SSRF issue dependency of @inertiajs/inertia [dev]

[devlloedy]

Hi! I got this issue (See picture below) pertaining to this issue https://www.npmjs.com/advisories/1594/versions .
I npm install to resolve the vulnerability but now my site became broken

console error

how can i fix this? this is my first time to encounter this error. if i revert back in old version my site works fine thanks.

[claudiodekker]

Hi,

To fix this issue, both the @inertiajs/inertia package as well as the adapter package you're using (e.g. @inertiajs/inertia-vue) should be compatible. Here's a list of all compatible adapter packages for @inertiajs/inertia:

• https://github.com/inertiajs/inertia/releases/tag/inertia-vue%40v0.5.4
• https://github.com/inertiajs/inertia/releases/tag/inertia-vue3%40v0.3.4
• https://github.com/inertiajs/inertia/releases/tag/inertia-react%40v0.5.1
• https://github.com/inertiajs/inertia/releases/tag/inertia-svelte%40v0.6.0

Do note that when making an upgrade like this, there are things in your application that might break due to changes between the versions. As such, I recommend you to go over to the releases page (https://github.com/inertiajs/inertia/releases) and to go through the releases all the way from your application's installed versions up to the current ones, applying all of the breaking changes/fixes that are relevant to your application. You can ignore all packages on the release page that aren't relevant for you.

In addition, I'd like to take this opportunity to mention that we understand that this isn't ideal, but we do intend to make 'breaking changes' like this less frequent once version 1.0.0 gets released. Furthermore, there is a serious consideration of removing Axios from Inertia's dependencies altogether, so that you're free to upgrade (or remove) it separately without having to go through the hassle of being (more or less) forced to upgrade your entire Inertia app.

Hope this helps!

[reinink]

Also, make sure you're not on axios version 0.21.0, as there is a known vulnerability. Upgrade to 0.21.1. 👍

[reinink]

I just opened a PR to force this: #409