Repository navigation
fix(deps): remove o axios 0.21 herdado do vue-authenticate e atualiza postcss - #43
Merged
Merged
Conversation
… postcss - overrides: o vue-authenticate declara axios ^0.21.1, mas não o importa (usa o cliente HTTP que a Web UI passa, o axios 1.20). A cópia 0.21.4 saía do lockfile só por isso e respondia por 21 alertas do Dependabot. Com o override, fica só o axios 1.20. - postcss 8.5.8 -> 8.5.28 (correções de segurança dentro do ^8). npm 6 (Node 14, usado no CI e na imagem) respeita o lockfile: npm ci e npm install instalam só o axios 1.20. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017ytYXYq4ZUt1EUoaNC3n3m
rodolphobrock
marked this pull request as ready for review
September 29, 2026 21:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fecha os 23 alertas do axios, dos 44 abertos do Dependabot na Web UI.
Mudanças
overridesdo axios novue-authenticate(23 alertas). Ovue-authenticatedeclaraaxios ^0.21.1, mas o código compilado dele não importa o axios: ele usa o cliente HTTP que a Web UI passa, que é oaxios 1.20. A cópia 0.21.4 existia no lockfile só por causa dessa declaração. Com o override, fica só oaxios 1.20.^8). Os 5 alertas do postcss continuam abertos, porque opostcss 7.0.39do vue-loader 15 (@vue/component-compiler-utils) também está na faixa vulnerável; ele só roda no build.npm 6
O CI e a imagem usam Node 14 com npm 6, que não entende
overrides, mas respeita o lockfile. Testei os dois caminhos com npm 6.14.18:npm ci(imagem) enpm install(CI) instalam só oaxios 1.20.O que sobra (21 alertas, sem correção possível nesta base)
npm run serve), serialize-javascript 6, extract-zip (Cypress), qs (preso pelo express), postcss 7 (vue-loader 15) e @tootallnate/once. Nada disso vai para o bundle do navegador.buf; a Web UI só usav4()(src/services/api/interceptors.ts).Validação (Node 14)
npm cienpm installcom npm 6: sóaxios@1.20.0instalado.🤖 Generated with Claude Code
https://claude.ai/code/session_017ytYXYq4ZUt1EUoaNC3n3m