Need to bump axios to 1.6.0+ (and test) to address vulnerability about fluidframework

[bryanchen-d]

We are hitting same CG alert on the dependency of this package, is there any updates on this?

[JasonGore]

A couple of recent PRs have bumped axios but there is still an instance in @fluidframework/driver-utils that needs to be bumped as well.

[JasonGore]

@alexvy86 Since you did the other two PRs is this an update that you're planning on doing as well? Thanks!

[alexvy86]

Not me specifically but @jatgarg has some work items on his plate to do it soon.

I'd expect that using an override / yarn resolution to force 1.6 on your end while we make this change should be ok; in the cases where we already upgraded axios we didn't have to make any code changes, and AFAIK we don't do anything too fancy with it, so what I saw in axios' release notes didn't seem particularly concerning.

[jatgarg]

The work to update it in FF packages will be done in this sprint which is ending on 12/22

[astegmaier]

It looks like this work was completed in #18848. Although the change is not yet published (8.0.0 and 2.0.0-dev-rc.1.0.0.225277 has it, but 2.0.0-internal.8.0.0 and 2.0.0-internal.7.4.0 do not) - presumably this will happen soon enough, though.

[bryanchen-d]

@jatgarg would there be a new patch release for 1.x version with this fix?