Old axios version included in js bundle

[fritz-c]

Even in the latest version of this library, an old version of axios (v0.21.4) is being included in the js bundle (dist/js/field.js).

My Environment

ziffmedia/nova-select-plus Version: v2.1.0-beta.4
Nova version 5.2.1
Chrome Version 133.0.6943.54

This is causing a problem for me, emerging in the form of this console error:

app.js?id=fa13d87445896534a214751fa8861697:1 Uncaught (in promise) TypeError: Cannot destructure property 'status' of 't' as it is undefined.
    at app.js?id=fa13d87445896534a214751fa8861697:1:466
    at async yt.request (vendor.js?id=72a16d849ca92f77ad8a60cb99c6f036:2:2364549)
    at yt.request (vendor.js?id=72a16d849ca92f77ad8a60cb99c6f036:2:2364645)

It took me a bit of work to trace this error back to the library, so I'll explain a bit more background.

The error is triggered whenever I make a change to a field, say Select::make('kind') that is referenced in a ->dependsOn( setting on the SelectPlus field:

SelectPlus::make('Choices')
    // ...
    ->dependsOn(['kind'], function (SelectPlus $field, NovaRequest $request, FormData $formData) {
        if ($formData->kind === 'unknown') {
            $field->hide();
        }
    }),

The 'kind' value changing triggers a request to the Nova backend, or rather it would if it didn't hit that error first.

Even more background

The error, working backwards, starts in
vendor/laravel/nova/resources/js/bootstrap/axios.js, where destructuring an undefined error.response triggers the error.
The reason error.response is undefined is that, in the course of making a request (the Nova.request().patch request called in syncField in vendor/laravel/nova/resources/js/mixins/DependentFormField.js, a mixin which this library uses), something triggered an error, that wasn't an HTTP error (this isn't the first time someone's had issues with a lack of handling there).

The stack trace of that non-response-related error looks like this:

TypeError: r.cancelToken.subscribe is not a function
    at vendor.js?id=72a16d849ca92f77ad8a60cb99c6f036:2:2357735
    at new Promise (<anonymous>)
    at xhr (vendor.js?id=72a16d849ca92f77ad8a60cb99c6f036:2:2355993)
    at yt.pt (vendor.js?id=72a16d849ca92f77ad8a60cb99c6f036:2:2363110)
    at yt._request (vendor.js?id=72a16d849ca92f77ad8a60cb99c6f036:2:2366132)
    at yt.request (vendor.js?id=72a16d849ca92f77ad8a60cb99c6f036:2:2364560)
    at yt.patch (vendor.js?id=72a16d849ca92f77ad8a60cb99c6f036:2:2366580)
    at Function.patch (vendor.js?id=72a16d849ca92f77ad8a60cb99c6f036:2:2334977)
    at Proxy.syncField (select-plus-field:7:23589)
    at select-plus-field:7:22980

The top line there is thrown from logic in the latest version of axios. It expects a CancelToken instance to have a subscribe method, which it in theory does have.

I fiddled some more with the dev tools and stumbled upon a definition of the CancelToken class that didn't have a subscribe, method, however, and it was in the bundle for this library.

Unminified CancelToken class from nova-select-plus's field.js

(t, e, n) => {
    "use strict";
    var r = n(4495);
    function o(t) {
        if ("function" != typeof t) throw new TypeError("executor must be a function.");
        var e;
        this.promise = new Promise(function (t) {
            e = t;
        });
        var n = this;
        t(function (t) {
            n.reason || ((n.reason = new r(t)), e(n.reason));
        });
    }
    (o.prototype.throwIfRequested = function () {
        if (this.reason) throw this.reason;
    }),
        (o.source = function () {
            var t;
            return {
                token: new o(function (e) {
                    t = e;
                }),
                cancel: t,
            };
        }),
        (t.exports = o);
};

If I had to guess, I'd say an older version of Nova is installed wherever npm run prod is being run, so it builds in the older dependencies.