deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-xvmh-25jw-gmmm
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 4.2.0-beta, < 4.4.12
Patched in: 4.4.12

Summary: Moodle affected by a code injection vulnerability

Details:
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application.
GitHub Security Advisory: GHSA-xvmh-25jw-gmmm
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 4.5.0-beta, < 4.5.8
Patched in: 4.5.8

Summary: Moodle affected by a code injection vulnerability

Details:
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application.
GitHub Security Advisory: GHSA-xvmh-25jw-gmmm
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 5.0.0-beta, < 5.0.4
Patched in: 5.0.4

Summary: Moodle affected by a code injection vulnerability

Details:
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application.
GitHub Security Advisory: GHSA-xvmh-25jw-gmmm
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 5.1.0-beta, < 5.1.1
Patched in: 5.1.1

Summary: Moodle affected by a code injection vulnerability

Details:
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application.
GitHub Security Advisory: GHSA-j4rc-96xj-gvqc
Package: thorsten/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 4.0.16
Patched in: 4.0.17

Summary: phpMyFAQ: Public API endpoints expose emails and invisible questions

Details:
### Summary
Several public API endpoints return email addresses and non‑public records (e.g. open questions with isVisible=false).

### Details
OpenQuestionController::list() calls Question::getAll() with the default showAll=true, returning invisible questions and their emails. Similar exposures exist in comment/news/faq APIs.

### PoC
```
curl -i -H 'Accept-Language: en' \
  http://192.168.40.16/phpmyfaq/api/v3.0/open-questions
```

### Impact
Privacy exposure of email addresses and non‑public content; increased risk of phishing/scraping.
GitHub Security Advisory: GHSA-j4rc-96xj-gvqc
Package: phpmyfaq/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 4.0.16
Patched in: 4.0.17

Summary: phpMyFAQ: Public API endpoints expose emails and invisible questions

Details:
### Summary
Several public API endpoints return email addresses and non‑public records (e.g. open questions with isVisible=false).

### Details
OpenQuestionController::list() calls Question::getAll() with the default showAll=true, returning invisible questions and their emails. Similar exposures exist in comment/news/faq APIs.

### PoC
```
curl -i -H 'Accept-Language: en' \
  http://192.168.40.16/phpmyfaq/api/v3.0/open-questions
```

### Impact
Privacy exposure of email addresses and non‑public content; increased risk of phishing/scraping.
GitHub Security Advisory: GHSA-wm8h-26fv-mg7g
Package: thorsten/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization, CWE-862: Missing Authorization
Vulnerable versions: <= 4.0.16
Patched in: 4.0.17

Summary: phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)

Details:
### Summary
Authenticated non‑admin users can call /api/setup/backup and trigger a configuration backup. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP.

### Details
SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. This allows any logged‑in user to create a sensitive backup and retrieve its path.

### PoC
Precondition: API enabled, any authenticated non‑admin user.
- Log in as a non‑admin user.
- Call backup endpoint.
```
curl -c /tmp/pmf_api_cookies.txt \
  -H 'Content-Type: application/json' \
  -d '{"username":"tester","password":"Test1234!"}' \
  http://192.168.40.16/phpmyfaq/api/v3.0/login

curl -i -b /tmp/pmf_api_cookies.txt \
  -X POST --data '4.0.16' \
  http://192.168.40.16/phpmyfaq/api/setup/backup
```

### Impact
Low‑privileged users can generate sensitive backups. If the ZIP is web‑accessible (server misconfiguration), this can lead to secret exposure.
GitHub Security Advisory: GHSA-wm8h-26fv-mg7g
Package: phpmyfaq/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization, CWE-862: Missing Authorization
Vulnerable versions: <= 4.0.16
Patched in: 4.0.17

Summary: phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)

Details:
### Summary
Authenticated non‑admin users can call /api/setup/backup and trigger a configuration backup. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP.

### Details
SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. This allows any logged‑in user to create a sensitive backup and retrieve its path.

### PoC
Precondition: API enabled, any authenticated non‑admin user.
- Log in as a non‑admin user.
- Call backup endpoint.
```
curl -c /tmp/pmf_api_cookies.txt \
  -H 'Content-Type: application/json' \
  -d '{"username":"tester","password":"Test1234!"}' \
  http://192.168.40.16/phpmyfaq/api/v3.0/login

curl -i -b /tmp/pmf_api_cookies.txt \
  -X POST --data '4.0.16' \
  http://192.168.40.16/phpmyfaq/api/setup/backup
```

### Impact
Low‑privileged users can generate sensitive backups. If the ZIP is web‑accessible (server misconfiguration), this can lead to secret exposure.
GitHub Security Advisory: GHSA-7p9h-m7m8-vhhv
Package: thorsten/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 4.0.16
Patched in: 4.0.17

Summary: phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

Details:
### Summary
A logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.

### Details
In attachment.php, the access decision uses:
```($groupPermission || ($groupPermission && $userPermission)) && isset($permission['dlattachment'])```
isset() returns true even when the right value is false, and the logic simplifies to $groupPermission for some permission modes. As a result, a user without dlattachment can still access the attachment.

### PoC
Precondition: A non‑admin user exists; an attachment is associated to a FAQ record; records.allowDownloadsForGuests = false.
Log in as a non‑admin user without dlattachment.
Request the attachment download endpoint.
```
curl -c /tmp/pmf_api_cookies.txt \
  -H 'Content-Type: application/json' \
  -d '{"username":"tester","password":"Test1234!"}' \
  http://192.168.40.16/phpmyfaq/api/v3.0/login

curl -i -b /tmp/pmf_api_cookies.txt \
  "http://192.168.40.16/phpmyfaq/index.php?action=attachment&id=1"
```

### Impact
Unauthorized users can download attachments (confidentiality breach). Depending on content, this may expose sensitive documents.
GitHub Security Advisory: GHSA-7p9h-m7m8-vhhv
Package: phpmyfaq/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 4.0.16
Patched in: 4.0.17

Summary: phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

Details:
### Summary
A logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.

### Details
In attachment.php, the access decision uses:
```($groupPermission || ($groupPermission && $userPermission)) && isset($permission['dlattachment'])```
isset() returns true even when the right value is false, and the logic simplifies to $groupPermission for some permission modes. As a result, a user without dlattachment can still access the attachment.

### PoC
Precondition: A non‑admin user exists; an attachment is associated to a FAQ record; records.allowDownloadsForGuests = false.
Log in as a non‑admin user without dlattachment.
Request the attachment download endpoint.
```
curl -c /tmp/pmf_api_cookies.txt \
  -H 'Content-Type: application/json' \
  -d '{"username":"tester","password":"Test1234!"}' \
  http://192.168.40.16/phpmyfaq/api/v3.0/login

curl -i -b /tmp/pmf_api_cookies.txt \
  "http://192.168.40.16/phpmyfaq/index.php?action=attachment&id=1"
```

### Impact
Unauthorized users can download attachments (confidentiality breach). Depending on content, this may expose sensitive documents.
GitHub Security Advisory: GHSA-w7rq-fgx4-4xcm
Package: lavalite/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 10.1.0
Patched in: unpatched

Summary: LavaLite CMS affected by a stored cross-site scripting vulnerability

Details:
LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. When other users view search results that include the malicious package, the injected script executes in their browsers, potentially enabling session hijacking, credential theft, and unauthorized actions in the context of the victim.
GitHub Security Advisory: GHSA-657c-wxg6-jmqv
Package: ph7software/ph7builder (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 17.9.1
Patched in: unpatched

Summary: pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability

Details:
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
GitHub Security Advisory: GHSA-ggff-9mj3-7246
Package: cpsit/typo3-mailqueue (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.5.0, < 0.5.1
Patched in: 0.5.1

Summary: mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport

Details:
## Description

The extension extends TYPO3’s FileSpool component, which was vulnerable to Insecure Deserialization prior to [TYPO3-CORE-SA-2026-004](https://typo3.org/security/advisory/typo3-core-sa-2026-004). Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension.

More information about this vulnerability can be found in the related TYPO3 Core Security Advisory [TYPO3-CORE-SA-2026-004](https://typo3.org/security/advisory/typo3-core-sa-2026-004).

## References

* [TYPO3-EXT-SA-2026-001](https://typo3.org/security/advisory/typo3-ext-sa-2026-001)
* https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db
* https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb[PII_REDACTED]a94e43bbf117abf733
GitHub Security Advisory: GHSA-ggff-9mj3-7246
Package: cpsit/typo3-mailqueue (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.4.3
Patched in: 0.4.3

Summary: mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport

Details:
## Description

The extension extends TYPO3’s FileSpool component, which was vulnerable to Insecure Deserialization prior to [TYPO3-CORE-SA-2026-004](https://typo3.org/security/advisory/typo3-core-sa-2026-004). Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension.

More information about this vulnerability can be found in the related TYPO3 Core Security Advisory [TYPO3-CORE-SA-2026-004](https://typo3.org/security/advisory/typo3-core-sa-2026-004).

## References

* [TYPO3-EXT-SA-2026-001](https://typo3.org/security/advisory/typo3-ext-sa-2026-001)
* https://github.com/CPS-IT/mailqueue/commit/fd09aa4e1a751551bae4b228bee814e22f2048db
* https://github.com/CPS-IT/mailqueue/commit/12a0a35027bb[PII_REDACTED]a94e43bbf117abf733
GitHub Security Advisory: GHSA-m27r-m6rx-mhm4
Package: laravel/reverb (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 1.7.0
Patched in: 1.7.0

Summary: Laravel Redis Horizontal Scaling Insecure Deserialization

Details:
### Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (`REVERB_SCALING_ENABLED=true`).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s `unserialize()` function without restricting which classes could be instantiated.

**Risk:** Remote Code Execution (RCE)

### Patches
This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to `laravel/reverb: ^1.7.0` immediately.

### Workarounds
If you cannot upgrade to v1.7.0, you should apply the following mitigations:

* Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
* Disable Scaling: If your environment uses only one Reverb node, set `REVERB_SCALING_ENABLED=false` to bypass the vulnerable logic entirely.

### Credits
This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad
GitHub Security Advisory: GHSA-9g95-48c6-r778
Package: livewire-filemanager/filemanager (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 1.0.4
Patched in: unpatched

Summary: Livewire Filemanager does not restrict uploaded file types

Details:
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
GitHub Security Advisory: GHSA-jw2v-cq5x-q68g
Package: pterodactyl/panel (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-400: Uncontrolled Resource Consumption, CWE-413: Improper Resource Locking, CWE-667: Improper Locking
Vulnerable versions: < 1.12.0
Patched in: 1.12.0

Summary: Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted

Details:
### Summary
Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and validated during the request cycle.

However, it is possible for a malicious user to send a massive volume of requests at the same time that would create more resources than the server is allotted. This is because the validation occurs early in the request cycle and does not lock the target resource while it is processing. As a result sending a large volume of requests at the same time would lead all of those requests to validate as not using any of the target resources, and then all creating the resources at the same time.

As a result a server would be able to create more databases, allocations, or backups than configured.

### Impact
A malicious user is able to deny resources to other users on the system, and may be able to excessively consume the limited allocations for a node, or fill up backup space faster than is allowed by the system.
GitHub Security Advisory: GHSA-qh8m-9qxx-53m5
Package: cakephp/cakephp (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 5.3.0
Patched in: 5.3.1

Summary: CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

Details:
### Impact
The `PaginatorHelper::limitControl()` method has a cross-site-scripting vulnerability via query string parameter manipulation.

### Patches
This issue has been fixed in 5.2.12 and 5.3.1

### Workarounds
If you are unable to upgrade, you should avoid using `Paginator::limitControl()` until you can upgrade.
GitHub Security Advisory: GHSA-qh8m-9qxx-53m5
Package: cakephp/cakephp (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.2.10, < 5.2.12
Patched in: 5.2.12

Summary: CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

Details:
### Impact
The `PaginatorHelper::limitControl()` method has a cross-site-scripting vulnerability via query string parameter manipulation.

### Patches
This issue has been fixed in 5.2.12 and 5.3.1

### Workarounds
If you are unable to upgrade, you should avoid using `Paginator::limitControl()` until you can upgrade.
GitHub Security Advisory: GHSA-rwr8-xrpw-9qf5
Package: solspace/craft-freeform (COMPOSER)
Severity: LOW (CVSS 0.0)
Vulnerable versions: >= 5.0.0-beta.1, < 5.5.9
Patched in: 5.5.9

Summary: solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets

Details:
### Summary
The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios

### Details
We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.
GitHub Security Advisory: GHSA-rwr8-xrpw-9qf5
Package: solspace/craft-freeform (COMPOSER)
Severity: LOW (CVSS 0.0)
Vulnerable versions: < 4.1.22
Patched in: 4.1.22

Summary: solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets

Details:
### Summary
The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios

### Details
We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.
GitHub Security Advisory: GHSA-44jg-mv3h-wj6g
Package: solspace/craft-freeform (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.1.23
Patched in: 4.1.23

Summary: solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data

Details:
### Summary
_Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._

\PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.

### Details
_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._

See https://github.com/advisories/GHSA-wgmf-q9vr-vww6

### PoC
_Complete instructions, including specific configuration details, to reproduce the vulnerability._

Example target script:

```
<?php

require 'vendor/autoload.php';

$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');

$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
print($writer->generateHTMLAll());
```

Save this file in the same directory:

[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx)

Open index.php in a web browser. An alert should be displayed.

### Impact
_What kind of vulnerability is it? Who is impacted?_

Full takeover of the session of users viewing spreadsheet files as HTML.
GitHub Security Advisory: GHSA-hm9j-cgmm-2w36
Package: aimeos/aimeos-laravel (COMPOSER)
Severity: HIGH (CVSS 8.2)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: = 2021.10
Patched in: unpatched

Summary: Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter

Details:
Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.
GitHub Security Advisory: GHSA-58q2-9x27-h2jm
Package: solspace/craft-freeform (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 4.1.29
Patched in: 4.1.30

Summary: solspace/craft-freeform Has a DoS Vulnerability

Details:
### Summary
Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754).

Freeform version: 4.1.29
Craft CMS version: 4.16.8

### Impact
When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`.

https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj
https://github.com/axios/axios/pull/7011
https://github.com/axios/axios/commit/945435fc[PII_REDACTED]8202250debb8d4ae892593
https://github.com/axios/axios/releases/tag/v1.12.0