T[]) => R): (array: T[]) => R;
+    isAxiosError(payload: any): payload is AxiosError;
+  }
+
+  const axios: AxiosStatic;
+
+  export const AxiosError: {
+    new <T = any>(
+      message?: string,
+      code?: string,
+      config?: AxiosRequestConfig,
+      request?: any,
+      response?: AxiosResponse<T>
+    ): AxiosError<T>;
+    readonly prototype: AxiosError;
+    readonly ERR_NETWORK: string;
+    readonly ERR_BAD_REQUEST: string;
+    readonly TIMEOUT_ERROR_CODE: string;
+    readonly ERR_BAD_RESPONSE: string;
+    readonly ERR_FR_TOO_MANY_REDIRECTS: string;
+    readonly ERR_DEPRECATED: string;
+    readonly ERR_BAD_OPTION_VALUE: string;
+    readonly ERR_CANCELED: string;
+    readonly ECONNABORTED: string;
+    readonly ETIMEDOUT: string;
+    from<T = any>(
+      error: Error,
+      code?: string,
+      config?: AxiosRequestConfig,
+      request?: any,
+      response?: AxiosResponse<T>,
+      customProps?: Record<string, any>
+    ): AxiosError<T>;
+  };
+
+  export default axios;
+}

src/caches/DiskCache.ts

@@ -34,7 +34,7 @@ export class DiskCache<V> implements CacheLayer<string, V>{
   public get = async (key: string): Promise<V | void>  => {
     const pathKey = this.getPathKey(key)
     this.total += 1
-    const data = await new Promise<V>(resolve => {
+    const data = await new Promise<V | undefined>(resolve => {
       this.lock.readLock(key, async (release: () => void) => {
         try {
           const fileData = await this.readFile(pathKey)

src/caches/LRUDiskCache.ts

@@ -70,7 +70,7 @@ export class LRUDiskCache<V> implements CacheLayer<string, V>{
 
     const pathKey = this.getPathKey(key)
 
-    const data = await new Promise<V>(resolve => {
+    const data = await new Promise<V | undefined>(resolve => {
       this.lock.readLock(key, async (release: () => void) => {
         try {
           const fileData = await this.readFile(pathKey)

src/caches/MultilayeredCache.ts

@@ -10,7 +10,7 @@ export class MultilayeredCache <K, V> implements CacheLayer<K, V>{
   constructor (private caches: Array<CacheLayer<K, V>>) {}
 
   public get = async (key: K, fetcher?: () => Promise<FetchResult<V>>): Promise<V | void> => {
-    let value: V | void
+    let value: V | void = undefined
     let maxAge: number | void
     let successIndex = await this.findIndex(async (cache: CacheLayer<K, V>) => {
       const [getValue, hasKey] = await Promise.all([cache.get(key), cache.has(key)])