slackapi
Remove Axios from Slack Packages
Axios has a ton of vulnerabilities that come up frequently (It's almost once a month), can we replace/remove this package?
Packages:
Select all that apply:
- [ x]
@slack/web-api - [ ]
@slack/rtm-api - [x ]
@slack/webhooks - [ ]
@slack/oauth - [ ]
@slack/socket-mode - [ ]
@slack/types - [ ] I don't know
Requirements
Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you are agreeing to those rules.
Hey @JacobWilson01! 👋 Thanks for sharing this with us.
We're keeping track of this in #1525 for #2359 and are making active developments to remove the axios package in an upcoming release with hopes of a more compatible alternative.
👋 It looks like this issue has been open for 30 days with no activity. We'll mark this as stale for now, and wait 10 days for an update or for further comment before closing this issue out. If you think this issue needs to be prioritized, please comment to get the thread going again! Maintainers also review issues marked as stale on a regular basis and comment or adjust status if the issue needs to be reprioritized.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
#2368 was closed on the basis this would be actioned. Please reopen #2368 if you aren't going to remove axios imminently
👋 It looks like this issue has been open for 30 days with no activity. We'll mark this as stale for now, and wait 10 days for an update or for further comment before closing this issue out. If you think this issue needs to be prioritized, please comment to get the thread going again! Maintainers also review issues marked as stale on a regular basis and comment or adjust status if the issue needs to be reprioritized.
代替ライブラリの候補はいくつか検討済みでしょうか？ あくまで個人的な一例ですが、以下のライブラリを2年ほど使っていて大きな脆弱性指摘はなかったかと記憶しています。 https://www.npmjs.com/package/postman-request
代替ライブラリへの移行を進めている場合でも、時間がかかる場合は axios のバージョンアップにより CVE-2025-58754 の対処をしていただければ幸いです。
