Current Behavior
@nx/module-federation has vulnerable axios version (namely 1.13.5: CVE-2025-62718) from peer dependency @module-federation/enhanced. The issue is fixed (module-federation/core#4649) from @module-federation/enhanced ^2.3.2
@nx/module-federation 22.6.5
│ │ ├─┬ @module-federation/enhanced 2.3.1
│ │ │ ├─┬ @module-federation/cli 2.3.1
│ │ │ │ └─┬ @module-federation/dts-plugin 2.3.1
│ │ │ │ └── axios 1.13.5
│ │ │ ├─┬ @module-federation/dts-plugin 2.3.1
│ │ │ │ └── axios 1.13.5
│ │ │ ├─┬ @module-federation/manifest 2.3.1
│ │ │ │ └─┬ @module-federation/dts-plugin 2.3.1
│ │ │ │ └── axios 1.13.5
│ │ │ └─┬ @module-federation/rspack 2.3.1
│ │ │ ├─┬ @module-federation/dts-plugin 2.3.1
│ │ │ │ └── axios 1.13.5
│ │ │ └─┬ @module-federation/manifest 2.3.1
│ │ │ └─┬ @module-federation/dts-plugin 2.3.1
│ │ │ └── axios 1.13.5
Expected Behavior
Upgrade module-federation to version 2.3.2 or higher
GitHub Repo
No response
Steps to Reproduce
Nx Report
Node : 22.12.0
OS : darwin-arm64
Native Target : aarch64-macos
pnpm : 10.20.0
daemon : Disabled
nx : 22.6.5
@nx/js : 22.6.5
@nx/eslint : 22.6.5
@nx/workspace : 22.6.5
@nx/angular : 22.6.5
@nx/jest : 22.6.5
@nx/devkit : 22.6.5
@nx/eslint-plugin : 22.6.5
@nx/module-federation : 22.6.5
@nx/next : 22.6.5
@nx/plugin : 22.6.5
@nx/react : 22.6.5
@nx/rollup : 22.6.5
@nx/rspack : 22.6.5
@nx/vite : 22.6.5
@nx/vitest : 22.6.5
@nx/web : 22.6.5
@nx/webpack : 22.6.5
typescript : 5.9.3
---------------------------------------
Registered Plugins:
@nx/next/plugin
@nx/vitest
@nx/eslint/plugin
@nx/react/router-plugin
@nx/vite/plugin
@documedis/nx/plugins/api-generator
@documedis/nx/plugins/tailwind-compile
---------------------------------------
Community plugins:
@analogjs/vite-plugin-angular : 2.2.3
---------------------------------------
Cache Usage: 0.00 B / 92.64 GB
Failure Logs
Package Manager Version
No response
Operating System
Additional Information
No response
Current Behavior
@nx/module-federationhas vulnerable axios version (namely 1.13.5: CVE-2025-62718) from peer dependency@module-federation/enhanced. The issue is fixed (module-federation/core#4649) from @module-federation/enhanced ^2.3.2@nx/module-federation 22.6.5
│ │ ├─┬ @module-federation/enhanced 2.3.1
│ │ │ ├─┬ @module-federation/cli 2.3.1
│ │ │ │ └─┬ @module-federation/dts-plugin 2.3.1
│ │ │ │ └── axios 1.13.5
│ │ │ ├─┬ @module-federation/dts-plugin 2.3.1
│ │ │ │ └── axios 1.13.5
│ │ │ ├─┬ @module-federation/manifest 2.3.1
│ │ │ │ └─┬ @module-federation/dts-plugin 2.3.1
│ │ │ │ └── axios 1.13.5
│ │ │ └─┬ @module-federation/rspack 2.3.1
│ │ │ ├─┬ @module-federation/dts-plugin 2.3.1
│ │ │ │ └── axios 1.13.5
│ │ │ └─┬ @module-federation/manifest 2.3.1
│ │ │ └─┬ @module-federation/dts-plugin 2.3.1
│ │ │ └── axios 1.13.5
Expected Behavior
Upgrade module-federation to version 2.3.2 or higher
GitHub Repo
No response
Steps to Reproduce
Nx Report
Failure Logs
Package Manager Version
No response
Operating System
Additional Information
No response