Vulnerability: axios (npm)

[WilliamHolmes]

A vulnerable version of the axios package is being included by cldr-data-downloader

https://www.cve.org/CVERecord?id=CVE-2023-45857

│ └─┬ cldr-data@36.0.1
│   └─┬ cldr-data-downloader@1.0.0-1
│     └── axios@0.26.1

[gan0928]

Any update?

[WilliamHolmes]

I guess there's a dependency on this ticket

[acofer]

#85 would fix it, opened two weeks ago. Any maintainers around to let us know if that can be merged?

[neginkheradmandian]

• update cldr-data to last version
• update cldr-data-downlaoder to last version
• add

"overrides": {
   "axios": "latest"
 }, 

to package.json resolve this issue for me

[jpshaw45]

When can we expect this release(#85) to be available?

[rmsilva1973]

Hi @rxaviers . Is this repo dead? This dependency on a vulnerable version of axios is so simple to fix. There's even a PR laying around.