chore(deps): bump axios to solve CVEs from may 2026 by julio-rocketchat · Pull Request #40827 · RocketChat/Rocket.Chat

julio-rocketchat · 2026-06-04T19:49:22Z

Proposed changes (including videos or screenshots)

Issue(s)

https://rocketchat.atlassian.net/browse/SB-998

Steps to test or reproduce

Further comments

Summary by CodeRabbit

Chores
- Updated axios and webdav axios dependencies to latest stable versions.

dionisio-bot · 2026-06-04T19:49:27Z

Looks like this PR is not ready to merge, because of the following issues:

This PR is missing the 'stat: QA assured' label

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

changeset-bot · 2026-06-04T19:49:28Z

⚠️ No Changeset found

Latest commit: 14318f9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-06-04T19:49:31Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

.github/actions/update-version-durability/package-lock.json is excluded by !**/package-lock.json
yarn.lock is excluded by !**/yarn.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e6fab4a0-a82a-4db1-9e4f-23785bce983e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Walkthrough

This PR updates axios dependencies across the repository. The root package.json Yarn resolutions are bumped from 1.15.2 to 1.16.0 for multiple axios semver ranges, and webdav/axios is updated from 0.31.1 to 0.32.0. The update-version-durability GitHub Action's axios dependency is also updated to ^1.16.0.

Changes

Dependency Version Updates

Layer / File(s)	Summary
Root workspace Yarn resolutions `package.json`	Multiple axios semver-range resolutions (`^1.6.1`, `^1.7.4`, `^1.7.8`, `^1.11.0`, `^1.13.2`) are updated from `1.15.2` to `1.16.0`, and `webdav/axios` is bumped from `0.31.1` to `0.32.0`.
GitHub Action axios dependency `.github/actions/update-version-durability/package.json`	The axios dependency in the update-version-durability action is updated from `^1.7.2` to `^1.16.0`.

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

type: chore

Suggested reviewers

yasnagat

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: bumping axios dependency versions to resolve CVEs from May 2026.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-06-04T20:01:46Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.07%. Comparing base (1a207e5) to head (14318f9).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #40827      +/-   ##
===========================================
- Coverage    70.10%   70.07%   -0.04%     
===========================================
  Files         3337     3337              
  Lines       123506   123506              
  Branches     22035    22028       -7     
===========================================
- Hits         86584    86546      -38     
- Misses       33585    33617      +32     
- Partials      3337     3343       +6

Flag	Coverage Δ
e2e	`59.39% <ø> (-0.02%)`	⬇️
e2e-api	`46.26% <ø> (ø)`
unit	`70.87% <ø> (-0.05%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/update-version-durability/package.json:
- Line 14: package.json requests axios@^1.16.0 but the action’s
package-lock.json pins axios@1.15.2; refresh the lockfile by running npm install
inside the action directory to update package-lock.json so the resolved axios
matches the manifest, verify package-lock.json now resolves axios to a 1.16.x
version, and commit the updated package-lock.json alongside the package.json
change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3ee0b00a-92ca-4fa0-94b8-dd8bab9f57a4

📥 Commits

Reviewing files that changed from the base of the PR and between afcc72d and ee4d4e2.

⛔ Files ignored due to path filters (1)

yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

.github/actions/update-version-durability/package.json
package.json

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

GitHub Check: cubic · AI code reviewer
GitHub Check: Hacktron Security Check

🧰 Additional context used

🧠 Learnings (1)

📓 Common learnings

Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: In Rocket.Chat PRs, keep feature PRs free of unrelated lockfile-only dependency bumps; prefer reverting lockfile drift or isolating such bumps into a separate "chore" commit/PR, and always use yarn install --immutable with the Yarn version pinned in package.json via Corepack.

Learnt from: smirk-dev
Repo: RocketChat/Rocket.Chat PR: 39625
File: apps/meteor/app/api/server/v1/push.ts:85-97
Timestamp: 2026-03-14T14:58:58.834Z
Learning: In RocketChat/Rocket.Chat, the `push.token` POST/DELETE endpoints in `apps/meteor/app/api/server/v1/push.ts` were already migrated to the chained router API pattern on `develop` prior to PR `#39625`. `cleanTokenResult` (which strips `authToken` and returns `PushTokenResult`) and `isPushTokenPOSTProps`/`isPushTokenDELETEProps` validators already exist on `develop`. PR `#39625` only migrates `push.get` and `push.info` to the chained pattern. Do not flag `cleanTokenResult` or `PushTokenResult` as newly introduced behavior-breaking changes when reviewing this PR.

🔇 Additional comments (1)

package.json (1)

41-45: LGTM!

Also applies to: 73-73

cubic-dev-ai

1 issue found across 3 files

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

chore(deps): bump axios to solve CVEs from may 2026

ee4d4e2

julio-rocketchat mentioned this pull request Jun 5, 2026

fix: upgrade axios to 1.16.0, 0.32.0 (CVE-2026-44486) #40830

Closed

3 tasks

julio-rocketchat marked this pull request as ready for review June 5, 2026 07:54

julio-rocketchat requested a review from a team as a code owner June 5, 2026 07:54

coderabbitai Bot added the type: chore label Jun 5, 2026

coderabbitai Bot reviewed Jun 5, 2026

View reviewed changes

Comment thread .github/actions/update-version-durability/package.json

cubic-dev-ai Bot reviewed Jun 5, 2026

View reviewed changes

Comment thread .github/actions/update-version-durability/package.json

julio-rocketchat added 2 commits June 5, 2026 10:33

Update package-lock.json under update-version-durability

3ad4971

Merge branch 'develop' into bump-axios

00aff9c

julio-rocketchat added this to the 8.6.0 milestone Jun 5, 2026

Merge branch 'develop' into bump-axios

14318f9

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump axios to solve CVEs from may 2026#40827

chore(deps): bump axios to solve CVEs from may 2026#40827
julio-rocketchat wants to merge 4 commits into
developfrom
bump-axios

julio-rocketchat commented Jun 4, 2026 •

edited

Loading

Uh oh!

dionisio-bot Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 4, 2026 •

edited

Loading

Review skipped

Uh oh!

codecov Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

julio-rocketchat commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes (including videos or screenshots)

Issue(s)

Steps to test or reproduce

Further comments

Summary by CodeRabbit

Uh oh!

dionisio-bot Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Suggested labels

Suggested reviewers

Uh oh!

codecov Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

julio-rocketchat commented Jun 4, 2026 •

edited

Loading

dionisio-bot Bot commented Jun 4, 2026 •

edited

Loading

changeset-bot Bot commented Jun 4, 2026 •

edited

Loading

coderabbitai Bot commented Jun 4, 2026 •

edited

Loading

codecov Bot commented Jun 4, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading