Releases · Ed-Fi-Alliance-OSS/certification-testing

Bump axios from 1.13.6 to 1.15.0 in /bruno (#116)

Bumps [axios](https://github.com/axios/axios) from 1.13.6 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.6...v1.15.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Assets 5

14 Apr 01:34

github-actions

commit-a9ef5dd5538c2b0be340747421ebc693bd9f39ed

a9ef5dd

commit-a9ef5dd5538c2 Pre-release

Pre-release

Automated SIS artifact for commit-a9ef5dd5538c2b0be340747421ebc693bd9f39ed.

Assets 5

20 Mar 16:45

josephcampos-gap

v2.1.0-qa-test

c91fb49

v2.1.0-qa-test Pre-release

Pre-release

[CERT-222] Update Bruno CLI dependencies (#114)

* [CERT-222] Workflow update - export Bruno artifacts

* docs: Added artifact readme documentation

* [CERT-222] fix: Bruno CLI dependency updated

* [CERT-222] fix: Fixing aws-sdk security vulnerability

The override is working — fast-xml-parser is now at `4.5.4`. Here's where things stand:

* Critical CVE removed (GHSA-m7jm-9gc2-mpf2, score 9.3) ✓
* Low CVE removed (GHSA-fj3w-jwp8-x2g3) ✓
* Remaining: 1 High (GHSA-8gc5-j5rx-235r) — numeric entity expansion bypass affecting >=4.0.0-beta.3 <=5.5.5. This one can only be fully fixed by going to 5.5.6+, which risks breaking @aws-sdk/core (5.x API change).

The remaining high CVE relates to DoS via maliciously crafted XML in DOCTYPE entities. Since this tool is a CLI test runner that doesn't parse untrusted XML from external sources at runtime, the risk is effectively theoretical in this context. The only way to fully clear it without a major @usebruno/cli downgrade would be to wait for `@aws-sdk/core` to publish a release pinning `fast-xml-parser@>=5.5.6`.

* [CERT-222] fix: Fully fixed security vulnerabilities

Assets 5