chore(deps): update dependency n8n to v1.59.4

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
n8n (source)	patch	1.59.3 -> 1.59.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

n8n-io/n8n (n8n)

v1.59.4

Compare Source

Bug Fixes

• editor: Prevent clipboard xss injection (#​10894) (20a99b9)
• editor: Update gird size when opening credentials support chat (#​10882) (42bfac0)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/n8n:1.59.4

📦 Image Reference ghcr.io/uniget-org/tools/n8n:1.59.4

digest	sha256:6da0d709d66eb0ceff48cb180a6baf222047dffdd08589eff319c0f600647466
vulnerabilities
platform	linux/amd64
size	143 MB
packages	1305

pdfjs-dist 2.16.105 (npm) pkg:npm/pdfjs-dist@2.16.105 Affected range <=4.1.392 Fixed version 4.2.67 Description Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches The patch removes the use of eval: mozilla/pdf.js#18015 Workarounds Set the option isEvalSupported to false. References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

semver 5.3.0 (npm) pkg:npm/semver@5.3.0 Inefficient Regular Expression Complexity Affected range <5.7.2 Fixed version 5.7.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

axios 1.6.7 (npm) pkg:npm/axios@1.6.7 Server-Side Request Forgery (SSRF) Affected range >=1.3.2 <=1.7.3 Fixed version 1.7.4 Description axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

body-parser 1.20.2 (npm) pkg:npm/body-parser@1.20.2 Asymmetric Resource Consumption (Amplification) Affected range <1.20.3 Fixed version 1.20.3 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Impact body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. Patches this issue is patched in 1.20.3 References

path-to-regexp 0.1.7 (npm) pkg:npm/path-to-regexp@0.1.7 Inefficient Regular Expression Complexity Affected range <0.1.10 Fixed version 0.1.10 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Impact A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b. Patches For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0. These versions add backtrack protection when a custom regex pattern is not provided: 0.1.10 1.9.0 3.3.0 6.3.0 They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability. Version 7.1.0 can enable strict: true and get an error when the regular expression might be bad. Version 8.0.0 removes the features that can cause a ReDoS. Workarounds All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b to /:a-:b([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster. Details Using /:a-:b will produce the regular expression /^\/([^\/]+?)-([^\/]+?)\/?$/. This can be exploited by a path such as /a${'-a'.repeat(8_000)}/a. OWASP has a good example of why this occurs, but the TL;DR is the /a at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the :a-:b on the repeated 8,000 -a. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms. References OWASP Detailed blog post

send 0.18.0 (npm) pkg:npm/send@0.18.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <0.19.0 Fixed version 0.19.0 CVSS Score 5 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L Description Impact passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code Patches this issue is patched in send 0.19.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist Details successful exploitation of this vector requires the following: The attacker MUST control the input to response.redirect() express MUST NOT redirect before the template appears the browser MUST NOT complete redirection before: the user MUST click on the link in the template

express 4.19.2 (npm) pkg:npm/express@4.19.2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <4.20.0 Fixed version 4.20.0 CVSS Score 5 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L Description Impact In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code Patches this issue is patched in express 4.20.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist Details successful exploitation of this vector requires the following: The attacker MUST control the input to response.redirect() express MUST NOT redirect before the template appears the browser MUST NOT complete redirection before: the user MUST click on the link in the template

serve-static 1.15.0 (npm) pkg:npm/serve-static@1.15.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.16.0 Fixed version 1.16.0 CVSS Score 5 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L Description Impact passing untrusted user input - even after sanitizing it - to redirect() may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist Details successful exploitation of this vector requires the following: The attacker MUST control the input to response.redirect() express MUST NOT redirect before the template appears the browser MUST NOT complete redirection before: the user MUST click on the link in the template

identity 3.4.2 (npm) pkg:npm/%40azure/identity@3.4.2 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Affected range <4.2.1 Fixed version 4.2.1 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Description Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/10963053509.

[github-actions]

PR is blocked and can not be merged. See https://github.com/uniget-org/tools/actions/runs/10963053509.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/10963053509.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/10963053509.