chore(deps): update gatsby to v4.25.7 [security] #233

renovate · 2023-06-10T03:55:51Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
gatsby (source, changelog)	`4.6.2` -> `4.25.7`

GitHub Vulnerability Alerts

CVE-2023-34238

Impact

The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the __file-code-frame and __original-stack-frame paths, exposed when running the Gatsby develop server (gatsby develop).

The following steps can be used to reproduce the vulnerability:


# Create a new Gatsby project
$ npm init gatsby
$ cd my-gatsby-site

# Start the Gatsby develop server
$ gatsby develop

# Execute the Local File Inclusion vulnerability in __file-code-frame
$ curl "http://127.0.0.1:8000/__file-code-frame?filePath=/etc/passwd&lineNumber=1"

# Execute the Local File Inclusion vulnerability in __original-stack-frame
$ curl "http://127.0.0.1:8000/__original-stack-frame?moduleId=/etc/hosts&lineNumber=1&skipSourceMap=1"

It should be noted that by default gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as --host 0.0.0.0, -H 0.0.0.0, or the GATSBY_HOST=0.0.0.0 environment variable.

Patches

A patch has been introduced in gatsby@5.9.1 and gatsby@4.25.7 which mitigates the issue.

Workarounds

As stated above, by default gatsby develop is only exposed to the localhost 127.0.0.1. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

Credits

We would like to thank Maxwell Garrett of Assetnote for bringing the __file-code-frame issue to our attention.

For more information

Email us at security@gatsbyjs.com.

Release Notes

gatsbyjs/gatsby (gatsby)

Welcome to gatsby@4.24.0 release (September 2022 #2)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.23.1`

Compare Source

`v4.23.0`: v4.23

Compare Source

Welcome to gatsby@4.23.0 release (September 2022 #1)

Key highlights of this release:

Open RFCs

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.22.1`

Compare Source

`v4.22.0`: v4.22

Compare Source

Welcome to gatsby@4.22.0 release (August 2022 #3)

Key highlights of this release:

Open RFCs

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.21.1`

Compare Source

`v4.21.0`: v4.21

Compare Source

Welcome to gatsby@4.21.0 release (August 2022 #2)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.20.0`: v4.20

Compare Source

Welcome to gatsby@4.20.0 release (August 2022 #1)

Key highlights of this release:

RFC for changes in sort and aggregation fields in Gatsby GraphQL Schema
Release Candidate for gatsby-plugin-mdx v4 - Support for MDX v2 and more!

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.19.2`

Compare Source

`v4.19.1`

Compare Source

`v4.19.0`: v4.19

Compare Source

Welcome to gatsby@4.19.0 release (July 2022 #2)

Key highlights of this release:

Gatsby Head API - Better performance & more future-proof than react-helmet
Release Candidate for gatsby-plugin-mdx v4 - Support for MDX v2 and more!

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.18.2`

Compare Source

`v4.18.1`

Compare Source

`v4.18.0`: v4.18

Compare Source

Welcome to gatsby@4.18.0 release (July 2022 #1)

Key highlights of this release:

typesOutputPath option for GraphQL Typegen - Configure the location of the generated TypeScript types
Server Side Rendering (SSR) in development - Find bugs & hydration errors more easily during gatsby develop
Open RFCs - MDX v2 & Metadata management

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.17.2`

Compare Source

`v4.17.1`

Compare Source

`v4.17.0`: v4.17

Compare Source

Welcome to gatsby@4.17.0 release (June 2022 #2)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.16.0`: v4.16

Compare Source

Welcome to gatsby@4.16.0 release (June 2022 #1)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.15.2`

Compare Source

`v4.15.1`

Compare Source

`v4.15.0`: v4.15

Compare Source

Welcome to gatsby@4.15.0 release (May 2022 #2)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

[Full changelog][full-changelog]

`v4.14.1`

Compare Source

`v4.14.0`: v4.14

Compare Source

Welcome to gatsby@4.14.0 release (May 2022 #1)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.13.1`

Compare Source

`v4.13.0`: v4.13

Compare Source

Welcome to gatsby@4.13.0 release (April 2022 #2)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.12.1`

Compare Source

`v4.12.0`: v4.12

Compare Source

Welcome to gatsby@4.12.0 release (April 2022 #1)

Key highlights of this release:

New RFCs

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.11.3`

Compare Source

`v4.11.2`

Compare Source

`v4.11.1`

Compare Source

`v4.11.0`: v4.11

Compare Source

Welcome to gatsby@4.11.0 release (March 2022 #3)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.10.3`

Compare Source

`v4.10.2`

Compare Source

`v4.10.1`

Compare Source

`v4.10.0`: v4.10

Compare Source

Welcome to gatsby@4.10.0 release (March 2022 #2)

Key highlights of this release:

Image CDN

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.9.3`

Compare Source

`v4.9.2`

Compare Source

`v4.9.1`

Compare Source

`v4.9.0`: v4.9

Compare Source

Welcome to gatsby@4.9.0 release (March 2022 #1)

Key highlights of this release:

Support for TypeScript in gatsby-config and gatsby-node

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

`v4.8.2`

Compare Source

`v4.8.1`

Compare Source

`v4.8.0`: v4.8

Compare Source

Welcome to gatsby@4.8.0 release (February 2022 #2)

Key highlights of this release:

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

`v4.7.2`

Compare Source

`v4.7.1`

Compare Source

`v4.7.0`: v4.7

Compare Source

Welcome to gatsby@4.7.0 release (February 2022 #1)

Key highlights of this release:

trailingSlash Option - Now built into the Framework itself
Faster Schema Creation & createPages - Speed improvements of at least 30%

Also check out notable bugfixes.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know
if you have any issues.

Previous release notes

Full changelog

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2023-06-10T03:55:52Z

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

Branch has one or more failed status checks

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from 4eedb8f to 7dd732d Compare June 17, 2023 07:00

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from 026a937 to 0d3353c Compare July 6, 2023 18:08

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from 4481846 to d0cfdee Compare July 18, 2023 20:06

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 565db83 to 611071a Compare July 27, 2023 16:07

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 4 times, most recently from 366630f to 90d5a84 Compare August 3, 2023 10:43

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from c672c37 to 5893e6c Compare August 11, 2023 20:27

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from e441cb2 to 7843ccc Compare August 19, 2023 00:33

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from dcf025d to 84c8149 Compare August 26, 2023 00:39

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from 40d9f21 to 3e535a3 Compare September 9, 2023 01:31

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 079b42c to b046b7c Compare September 16, 2023 20:19

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from c346c1b to cf36617 Compare September 25, 2023 12:57

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from cf36617 to 9facb1a Compare October 7, 2023 01:38

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from cad71f7 to b983b8b Compare April 3, 2024 21:42

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from b33b901 to 12ac3ac Compare April 29, 2024 21:19

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 12ac3ac to 71193f4 Compare May 24, 2024 20:07

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 71193f4 to a83b3b2 Compare June 5, 2024 20:17

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from aa64fe4 to 337ce7c Compare June 20, 2024 15:56

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 3 times, most recently from 1ccf93c to fc816b2 Compare July 15, 2024 15:13

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 66564d9 to d3953f5 Compare July 26, 2024 21:46

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 597376a to 2a0850a Compare July 30, 2024 07:13

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 2a0850a to 15a96b8 Compare August 6, 2024 10:13

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 15a96b8 to 6735f9f Compare August 22, 2024 13:43

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 5 times, most recently from cc03b6a to e61ef83 Compare September 4, 2024 09:59

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from f7aa5f8 to 5f66cc0 Compare September 12, 2024 21:22

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 4 times, most recently from 961c84b to c64d147 Compare October 2, 2024 19:46

chore(deps): update gatsby to v4.25.7 [security]

491fe0d

renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from c64d147 to 491fe0d Compare October 3, 2024 16:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update gatsby to v4.25.7 [security] #233

chore(deps): update gatsby to v4.25.7 [security] #233

renovate bot commented Jun 10, 2023 •

edited

Loading

renovate bot commented Jun 10, 2023

chore(deps): update gatsby to v4.25.7 [security] #233

Are you sure you want to change the base?

chore(deps): update gatsby to v4.25.7 [security] #233

Conversation

renovate bot commented Jun 10, 2023 • edited Loading

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

Credits

For more information

Release Notes

v4.24.0: v4.24

v4.23.0: v4.23

v4.22.0: v4.22

v4.21.0: v4.21

v4.20.0: v4.20

v4.19.0: v4.19

v4.18.0: v4.18

v4.17.0: v4.17

v4.16.0: v4.16

v4.15.0: v4.15

v4.14.0: v4.14

v4.13.0: v4.13

v4.12.0: v4.12

v4.11.0: v4.11

v4.10.0: v4.10

v4.9.0: v4.9

v4.8.0: v4.8

v4.7.0: v4.7

Configuration

renovate bot commented Jun 10, 2023

Branch automerge failure

renovate bot commented Jun 10, 2023 •

edited

Loading

`v4.24.0`: v4.24

`v4.23.0`: v4.23

`v4.22.0`: v4.22

`v4.21.0`: v4.21

`v4.20.0`: v4.20

`v4.19.0`: v4.19

`v4.18.0`: v4.18

`v4.17.0`: v4.17

`v4.16.0`: v4.16

`v4.15.0`: v4.15

`v4.14.0`: v4.14

`v4.13.0`: v4.13

`v4.12.0`: v4.12

`v4.11.0`: v4.11

`v4.10.0`: v4.10

`v4.9.0`: v4.9

`v4.8.0`: v4.8

`v4.7.0`: v4.7