chore(deps): update dependency undici to v6.11.1 [security] #421
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
6.6.1
->6.11.1
GitHub Vulnerability Alerts
CVE-2024-30260
Impact
Undici cleared Authorization and Proxy-Authorization headers for
fetch()
, but did not clear them forundici.request()
.Patches
This has been patched in nodejs/undici@6805746.
Fixes has been released in v5.28.4 and v6.11.1.
Workarounds
use
fetch()
or disablemaxRedirections
.References
Linzi Shang reported this.
CVE-2024-30261
Impact
If an attacker can alter the
integrity
option passed tofetch()
, they can letfetch()
accept requests as valid even if they have been tampered.Patches
Fixed in nodejs/undici@d542b8c.
Fixes has been released in v5.28.4 and v6.11.1.
Workarounds
Ensure that
integrity
cannot be tampered with.References
https://hackerone.com/reports/2377760
Release Notes
nodejs/undici (undici)
v6.11.1
Compare Source
v6.11.0
Compare Source
v6.10.2
Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v6.10.0...v6.10.2
v6.10.1
Compare Source
v6.10.0
Compare Source
What's Changed
4999fa1
to577f8eb
in /build by @dependabot in https://github.com/nodejs/undici/pull/2974New Contributors
Full Changelog: nodejs/undici@v6.9.0...v6.10.0
v6.9.0
Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v6.8.0...v6.9.0
v6.8.0
Compare Source
What's Changed
8bf9240
to7bfef1d
in /build by @dependabot in https://github.com/nodejs/undici/pull/29377bfef1d
to4999fa1
in /build by @dependabot in https://github.com/nodejs/undici/pull/2946New Contributors
Full Changelog: nodejs/undici@v6.7.1...v6.8.0
v6.7.1
Compare Source
What's Changed
d3271e4
to8bf9240
in /build by @dependabot in https://github.com/nodejs/undici/pull/2936New Contributors
Full Changelog: nodejs/undici@v6.7.0...v6.7.1
v6.7.0
Compare Source
What's Changed
s/ dispactgher/dispatcher/
by @steveluscher in https://github.com/nodejs/undici/pull/2807fetch
is aborted withnull
as theAbortSignal's
reason
by @steveluscher in https://github.com/nodejs/undici/pull/2833New Contributors
Full Changelog: nodejs/undici@v6.6.2...v6.7.0
v6.6.2
Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v6.6.1...v6.6.2
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.