Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update make-fetch-happen to 11.0.3 #2796

Merged
merged 1 commit into from
Apr 22, 2023
Merged

Conversation

ravindraP20
Copy link
Contributor

@ravindraP20 ravindraP20 commented Feb 10, 2023

Closes #2795
Blocked by #2770

http-cache-semantics 4.1.0 is vulnerable

https://www.cve.org/CVERecord?id=CVE-2022-25881

Checklist
  • npm install && npm test passes
  • tests are included
  • documentation is changed or added
  • commit message follows commit guidelines
Description of change

http-cache-semantics 4.1.0 is vulnerable

https://www.cve.org/CVERecord?id=CVE-2022-25881

npm/make-fetch-happen#210

@cclauss
Copy link
Contributor

cclauss commented Feb 10, 2023

@wraithgar @nlf Your reviews, please.

@wraithgar
Copy link
Contributor

The engines declaration for this version of make-fetch-happen is incompatible with the current one of node-gyp. This PR is blocked by #2770

@n10000k
Copy link

n10000k commented Mar 23, 2023

This is causing 1 high severity vulnerability from http-cache-semantics within make-fetch-happen.

Do we have an eta on this?

@mayurborkar27
Copy link

http-cache-semantics 4.1.0 is high vulnerability issue. need to update make-fetch-happen to 11.0.3
Details: https://www.cve.org/CVERecord?id=CVE-2022-25881
When can we expect the update on this or any ETA?

@cclauss
Copy link
Contributor

cclauss commented Mar 27, 2023

When you want a pull request to be merged, please give it a positive review as @fengmk2 has done at the top right of this page. Every checkmark ✔️ that project maintainers see there gives them confidence that the proposed changes have been looked at and have been deemed both useful and safe to merge into the codebase. Lots of "what is the ETA?" comments are easier for maintainers to ignore than ✔️✔️✔️✔️✔️ from several different reviewers.

Anyone can review a pull request on GitHub. To do so here:

  1. Scroll to the top of this page.
  2. Click the Files changed tab.
  3. Click the Review changes button.
  4. Click Approve (or one of the other options) and make comments only if they have not already been stated in the PR.
  5. Click Submit review so that your ✔️ can be added to the list.

@cclauss
Copy link
Contributor

cclauss commented Mar 27, 2023

Also, the comment above that this PR is blocked by #2770 means that interested parties should review that one as well.

@benjaminpjones
Copy link

benjaminpjones commented Apr 8, 2023

If I understand @wraithgar's comment correctly, the dependency is only on the engines upgrade, and not on the whole of #2770. Since the length of #2770 was cited as a blocker for review, I've broken out the one-line "engines" commit into a separate PR for convenience (#2827), and would appreciate your reviews!

@n10000k
Copy link

n10000k commented Apr 8, 2023

@cclauss 100%, however the original PR blocker is just going to become stale at this point, it's now 4 months old :(

@cclauss cclauss merged commit 02480f6 into nodejs:main Apr 22, 2023
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 7, 2023
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 8, 2023
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 9, 2023
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 9, 2023
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 9, 2023
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 10, 2023
@legobeat
Copy link

legobeat commented May 16, 2023

@cclauss Tests are now breaking on main on node 14~18: https://github.com/nodejs/node-gyp/actions/runs/4811204563/jobs/8564880967

Not sure why #2827 was closed (make-fetch-happen@11 and the new transitive cacache, minipass-fetch, and ssri^10 do end support for node 12)?

#2770 still looks relevant and is now rebased and updated by author.

@legobeat
Copy link

legobeat commented May 17, 2023

FWIW this change (updating make-fetch-happen) is/was breaking - package managers like yarn will refuse to install if on node 12.

Just opened npm/make-fetch-happen#243. Seems like it would make the situation more straight-forward on this side (assuming a node-gyp@9.x release with a yet-to-be-released make-fetch-happen@10.x is feasible)

legobeat added a commit to legobeat/node-gyp that referenced this pull request May 17, 2023
legobeat added a commit to legobeat/node-gyp that referenced this pull request May 17, 2023
This reverts commit 02480f6, thereby
rolling back dependency make-fetch-happen from ^11.0.3 to ^10.0.3.

The upgrade is breaking for node-fetch users as it has transitive
dependencies with syntax incompatible with supported Node.js versions.

Related:
- nodejs#2770
- nodejs#2837
- nodejs#2816
- nodejs#2848
- nodejs#2827
- nodejs#2796
@benjaminpjones
Copy link

benjaminpjones commented May 18, 2023

Not sure why #2827 was closed

I closed #2827 because this PR had already been merged. Happy to re-open, but it seems we can accomplish the same through #2770 directly.

legobeat added a commit to legobeat/node-gyp that referenced this pull request Jun 26, 2023
This reverts commit 02480f6, thereby
rolling back dependency make-fetch-happen from ^11.0.3 to ^10.0.3.

The upgrade is breaking for node-fetch users as it has transitive
dependencies with syntax incompatible with supported Node.js versions.

Related:
- nodejs#2770
- nodejs#2837
- nodejs#2816
- nodejs#2848
- nodejs#2827
- nodejs#2796
@legobeat legobeat mentioned this pull request Jul 5, 2023
lukekarrys added a commit that referenced this pull request Oct 27, 2023
lukekarrys added a commit that referenced this pull request Oct 27, 2023
lukekarrys added a commit that referenced this pull request Oct 27, 2023
lukekarrys added a commit that referenced this pull request Oct 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

update make-fetch-happen to 11.0.3
8 participants