chore(deps): update gatsby to v4.25.7 [security] #233

renovate · 2023-06-10T03:55:51Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
gatsby (source, changelog)	`4.6.2` -> `4.25.7`

GitHub Vulnerability Alerts

CVE-2023-34238

Impact

The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the __file-code-frame and __original-stack-frame paths, exposed when running the Gatsby develop server (gatsby develop).

The following steps can be used to reproduce the vulnerability:


# Create a new Gatsby project
$ npm init gatsby
$ cd my-gatsby-site

# Start the Gatsby develop server
$ gatsby develop

# Execute the Local File Inclusion vulnerability in __file-code-frame
$ curl "http://127.0.0.1:8000/__file-code-frame?filePath=/etc/passwd&lineNumber=1"

# Execute the Local File Inclusion vulnerability in __original-stack-frame
$ curl "http://127.0.0.1:8000/__original-stack-frame?moduleId=/etc/hosts&lineNumber=1&skipSourceMap=1"

It should be noted that by default gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as --host 0.0.0.0, -H 0.0.0.0, or the GATSBY_HOST=0.0.0.0 environment variable.

Patches

A patch has been introduced in gatsby@5.9.1 and gatsby@4.25.7 which mitigates the issue.

Workarounds

As stated above, by default gatsby develop is only exposed to the localhost 127.0.0.1. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

Credits

We would like to thank Maxwell Garrett of Assetnote for bringing the __file-code-frame issue to our attention.

For more information

Email us at security@gatsbyjs.com.

Release Notes

gatsbyjs/gatsby (gatsby)

Welcome to gatsby@4.24.0 release (September 2022 #2)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.23.1`

Compare Source

`v4.23.0`: v4.23

Compare Source

Welcome to gatsby@4.23.0 release (September 2022 #1)

Key highlights of this release:

Open RFCs

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.22.1`

Compare Source

`v4.22.0`: v4.22

Compare Source

Welcome to gatsby@4.22.0 release (August 2022 #3)

Key highlights of this release:

Open RFCs

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.21.1`

Compare Source

`v4.21.0`: v4.21

Compare Source

Welcome to gatsby@4.21.0 release (August 2022 #2)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.20.0`: v4.20

Compare Source

Welcome to gatsby@4.20.0 release (August 2022 #1)

Key highlights of this release:

RFC for changes in sort and aggregation fields in Gatsby GraphQL Schema
Release Candidate for gatsby-plugin-mdx v4 - Support for MDX v2 and more!

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.19.2`

Compare Source

`v4.19.1`

Compare Source

`v4.19.0`: v4.19

Compare Source

Welcome to gatsby@4.19.0 release (July 2022 #2)

Key highlights of this release:

Gatsby Head API - Better performance & more future-proof than react-helmet
Release Candidate for gatsby-plugin-mdx v4 - Support for MDX v2 and more!

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.18.2`

Compare Source

`v4.18.1`

Compare Source

`v4.18.0`: v4.18

Compare Source

Welcome to gatsby@4.18.0 release (July 2022 #1)

Key highlights of this release:

typesOutputPath option for GraphQL Typegen - Configure the location of the generated TypeScript types
Server Side Rendering (SSR) in development - Find bugs & hydration errors more easily during gatsby develop
Open RFCs - MDX v2 & Metadata management

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.17.2`

Compare Source

`v4.17.1`

Compare Source

`v4.17.0`: v4.17

Compare Source

Welcome to gatsby@4.17.0 release (June 2022 #2)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.16.0`: v4.16

Compare Source

Welcome to gatsby@4.16.0 release (June 2022 #1)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.15.2`

Compare Source

`v4.15.1`

Compare Source

`v4.15.0`: v4.15

Compare Source

Welcome to gatsby@4.15.0 release (May 2022 #2)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

[Full changelog][full-changelog]

`v4.14.1`

Compare Source

`v4.14.0`: v4.14

Compare Source

Welcome to gatsby@4.14.0 release (May 2022 #1)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.13.1`

Compare Source

`v4.13.0`: v4.13

Compare Source

Welcome to gatsby@4.13.0 release (April 2022 #2)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.12.1`

Compare Source

`v4.12.0`: v4.12

Compare Source

Welcome to gatsby@4.12.0 release (April 2022 #1)

Key highlights of this release:

New RFCs

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.11.3`

Compare Source

`v4.11.2`

Compare Source

`v4.11.1`

Compare Source

`v4.11.0`: v4.11

Compare Source

Welcome to gatsby@4.11.0 release (March 2022 #3)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.10.3`

Compare Source

`v4.10.2`

Compare Source

`v4.10.1`

Compare Source

`v4.10.0`: v4.10

Compare Source

Welcome to gatsby@4.10.0 release (March 2022 #2)

Key highlights of this release:

Image CDN

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.9.3`

Compare Source

`v4.9.2`

Compare Source

`v4.9.1`

Compare Source

`v4.9.0`: v4.9

Compare Source

Welcome to gatsby@4.9.0 release (March 2022 #1)

Key highlights of this release:

Support for TypeScript in gatsby-config and gatsby-node

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.8.2`

Compare Source

`v4.8.1`

Compare Source

`v4.8.0`: v4.8

Compare Source

Welcome to gatsby@4.8.0 release (February 2022 #2)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.7.2`

Compare Source

`v4.7.1`

Compare Source

`v4.7.0`: v4.7

Compare Source

Welcome to gatsby@4.7.0 release (February 2022 #1)

Key highlights of this release:

trailingSlash Option - Now built into the Framework itself
Faster Schema Creation & createPages - Speed improvements of at least 30%

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2023-06-10T03:55:52Z

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

Branch has one or more failed status checks

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from 4eedb8f to 7dd732d Compare June 17, 2023 07:00

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from 026a937 to 0d3353c Compare July 6, 2023 18:08

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from 4481846 to d0cfdee Compare July 18, 2023 20:06

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 565db83 to 611071a Compare July 27, 2023 16:07

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 4 times, most recently from 366630f to 90d5a84 Compare August 3, 2023 10:43

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from c672c37 to 5893e6c Compare August 11, 2023 20:27

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from e441cb2 to 7843ccc Compare August 19, 2023 00:33

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from dcf025d to 84c8149 Compare August 26, 2023 00:39

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from 40d9f21 to 3e535a3 Compare September 9, 2023 01:31

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 079b42c to b046b7c Compare September 16, 2023 20:19

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from c346c1b to cf36617 Compare September 25, 2023 12:57

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from cf36617 to 9facb1a Compare October 7, 2023 01:38

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 2a0850a to 15a96b8 Compare August 6, 2024 10:13

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 15a96b8 to 6735f9f Compare August 22, 2024 13:43

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 5 times, most recently from cc03b6a to e61ef83 Compare September 4, 2024 09:59

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from f7aa5f8 to 5f66cc0 Compare September 12, 2024 21:22

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 5 times, most recently from c64d147 to 491fe0d Compare October 3, 2024 16:06

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 491fe0d to 0af9f4f Compare October 10, 2024 19:25

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 5 times, most recently from cfa8f6e to 16f190c Compare October 26, 2024 10:12

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 16f190c to 6f7eb05 Compare November 3, 2024 12:04

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 6f7eb05 to 1b86802 Compare December 5, 2024 22:36

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from ce41544 to 22f8001 Compare December 24, 2024 07:30

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 22f8001 to ff372bd Compare January 10, 2025 23:06

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from b763c14 to 4d1aa54 Compare January 25, 2025 00:58

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 4d1aa54 to fa81577 Compare February 8, 2025 16:48

chore(deps): update gatsby to v4.25.7 [security]

6427733

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from fa81577 to 6427733 Compare February 14, 2025 19:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update gatsby to v4.25.7 [security] #233

chore(deps): update gatsby to v4.25.7 [security] #233

renovate bot commented Jun 10, 2023 •

edited

Loading

renovate bot commented Jun 10, 2023

chore(deps): update gatsby to v4.25.7 [security] #233

Are you sure you want to change the base?

chore(deps): update gatsby to v4.25.7 [security] #233

Conversation

renovate bot commented Jun 10, 2023 • edited Loading

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

Credits

For more information

Release Notes

v4.24.0: v4.24

v4.23.0: v4.23

v4.22.0: v4.22

v4.21.0: v4.21

v4.20.0: v4.20

v4.19.0: v4.19

v4.18.0: v4.18

v4.17.0: v4.17

v4.16.0: v4.16

v4.15.0: v4.15

v4.14.0: v4.14

v4.13.0: v4.13

v4.12.0: v4.12

v4.11.0: v4.11

v4.10.0: v4.10

v4.9.0: v4.9

v4.8.0: v4.8

v4.7.0: v4.7

Configuration

renovate bot commented Jun 10, 2023

Branch automerge failure

renovate bot commented Jun 10, 2023 •

edited

Loading

`v4.24.0`: v4.24

`v4.23.0`: v4.23

`v4.22.0`: v4.22

`v4.21.0`: v4.21

`v4.20.0`: v4.20

`v4.19.0`: v4.19

`v4.18.0`: v4.18

`v4.17.0`: v4.17

`v4.16.0`: v4.16

`v4.15.0`: v4.15

`v4.14.0`: v4.14

`v4.13.0`: v4.13

`v4.12.0`: v4.12

`v4.11.0`: v4.11

`v4.10.0`: v4.10

`v4.9.0`: v4.9

`v4.8.0`: v4.8

`v4.7.0`: v4.7