From 9e6feabb7ea8f26a9b39fe13a6fc217fa1531c32 Mon Sep 17 00:00:00 2001 From: "adedotun@flutterwavego.com" Date: Mon, 7 Sep 2026 20:52:23 +0100 Subject: [PATCH 1/2] Update Vulnerable Packages The listed packages are: axios from ^1.13.5 to ^1.18.0 joi from 17.8.3 to 17.13.7 winston from ^3.8.2 to ^3.19.0. eslint-config-prettier from ^8.6.0 to ^8.10.2. eslint-plugin-import from ^2.27.5 to ^2.32.0 Update affected sub-dependencies, including brace-expansion, form-data, and js-yaml. --- package-lock.json | 56 +++++++++++++++++++++++------------------------ package.json | 6 ++--- 2 files changed, 31 insertions(+), 31 deletions(-) diff --git a/package-lock.json b/package-lock.json index c0c1f1c..7b65c8e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,27 +1,27 @@ { "name": "flutterwave-node-v3", - "version": "1.3.2", + "version": "1.3.3", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "flutterwave-node-v3", - "version": "1.3.2", + "version": "1.3.3", "license": "MIT", "dependencies": { - "axios": "^1.13.5", - "eslint-config-prettier": "^8.6.0", - "joi": "17.8.3", + "axios": "^1.18.0", + "eslint-config-prettier": "^8.10.2", + "joi": "^17.13.7", "md5": "^2.3.0", "node-forge": "^1.4.0", "q": "^1.5.1", - "winston": "^3.8.2" + "winston": "^3.19.0" }, "devDependencies": { "dotenv": "^10.0.0", "eslint": "^8.57.0", "eslint-config-airbnb-base": "^15.0.0", - "eslint-plugin-import": "^2.27.5", + "eslint-plugin-import": "^2.32.0", "prettier": "2.8.3", "should": "^13.2.3" } @@ -487,13 +487,13 @@ } }, "node_modules/axios": { - "version": "1.17.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.17.0.tgz", - "integrity": "sha512-J8SwNxprqqpbfenehxWYXE7CW+wM1BB4w3+N+g+/Wx40xM4rsLrfPmHHxSWIxJLYDgSY/HqlFPIYb2/S3rxafw==", + "version": "1.20.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz", + "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", - "form-data": "^4.0.5", + "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } @@ -505,9 +505,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.15", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz", - "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -1445,16 +1445,16 @@ } }, "node_modules/form-data": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz", - "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==", + "version": "4.0.6", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz", + "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==", "license": "MIT", "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", - "hasown": "^2.0.2", - "mime-types": "^2.1.12" + "hasown": "^2.0.4", + "mime-types": "^2.1.35" }, "engines": { "node": ">= 6" @@ -2244,22 +2244,22 @@ "license": "ISC" }, "node_modules/joi": { - "version": "17.8.3", - "resolved": "https://registry.npmjs.org/joi/-/joi-17.8.3.tgz", - "integrity": "sha512-q5Fn6Tj/jR8PfrLrx4fpGH4v9qM6o+vDUfD4/3vxxyg34OmKcNqYZ1qn2mpLza96S8tL0p0rIw2gOZX+/cTg9w==", + "version": "17.13.7", + "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.7.tgz", + "integrity": "sha512-MF80Dm5Y2veNy8QWVx9Bj3ui4mo7+VPSPsR1M+oaHXV0Gx6zGX9a2F+OZG3Blby9tOlzU9Rs5FUimlEhbKtfnQ==", "license": "BSD-3-Clause", "dependencies": { - "@hapi/hoek": "^9.0.0", - "@hapi/topo": "^5.0.0", - "@sideway/address": "^4.1.3", + "@hapi/hoek": "^9.3.0", + "@hapi/topo": "^5.1.0", + "@sideway/address": "^4.1.5", "@sideway/formula": "^3.0.1", "@sideway/pinpoint": "^2.0.0" } }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 98407be..5c08c5a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "flutterwave-node-v3", - "version": "1.4.1", + "version": "1.3.3", "description": "The official Node.JS integration library for Flutterwave v3 payment APIs", "main": "index.js", "scripts": { @@ -14,9 +14,9 @@ "author": "Flutterwave Developers", "license": "MIT", "dependencies": { - "axios": "^1.17.0", + "axios": "^1.18.0", "eslint-config-prettier": "^8.10.2", - "joi": "17.8.3", + "joi": "^17.13.7", "md5": "^2.3.0", "node-forge": "^1.4.0", "q": "^1.5.1", From c872c8ce38513f192be3fcdc34ce4c2afb7f2b59 Mon Sep 17 00:00:00 2001 From: "adedotun@flutterwavego.com" Date: Mon, 7 Sep 2026 21:18:55 +0100 Subject: [PATCH 2/2] Updated the changelog with the recent updates. Updated the package version from 1.4.1 to 1.4.2, and added the packages updated to the changelog. --- CHANGELOG.md | 20 ++++++++++++++++++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2765c02..c1fcee8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,25 @@ # Changelog +## 1.4.2 | 2026-09-07 +Fix dependency vulnerabilities and update package dependencies. + +### Version changes +- [UPDATED] axios from ^1.13.5 to ^1.18.0 to address High-severity Prototype Pollution and DoS vulnerabilities. + +- [UPDATED] joi from 17.8.3 to ^17.13.7 to address the Moderate-severity uncaught RangeError DoS vulnerability. + +- [UPDATED] winston from ^3.8.2 to ^3.19.0. + +- [UPDATED] eslint-config-prettier from ^8.6.0 to ^8.10.2. + +- [UPDATED] eslint-plugin-import from ^2.27.5 to ^2.32.0 as part of the development tooling updates. + +- [UPDATED] Transitive dependency brace-expansion from 1.1.15 to 1.1.18. + +- [UPDATED] Transitive dependency form-data from 4.0.5 to 4.0.6. + +- [UPDATED] Transitive dependency js-yaml from 4.2.0 to 4.3.2. + ## 1.4.1 | 2026-06-17 Refactor Signoz integration. diff --git a/package-lock.json b/package-lock.json index 7b65c8e..ac5f1ac 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "flutterwave-node-v3", - "version": "1.3.3", + "version": "1.4.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "flutterwave-node-v3", - "version": "1.3.3", + "version": "1.4.2", "license": "MIT", "dependencies": { "axios": "^1.18.0", diff --git a/package.json b/package.json index 5c08c5a..b870b8a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "flutterwave-node-v3", - "version": "1.3.3", + "version": "1.4.2", "description": "The official Node.JS integration library for Flutterwave v3 payment APIs", "main": "index.js", "scripts": {