Hey team, I was recently working on integrating the React SDK in order to have persistant filters but I noticed that the SDK has Axios dependencies. Is there any status updates on that due to the recent Supply chain Attack

I’m sorry, but the provided knowledge sources do not contain any information about Axios dependencies in the GoodData React SDK or about actions taken in response to recent supply‑chain attacks. What is mentioned is only general security guidance, which recommends regularly updating GoodData SDKs and monitoring release notes and notifications for new security capabilities or alerts, but it does not mention Axios or any specific incident. [Secure deployment] Because of that, I cannot reliably confirm: • Whether Axios is currently used internally in specific SDK packages. • Whether any remediation or dependency changes have been made in response to a particular Axios‑related supply‑chain attack. To get an authoritative and up‑to‑date answer, you would need to: 1. Check the current

package.json

/ lockfile of the SDK version you use (or the GitHub repo) to see the exact Axios version and transitive dependencies. 2. Review the React SDK changelog and “What’s New” page for any security‑related notes not present in these excerpts. [React SDK changelog; What’s new] 3. If you need an official security statement, open a ticket with GoodData Support or your account representative, referencing the specific Axios CVE or incident you’re concerned about. If you share the exact SDK version and Axios advisory (e.g., CVE ID), I can help you interpret what to look for in the changelog and dependency tree, but I can’t confirm any remediation steps beyond what’s in the linked docs. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups. 👀 Our Support team monitors all messages and will jump in if needed.

Hi Joaquim, After check this internally, we can share that GoodData's own systems were not affected. We manage our dependencies manually and were not running any of the vulnerable versions (

axios@1.14.1

or

axios@0.30.4

). There is a small chance that if you ran npm install during the brief window the compromised versions were live (~3 hours on March 31), npm could have resolved to one of them. To verify, run:

npm ls axios

If you see

1.14.1

or

0.30.4

, we recommend reinstalling with the current clean version. As a best practice going forward, we recommend always using a lockfile (package-lock.json or pnpm-lock.yaml) and verifying the resolved Axios version after installing or updating the GoodData SDK. Let me know if you have any questions!

thank you @Mauricio Cabezas