Skip to content

fix: Replace axios with native fetch in turbo-codemod#11600

Merged
anthonyshew merged 2 commits intomainfrom
anthonyshew/turbo-5143-remove-axios
Jan 31, 2026
Merged

fix: Replace axios with native fetch in turbo-codemod#11600
anthonyshew merged 2 commits intomainfrom
anthonyshew/turbo-5143-remove-axios

Conversation

@anthonyshew
Copy link
Copy Markdown
Contributor

Summary

  • Replace axios with native fetch() in @turbo/codemod package
  • Remove axios dependency and all its transitive dependencies (form-data, follow-redirects)
  • Fixes TURBO-5143: axios SSRF and Credential Leakage vulnerability (High severity)

Changes

The getLatestVersion.ts file was the only place using axios for a simple GET request to the npm registry. Node.js 18+ has native fetch support, so this removes the need for the axios dependency entirely.

Testing

  • The modified code preserves the same error handling behavior
  • Tests pass (pre-existing failures unrelated to this change are due to workspace package build ordering)

@anthonyshew anthonyshew requested a review from a team as a code owner January 31, 2026 20:48
@anthonyshew anthonyshew requested review from tknickman and removed request for a team January 31, 2026 20:48
@vercel vercel Bot temporarily deployed to Preview – turborepo-test-coverage January 31, 2026 20:48 Inactive
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Jan 31, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples-basic-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm
examples-designsystem-docs Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm
examples-gatsby-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm
examples-kitchensink-blog Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm
examples-nonmonorepo Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm
examples-svelte-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm
examples-tailwind-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm
examples-vite-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm
turbo-site Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm
turborepo-test-coverage Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 9:09pm

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jan 31, 2026

Coverage Report

Metric Coverage
Lines 75.88%
Functions 46.75%
Branches 0.00%

View full report

@anthonyshew anthonyshew merged commit bbcf472 into main Jan 31, 2026
104 of 105 checks passed
@anthonyshew anthonyshew deleted the anthonyshew/turbo-5143-remove-axios branch January 31, 2026 21:18
anthonyshew added a commit that referenced this pull request Jan 31, 2026
## Summary

- Add `rust` output to the `find-changes` job that detects Rust/core
code changes
- Skip Rust tests, integration tests, and coverage when only JS packages
change

## Why

PRs like #11600 (removing axios from `@turbo/codemod`) were spinning up
~95 CI jobs even though the change only touched a JS package. Most of
these jobs hit cache and did nothing useful, wasting compute.

The existing `rest` filter triggers on any change outside `examples/`
and `docs/`, including lockfile changes. This is too broad for
determining whether Rust/integration tests need to run.

## Changes

The new `rust` filter detects changes to:
- `crates/` - Rust source
- `cli/` - CLI code
- `Cargo.*` - Rust dependencies
- `rust-toolchain.toml` - Rust version
- `.cargo/` - Cargo config
- `turborepo-tests/` - Integration test fixtures

Jobs now gated by `rust == 'true'`:
- Integration tests (57 jobs across 3 OSes)
- Rust unit tests (6 jobs)
- Coverage report
- `@turbo/types` codegen check

## Impact

For JS-only PRs: ~95 jobs → ~20 jobs

The `test-js-packages.yml` workflow still runs with proper filtering via
`turbo run --filter={./packages/*}...[$BASE_SHA]`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant