mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-11-09 00:22:38 -06:00
simplify-filter-syntax-non-technical-users
306
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 kolaente
|
9077ad79f1 | fix(desktop): skip AppImage protocol handler for paths with backslashes | ||
 renovate[bot]andkolaente
|
8f8c52fe82 | chore(deps): update dependency ip-address to v10.7.5 | ||
|
renovate[bot]andkolaente
|
0114a03da7 | chore(deps): update pnpm to v12 | ||
|
renovate[bot]andkolaente
|
338cdff2c2 | chore(deps): update dev-dependencies | ||
|
renovate[bot]andkolaente
|
186927df79 | chore(deps): update dependency minimatch to v11 [security] | ||
 dependabot[bot]andkolaente
|
aaf21f681f |
chore(deps): bump body-parser from 2.3.0 to 2.4.0 in /desktop
Bumps [body-parser](https://github.com/expressjs/body-parser) from 2.3.0 to 2.4.0. - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](https://github.com/expressjs/body-parser/compare/v2.3.0...v2.4.0) --- updated-dependencies: - dependency-name: body-parser dependency-version: 2.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
  |
ad9ab28cde |
chore(deps): update dependency undici@6 to v8.12.2 [security] (#4242)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [undici@6](https://undici.nodejs.org) ([source](https://redirect.github.com/nodejs/undici)) | [`8.10.2` → `8.12.2`](https://renovatebot.com/diffs/npm/undici@6/8.10.2/8.12.2) |  |  | --- ### undici vulnerable to Denial of Service via unbounded memory in the EventSource parser [CVE-2026-109924](https://nvd.nist.gov/vuln/detail/CVE-2026-109924) / [GHSA-4qv8-2p9j-2685](https://redirect.github.com/advisories/GHSA-4qv8-2p9j-2685) <details> <summary>More information</summary> #### Details ##### Impact undici's `EventSource` client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed `data:` fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state. The byte-based `maxEventSize` and `maxResponseSize` limits do not bound that retained state, and `maxResponseSize` is enforced on the compressed body before decompression, so a small compressed response can expand into enough retained memory to terminate the process. The application only needs to maintain an `EventSource` connection to an untrusted peer, which controls only the response. Availability is the only impact. ##### Patches Upgrade to `6.29.1`, `7.30.1`, or `8.12.2`, which bound the retained EventSource parser state (the number of `data` fields and buffered chunks, the unfinished-line length, and per-field byte totals) independently of the byte limits. ##### Workarounds None. #### Severity - CVSS Score: 5.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685) - [https://nvd.nist.gov/vuln/detail/CVE-2026-109924](https://nvd.nist.gov/vuln/detail/CVE-2026-109924) - [https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6](https://redirect.github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6) - [https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab](https://redirect.github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab) - [https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e](https://redirect.github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://redirect.github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v6.29.1](https://redirect.github.com/nodejs/undici/releases/tag/v6.29.1) - [https://github.com/nodejs/undici/releases/tag/v7.30.1](https://redirect.github.com/nodejs/undici/releases/tag/v7.30.1) - [https://github.com/nodejs/undici/releases/tag/v8.12.2](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4qv8-2p9j-2685) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens [CVE-2026-109841](https://nvd.nist.gov/vuln/detail/CVE-2026-109841) / [GHSA-f72v-6w45-q472](https://redirect.github.com/advisories/GHSA-f72v-6w45-q472) <details> <summary>More information</summary> #### Details ##### Impact undici's `fetch()` verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as `SHA256-...` or `Sha256-...` is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check. An application that pins a response with a valid uppercase or mixed-case SRI token receives attacker-controlled bytes with no integrity error. The attacker needs only to control the response body, not the application's integrity metadata. The issue affects response integrity only. The regression was introduced in undici 7.15.0; releases 7.14.0 and earlier lowercase the token and are not affected. ##### Patches Upgrade to `7.30.1` or `8.12.2`. undici now normalizes the algorithm token to ASCII lowercase before validating it and before selecting the strongest algorithm, so case variants of SHA-256, SHA-384, and SHA-512 are verified correctly. ##### Workarounds Use lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in `integrity` metadata. #### Severity - CVSS Score: 5.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472) - [https://nvd.nist.gov/vuln/detail/CVE-2026-109841](https://nvd.nist.gov/vuln/detail/CVE-2026-109841) - [https://github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00](https://redirect.github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00) - [https://github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0](https://redirect.github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://redirect.github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v7.30.1](https://redirect.github.com/nodejs/undici/releases/tag/v7.30.1) - [https://github.com/nodejs/undici/releases/tag/v8.12.2](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-f72v-6w45-q472) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### undici vulnerable to Denial of Service via unhandled error on excessive content-encodings [CVE-2026-109869](https://nvd.nist.gov/vuln/detail/CVE-2026-109869) / [GHSA-xjj6-f33q-929c](https://redirect.github.com/advisories/GHSA-xjj6-f33q-929c) <details> <summary>More information</summary> #### Details ##### Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled `error` and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the `fetch()` rejection. undici 6.x, 7.x, and 8.x are affected. ##### Patches Upgrade to `6.29.1`, `7.30.1`, or `8.12.2`. undici now validates the content-encoding chain before creating the internal body stream and aborts the response when the limit is exceeded, so no error can surface on an orphaned stream. ##### Workarounds None. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c) - [https://nvd.nist.gov/vuln/detail/CVE-2026-109869](https://nvd.nist.gov/vuln/detail/CVE-2026-109869) - [https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429](https://redirect.github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429) - [https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436](https://redirect.github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436) - [https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5](https://redirect.github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://redirect.github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v6.29.1](https://redirect.github.com/nodejs/undici/releases/tag/v6.29.1) - [https://github.com/nodejs/undici/releases/tag/v7.30.1](https://redirect.github.com/nodejs/undici/releases/tag/v7.30.1) - [https://github.com/nodejs/undici/releases/tag/v8.12.2](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xjj6-f33q-929c) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>nodejs/undici (undici@6)</summary> ### [`v8.12.2`](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.2) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.12.1...v8.12.2) #### Security fixes ##### High severity ##### Denial of service via TLS 1.2 certificate-changing renegotiation **CVE-2026-87018 · [GHSA-qrxm-fqhp-jwvm](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)** A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process. ##### TLS certificate validation bypass through dropped `Agent` options **CVE-2026-109383 · [GHSA-2m5v-pch6-74hx](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)** `Agent` used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as `checkServerIdentity`. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers. ##### Cache poisoning and cross-user disclosure through cross-origin redirects **CVE-2026-109829 · [GHSA-4w7w-5xrc-9h26](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26)** When an originless `Agent` combined redirect and shared-cache interceptors as `compose(redirect(), cache())`, a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy. ##### Denial of service through excessive `Content-Encoding` values **CVE-2026-109869 · [GHSA-xjj6-f33q-929c](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c)** A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although `fetch()` rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely. ##### Medium severity ##### Denial of service through the `decompress` interceptor **CVE-2026-87029 · [GHSA-55wc-3pg8-jfw6](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6)** An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when `decompress` was composed with a handler such as `dump` with a size limit. This release converts downstream handler exceptions into per-request errors. ##### Subresource Integrity bypass with non-lowercase algorithm tokens **CVE-2026-109841 · [GHSA-f72v-6w45-q472](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472)** `fetch()` treated valid mixed-case or uppercase SRI algorithm tokens, such as `SHA256`, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection. ##### Denial of service through unbounded EventSource parser state **CVE-2026-109924 · [GHSA-4qv8-2p9j-2685](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)** A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny `data:` fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data. ##### Denial of service through unbounded automatic WebSocket PONG buffering **CVE-2026-109932 · [GHSA-9fm3-97px-rjf6](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)** A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains. **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.12.1...v8.12.2> ### [`v8.12.1`](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.1) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.12.0...v8.12.1) #### What's Changed - fix: restore build:wasm npm script by [@​mcollina](https://redirect.github.com/mcollina) in [#​6009](https://redirect.github.com/nodejs/undici/pull/6009) - test: add unexpected disconnect guards to http2-body-delete.js by [@​Kesavamoorthig06](https://redirect.github.com/Kesavamoorthig06) in [#​5970](https://redirect.github.com/nodejs/undici/pull/5970) #### New Contributors - [@​Kesavamoorthig06](https://redirect.github.com/Kesavamoorthig06) made their first contribution in [#​5970](https://redirect.github.com/nodejs/undici/pull/5970) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.12.0...v8.12.1> ### [`v8.12.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.0) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.11.2...v8.12.0) #### What's Changed - fix(cookies): ignore a numeric expires outside the Date range by [@​xia-chao](https://redirect.github.com/xia-chao) in [#​5832](https://redirect.github.com/nodejs/undici/pull/5832) - fix(http2): pause bodyTimeout while applying backpressure by [@​jasnell](https://redirect.github.com/jasnell) in [#​5884](https://redirect.github.com/nodejs/undici/pull/5884) - fix(cache): track cached response abort state by [@​mcollina](https://redirect.github.com/mcollina) in [#​5820](https://redirect.github.com/nodejs/undici/pull/5820) - fix(deduplicate): make terminal callbacks exception-safe by [@​mcollina](https://redirect.github.com/mcollina) in [#​5838](https://redirect.github.com/nodejs/undici/pull/5838) - fix(decompress): stop inflating compress and x-compress by [@​luantaraschi](https://redirect.github.com/luantaraschi) in [#​5665](https://redirect.github.com/nodejs/undici/pull/5665) - fix(cache): evict least recently used entries in MemoryCacheStore by [@​jasnell](https://redirect.github.com/jasnell) in [#​5869](https://redirect.github.com/nodejs/undici/pull/5869) - fix(eventsource): fix redirect targets in eventsource by [@​jasnell](https://redirect.github.com/jasnell) in [#​5878](https://redirect.github.com/nodejs/undici/pull/5878) - fix(redirect): fix throwOnMaxRedirect edge by [@​jasnell](https://redirect.github.com/jasnell) in [#​5879](https://redirect.github.com/nodejs/undici/pull/5879) - fix: normalize HTTP/2 headers for legacy dispatch handlers by [@​Knowzzz](https://redirect.github.com/Knowzzz) in [#​5867](https://redirect.github.com/nodejs/undici/pull/5867) - fix(session cache): fix bug in tls session caching by [@​jasnell](https://redirect.github.com/jasnell) in [#​5882](https://redirect.github.com/nodejs/undici/pull/5882) - docs: fix relative links broken by the README move by [@​v1teka](https://redirect.github.com/v1teka) in [#​5843](https://redirect.github.com/nodejs/undici/pull/5843) - fix(redirect): add error code to max redirects error by [@​mcollina](https://redirect.github.com/mcollina) in [#​5895](https://redirect.github.com/nodejs/undici/pull/5895) - fix(eventsource): fix retry wrap bug by [@​jasnell](https://redirect.github.com/jasnell) in [#​5875](https://redirect.github.com/nodejs/undici/pull/5875) - fix(retry): keep request headers when resuming a download by [@​jasnell](https://redirect.github.com/jasnell) in [#​5870](https://redirect.github.com/nodejs/undici/pull/5870) - fix(proxyagent): correct handling of the host header by [@​jasnell](https://redirect.github.com/jasnell) in [#​5868](https://redirect.github.com/nodejs/undici/pull/5868) - fix(http1): fix handling of 204/304 responses by [@​jasnell](https://redirect.github.com/jasnell) in [#​5864](https://redirect.github.com/nodejs/undici/pull/5864) - test: add unexpected disconnect guards to two more h2 tests by [@​zeexzeex](https://redirect.github.com/zeexzeex) in [#​5825](https://redirect.github.com/nodejs/undici/pull/5825) - fix(cache): preserve 304 response event order with async stores by [@​marcopiraccini](https://redirect.github.com/marcopiraccini) in [#​5797](https://redirect.github.com/nodejs/undici/pull/5797) - fix(dns): handle a null pick, and stop failing over to an expired record by [@​datrixlab](https://redirect.github.com/datrixlab) in [#​5791](https://redirect.github.com/nodejs/undici/pull/5791) - fix: keep a header named **proto** across features by [@​luantaraschi](https://redirect.github.com/luantaraschi) in [#​5688](https://redirect.github.com/nodejs/undici/pull/5688) - ci: exclude tests from CodeQL analysis by [@​mcollina](https://redirect.github.com/mcollina) in [#​5905](https://redirect.github.com/nodejs/undici/pull/5905) - fix(pool): ensure that removed clients don't pick up requests by [@​jasnell](https://redirect.github.com/jasnell) in [#​5881](https://redirect.github.com/nodejs/undici/pull/5881) - feat: Added [@​perseveranza-pets/milo](https://redirect.github.com/perseveranza-pets/milo) as alternative experimental HTTP parser by [@​ShogunPanda](https://redirect.github.com/ShogunPanda) in [#​5492](https://redirect.github.com/nodejs/undici/pull/5492) - extractBody fixes 2 by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5926](https://redirect.github.com/nodejs/undici/pull/5926) - reenable cachestorage wpts by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5907](https://redirect.github.com/nodejs/undici/pull/5907) - fix(fetch): parse language tag in filename\* parameters by [@​fallintoplace](https://redirect.github.com/fallintoplace) in [#​5908](https://redirect.github.com/nodejs/undici/pull/5908) - fix(client): preserve tracked response header field boundaries by [@​ronag](https://redirect.github.com/ronag) in [#​5940](https://redirect.github.com/nodejs/undici/pull/5940) - fix(http1): fixup strictContentLength handling by [@​jasnell](https://redirect.github.com/jasnell) in [#​5897](https://redirect.github.com/nodejs/undici/pull/5897) - feat(cache): compress big sqlite cache entries with zstd by [@​mcollina](https://redirect.github.com/mcollina) in [#​5744](https://redirect.github.com/nodejs/undici/pull/5744) - fix(eventsource): enforce maxEventSize on unterminated lines by [@​mcollina](https://redirect.github.com/mcollina) in [#​5814](https://redirect.github.com/nodejs/undici/pull/5814) - limit zstd window size to 8 MB by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5955](https://redirect.github.com/nodejs/undici/pull/5955) - test: add unexpected disconnect guards to http2-body.js by [@​GhostCoder6969](https://redirect.github.com/GhostCoder6969) in [#​5914](https://redirect.github.com/nodejs/undici/pull/5914) - test: fix "specifiy" typo in cache interceptor test by [@​ump45nose](https://redirect.github.com/ump45nose) in [#​5922](https://redirect.github.com/nodejs/undici/pull/5922) - Wpt/wpt runner fixes by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5959](https://redirect.github.com/nodejs/undici/pull/5959) - fix(h2): unref a session detached by GOAWAY with no open streams by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5960](https://redirect.github.com/nodejs/undici/pull/5960) - feat: Throw an error when WebAssembly is not available. by [@​ShogunPanda](https://redirect.github.com/ShogunPanda) in [#​5966](https://redirect.github.com/nodejs/undici/pull/5966) - chore: Vendor milo 0.9.0. by [@​ShogunPanda](https://redirect.github.com/ShogunPanda) in [#​5954](https://redirect.github.com/nodejs/undici/pull/5954) - build(deps-dev): bump ws from 8.21.3 to 8.22.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5968](https://redirect.github.com/nodejs/undici/pull/5968) - build(deps-dev): bump undici from 6.28.0 to 6.29.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5933](https://redirect.github.com/nodejs/undici/pull/5933) - fix(typemap): `.md` -> `.html` by [@​avivkeller](https://redirect.github.com/avivkeller) in [#​5602](https://redirect.github.com/nodejs/undici/pull/5602) - build(deps): bump js-yaml from 4.1.1 to 4.3.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5810](https://redirect.github.com/nodejs/undici/pull/5810) - build(deps): bump brace-expansion by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5934](https://redirect.github.com/nodejs/undici/pull/5934) - build(deps-dev): bump fast-check from 4.10.1 to 4.10.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5921](https://redirect.github.com/nodejs/undici/pull/5921) - test(fetch): settle h2 internal stream errors by [@​Yahiro025](https://redirect.github.com/Yahiro025) in [#​5927](https://redirect.github.com/nodejs/undici/pull/5927) - docs(errors): clarify timeout error codes and related options by [@​theamodhshetty](https://redirect.github.com/theamodhshetty) in [#​4856](https://redirect.github.com/nodejs/undici/pull/4856) - fix(interceptor): limit response error body size by [@​mcollina](https://redirect.github.com/mcollina) in [#​5942](https://redirect.github.com/nodejs/undici/pull/5942) - build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5946](https://redirect.github.com/nodejs/undici/pull/5946) - build(deps): bump hendrikmuhs/ccache-action from 1.2.23 to 1.2.24 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5951](https://redirect.github.com/nodejs/undici/pull/5951) - build(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5952](https://redirect.github.com/nodejs/undici/pull/5952) - build(deps): bump github/codeql-action/autobuild from 4.37.9 to 4.38.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5950](https://redirect.github.com/nodejs/undici/pull/5950) - build(deps): bump github/codeql-action/init from 4.37.9 to 4.38.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5948](https://redirect.github.com/nodejs/undici/pull/5948) - build(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5947](https://redirect.github.com/nodejs/undici/pull/5947) - build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5630](https://redirect.github.com/nodejs/undici/pull/5630) - fix(http1): reset connections for no-body transfer encoding by [@​mcollina](https://redirect.github.com/mcollina) in [#​5941](https://redirect.github.com/nodejs/undici/pull/5941) - fix: exclude experimental milo from node.js core bundle by [@​mcollina](https://redirect.github.com/mcollina) in [#​5935](https://redirect.github.com/nodejs/undici/pull/5935) - test: re-enable HTTP/2 churn test on Node.js 26 by [@​mcollina](https://redirect.github.com/mcollina) in [#​5961](https://redirect.github.com/nodejs/undici/pull/5961) - test: keep the h2c unix socket path within sun_path limits by [@​mcollina](https://redirect.github.com/mcollina) in [#​5978](https://redirect.github.com/nodejs/undici/pull/5978) - fix(cache): preserve abort reasons after completion by [@​domenic](https://redirect.github.com/domenic) in [#​5958](https://redirect.github.com/nodejs/undici/pull/5958) - test: update milo paths in bundle-parser test by [@​mcollina](https://redirect.github.com/mcollina) in [#​5979](https://redirect.github.com/nodejs/undici/pull/5979) - fix(cache): always treat zero-lifetime entries as stale by [@​mcollina](https://redirect.github.com/mcollina) in [#​5980](https://redirect.github.com/nodejs/undici/pull/5980) - build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5949](https://redirect.github.com/nodejs/undici/pull/5949) - fix(websocket,eventsource): keep receive limits behind dispatcher wrappers by [@​jasnell](https://redirect.github.com/jasnell) in [#​5896](https://redirect.github.com/nodejs/undici/pull/5896) - fix(http2): enforce max concurrent streams by [@​jasnell](https://redirect.github.com/jasnell) in [#​5885](https://redirect.github.com/nodejs/undici/pull/5885) - docs: sync WG collaborators with nodejs/undici team by [@​mcollina](https://redirect.github.com/mcollina) in [#​5991](https://redirect.github.com/nodejs/undici/pull/5991) - build(deps-dev): bump [@​fastify/busboy](https://redirect.github.com/fastify/busboy) from 3.2.2 to 3.2.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​6005](https://redirect.github.com/nodejs/undici/pull/6005) - fix: ignore missing release ref during cleanup by [@​mcollina](https://redirect.github.com/mcollina) in [#​5891](https://redirect.github.com/nodejs/undici/pull/5891) - fix: reject unsupported FormData request bodies by [@​mcollina](https://redirect.github.com/mcollina) in [#​5913](https://redirect.github.com/nodejs/undici/pull/5913) - split wpt out of npm test by [@​mcollina](https://redirect.github.com/mcollina) in [#​5588](https://redirect.github.com/nodejs/undici/pull/5588) #### New Contributors - [@​xia-chao](https://redirect.github.com/xia-chao) made their first contribution in [#​5832](https://redirect.github.com/nodejs/undici/pull/5832) - [@​jasnell](https://redirect.github.com/jasnell) made their first contribution in [#​5884](https://redirect.github.com/nodejs/undici/pull/5884) - [@​Knowzzz](https://redirect.github.com/Knowzzz) made their first contribution in [#​5867](https://redirect.github.com/nodejs/undici/pull/5867) - [@​v1teka](https://redirect.github.com/v1teka) made their first contribution in [#​5843](https://redirect.github.com/nodejs/undici/pull/5843) - [@​datrixlab](https://redirect.github.com/datrixlab) made their first contribution in [#​5791](https://redirect.github.com/nodejs/undici/pull/5791) - [@​fallintoplace](https://redirect.github.com/fallintoplace) made their first contribution in [#​5908](https://redirect.github.com/nodejs/undici/pull/5908) - [@​GhostCoder6969](https://redirect.github.com/GhostCoder6969) made their first contribution in [#​5914](https://redirect.github.com/nodejs/undici/pull/5914) - [@​ump45nose](https://redirect.github.com/ump45nose) made their first contribution in [#​5922](https://redirect.github.com/nodejs/undici/pull/5922) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.11.2...v8.12.0> ### [`v8.11.2`](https://redirect.github.com/nodejs/undici/releases/tag/v8.11.2) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.11.1...v8.11.2) #### What's Changed - fix: close rejected HTTP/2 WebSocket handshake streams by [@​mcollina](https://redirect.github.com/mcollina) in [#​5873](https://redirect.github.com/nodejs/undici/pull/5873) - fix: avoid reconnecting aborted requests by [@​Junaid-PK](https://redirect.github.com/Junaid-PK) in [#​5846](https://redirect.github.com/nodejs/undici/pull/5846) #### New Contributors - [@​Junaid-PK](https://redirect.github.com/Junaid-PK) made their first contribution in [#​5846](https://redirect.github.com/nodejs/undici/pull/5846) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.11.1...v8.11.2> ### [`v8.11.1`](https://redirect.github.com/nodejs/undici/releases/tag/v8.11.1) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.11.0...v8.11.1) #### What's Changed - deslopify websocket test by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5851](https://redirect.github.com/nodejs/undici/pull/5851) - Revert "fix: preserve HTTP/2 for legacy fetch consumers" by [@​mcollina](https://redirect.github.com/mcollina) in [#​5860](https://redirect.github.com/nodejs/undici/pull/5860) - fix websocketstream bugs by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5863](https://redirect.github.com/nodejs/undici/pull/5863) - fix hang on 3xx response with large body by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5850](https://redirect.github.com/nodejs/undici/pull/5850) - docs: warn about buffering response bodies by [@​mcollina](https://redirect.github.com/mcollina) in [#​5872](https://redirect.github.com/nodejs/undici/pull/5872) - test: cover native fetch gzip decoding through the legacy bridge by [@​mcollina](https://redirect.github.com/mcollina) in [#​5874](https://redirect.github.com/nodejs/undici/pull/5874) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.11.0...v8.11.1> ### [`v8.11.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.11.0) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.10.2...v8.11.0) #### What's Changed - fix: complete upgrade diagnostics lifecycle by [@​BridgeAR](https://redirect.github.com/BridgeAR) in [#​5761](https://redirect.github.com/nodejs/undici/pull/5761) - build(deps): bump step-security/harden-runner from 2.19.4 to 2.21.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5753](https://redirect.github.com/nodejs/undici/pull/5753) - fix(decompress): join a repeated content-encoding header by [@​luantaraschi](https://redirect.github.com/luantaraschi) in [#​5664](https://redirect.github.com/nodejs/undici/pull/5664) - fix(cookies): keep a cookie named **proto** in getCookies by [@​luantaraschi](https://redirect.github.com/luantaraschi) in [#​5663](https://redirect.github.com/nodejs/undici/pull/5663) - build(deps-dev): bump jest from 30.5.0 to 30.5.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5784](https://redirect.github.com/nodejs/undici/pull/5784) - build(deps): bump got from 15.1.0 to 16.0.0 in /benchmarks by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5785](https://redirect.github.com/nodejs/undici/pull/5785) - fix: selectively re-enable SIMD for ppc64 by [@​richardlau](https://redirect.github.com/richardlau) in [#​5776](https://redirect.github.com/nodejs/undici/pull/5776) - use private fields for brand checks by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5792](https://redirect.github.com/nodejs/undici/pull/5792) - fix(h2): do not unref a session with open streams by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5782](https://redirect.github.com/nodejs/undici/pull/5782) - fix(h2): avoid pool fan-out during ALPN negotiation by [@​mcollina](https://redirect.github.com/mcollina) in [#​5799](https://redirect.github.com/nodejs/undici/pull/5799) - fix issue [#​5715](https://redirect.github.com/nodejs/undici/issues/5715) by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5805](https://redirect.github.com/nodejs/undici/pull/5805) - ci: extend macOS Node.js workflow timeout by [@​mcollina](https://redirect.github.com/mcollina) in [#​5775](https://redirect.github.com/nodejs/undici/pull/5775) - fix(env-http-proxy-agent): NO_PROXY wildcard semantics by [@​mcollina](https://redirect.github.com/mcollina) in [#​5777](https://redirect.github.com/nodejs/undici/pull/5777) - fix(h2): do not replay a request whose response already started after GOAWAY by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5788](https://redirect.github.com/nodejs/undici/pull/5788) - test: skip HTTP/2 churn test on Node.js 25 on all platforms by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5790](https://redirect.github.com/nodejs/undici/pull/5790) - fix(proxy-agent): preserve repeated iterable headers by [@​GiHoon1123](https://redirect.github.com/GiHoon1123) in [#​5779](https://redirect.github.com/nodejs/undici/pull/5779) - docs(errors): document ProxyConnectionError (UND_ERR_PRX_CONN) by [@​kilisamemarisaaa](https://redirect.github.com/kilisamemarisaaa) in [#​5781](https://redirect.github.com/nodejs/undici/pull/5781) - dataurl parsing improvements + update WPT by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5812](https://redirect.github.com/nodejs/undici/pull/5812) - fix(decompress): treat inherited Object.prototype names as unsupported encodings by [@​NgoQuocViet2001](https://redirect.github.com/NgoQuocViet2001) in [#​5807](https://redirect.github.com/nodejs/undici/pull/5807) - test(h2): stabilize http2-connection by [@​ViniciusDev26](https://redirect.github.com/ViniciusDev26) in [#​5801](https://redirect.github.com/nodejs/undici/pull/5801) - fix: preserve HTTP/2 for non-upgrade legacy requests by [@​mcollina](https://redirect.github.com/mcollina) in [#​5811](https://redirect.github.com/nodejs/undici/pull/5811) - fix: skip drain dispatch for clientTtl-evicted clients in PoolBase by [@​vwong](https://redirect.github.com/vwong) in [#​5677](https://redirect.github.com/nodejs/undici/pull/5677) - chore: update tests blocking release by [@​vwong](https://redirect.github.com/vwong) in [#​5828](https://redirect.github.com/nodejs/undici/pull/5828) - build(deps): bump uWebSockets.js from v20.68.0 to v20.70.0 in /benchmarks by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5824](https://redirect.github.com/nodejs/undici/pull/5824) - fix(deduplicate): settle requests when composed with retry by [@​mcollina](https://redirect.github.com/mcollina) in [#​5817](https://redirect.github.com/nodejs/undici/pull/5817) - fix(cache): do not report aborted on successful cache hits by [@​Yahiro025](https://redirect.github.com/Yahiro025) in [#​5819](https://redirect.github.com/nodejs/undici/pull/5819) - fix(cookies): keep an Expires of 0 when serializing a cookie by [@​NgoQuocViet2001](https://redirect.github.com/NgoQuocViet2001) in [#​5808](https://redirect.github.com/nodejs/undici/pull/5808) - fix: honor backpressure in decompression interceptor by [@​mcollina](https://redirect.github.com/mcollina) in [#​5829](https://redirect.github.com/nodejs/undici/pull/5829) - fix(h2): validate h2Options.maxConcurrentStreams itself by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5830](https://redirect.github.com/nodejs/undici/pull/5830) - test(fetch): make pull-dont-push exceed any socket buffer by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5840](https://redirect.github.com/nodejs/undici/pull/5840) - test(decompress): wait for highWaterMark via readable instead of setImmediate loop by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5841](https://redirect.github.com/nodejs/undici/pull/5841) - fix(h2): keep the session ref'd while requests are queued by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5839](https://redirect.github.com/nodejs/undici/pull/5839) - fix cache.addAll and cache.add hanging by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5844](https://redirect.github.com/nodejs/undici/pull/5844) - fix(retry): settle responses after connection close by [@​mcollina](https://redirect.github.com/mcollina) in [#​5815](https://redirect.github.com/nodejs/undici/pull/5815) - fix(h2): validate response content-length by [@​mcollina](https://redirect.github.com/mcollina) in [#​5816](https://redirect.github.com/nodejs/undici/pull/5816) - fix(redirect): ignore informational responses in history by [@​mcollina](https://redirect.github.com/mcollina) in [#​5813](https://redirect.github.com/nodejs/undici/pull/5813) - fix(websocket): reset the compressed flag when a message completes by [@​askalf](https://redirect.github.com/askalf) in [#​5827](https://redirect.github.com/nodejs/undici/pull/5827) - fix(h2): keep queued requests alive when the last stream closes by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5847](https://redirect.github.com/nodejs/undici/pull/5847) - build(deps-dev): bump jest from 30.5.1 to 30.5.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5854](https://redirect.github.com/nodejs/undici/pull/5854) - build(deps-dev): bump fast-check from 4.9.0 to 4.10.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5852](https://redirect.github.com/nodejs/undici/pull/5852) - build(deps): bump uWebSockets.js from v20.70.0 to v20.71.0 in /benchmarks by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5856](https://redirect.github.com/nodejs/undici/pull/5856) - build(deps-dev): bump [@​metcoder95/https-pem](https://redirect.github.com/metcoder95/https-pem) from 1.0.0 to 1.0.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5853](https://redirect.github.com/nodejs/undici/pull/5853) #### New Contributors - [@​luantaraschi](https://redirect.github.com/luantaraschi) made their first contribution in [#​5664](https://redirect.github.com/nodejs/undici/pull/5664) - [@​kilisamemarisaaa](https://redirect.github.com/kilisamemarisaaa) made their first contribution in [#​5781](https://redirect.github.com/nodejs/undici/pull/5781) - [@​NgoQuocViet2001](https://redirect.github.com/NgoQuocViet2001) made their first contribution in [#​5807](https://redirect.github.com/nodejs/undici/pull/5807) - [@​ViniciusDev26](https://redirect.github.com/ViniciusDev26) made their first contribution in [#​5801](https://redirect.github.com/nodejs/undici/pull/5801) - [@​vwong](https://redirect.github.com/vwong) made their first contribution in [#​5677](https://redirect.github.com/nodejs/undici/pull/5677) - [@​Yahiro025](https://redirect.github.com/Yahiro025) made their first contribution in [#​5819](https://redirect.github.com/nodejs/undici/pull/5819) - [@​askalf](https://redirect.github.com/askalf) made their first contribution in [#​5827](https://redirect.github.com/nodejs/undici/pull/5827) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.10.2...v8.11.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/go-vikunja/vikunja). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
|
e278c7694b |
chore(deps): update dependency undici@7 to v8.12.2 [security] (#4243)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [undici@7](https://undici.nodejs.org) ([source](https://redirect.github.com/nodejs/undici)) | [`8.10.2` → `8.12.2`](https://renovatebot.com/diffs/npm/undici@7/8.10.2/8.12.2) |  |  | --- ### undici vulnerable to Denial of Service via unbounded memory in the EventSource parser [CVE-2026-109924](https://nvd.nist.gov/vuln/detail/CVE-2026-109924) / [GHSA-4qv8-2p9j-2685](https://redirect.github.com/advisories/GHSA-4qv8-2p9j-2685) <details> <summary>More information</summary> #### Details ##### Impact undici's `EventSource` client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed `data:` fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state. The byte-based `maxEventSize` and `maxResponseSize` limits do not bound that retained state, and `maxResponseSize` is enforced on the compressed body before decompression, so a small compressed response can expand into enough retained memory to terminate the process. The application only needs to maintain an `EventSource` connection to an untrusted peer, which controls only the response. Availability is the only impact. ##### Patches Upgrade to `6.29.1`, `7.30.1`, or `8.12.2`, which bound the retained EventSource parser state (the number of `data` fields and buffered chunks, the unfinished-line length, and per-field byte totals) independently of the byte limits. ##### Workarounds None. #### Severity - CVSS Score: 5.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685) - [https://nvd.nist.gov/vuln/detail/CVE-2026-109924](https://nvd.nist.gov/vuln/detail/CVE-2026-109924) - [https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6](https://redirect.github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6) - [https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab](https://redirect.github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab) - [https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e](https://redirect.github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://redirect.github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v6.29.1](https://redirect.github.com/nodejs/undici/releases/tag/v6.29.1) - [https://github.com/nodejs/undici/releases/tag/v7.30.1](https://redirect.github.com/nodejs/undici/releases/tag/v7.30.1) - [https://github.com/nodejs/undici/releases/tag/v8.12.2](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4qv8-2p9j-2685) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens [CVE-2026-109841](https://nvd.nist.gov/vuln/detail/CVE-2026-109841) / [GHSA-f72v-6w45-q472](https://redirect.github.com/advisories/GHSA-f72v-6w45-q472) <details> <summary>More information</summary> #### Details ##### Impact undici's `fetch()` verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as `SHA256-...` or `Sha256-...` is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check. An application that pins a response with a valid uppercase or mixed-case SRI token receives attacker-controlled bytes with no integrity error. The attacker needs only to control the response body, not the application's integrity metadata. The issue affects response integrity only. The regression was introduced in undici 7.15.0; releases 7.14.0 and earlier lowercase the token and are not affected. ##### Patches Upgrade to `7.30.1` or `8.12.2`. undici now normalizes the algorithm token to ASCII lowercase before validating it and before selecting the strongest algorithm, so case variants of SHA-256, SHA-384, and SHA-512 are verified correctly. ##### Workarounds Use lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in `integrity` metadata. #### Severity - CVSS Score: 5.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472) - [https://nvd.nist.gov/vuln/detail/CVE-2026-109841](https://nvd.nist.gov/vuln/detail/CVE-2026-109841) - [https://github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00](https://redirect.github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00) - [https://github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0](https://redirect.github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://redirect.github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v7.30.1](https://redirect.github.com/nodejs/undici/releases/tag/v7.30.1) - [https://github.com/nodejs/undici/releases/tag/v8.12.2](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-f72v-6w45-q472) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### undici vulnerable to Denial of Service via unhandled error on excessive content-encodings [CVE-2026-109869](https://nvd.nist.gov/vuln/detail/CVE-2026-109869) / [GHSA-xjj6-f33q-929c](https://redirect.github.com/advisories/GHSA-xjj6-f33q-929c) <details> <summary>More information</summary> #### Details ##### Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled `error` and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the `fetch()` rejection. undici 6.x, 7.x, and 8.x are affected. ##### Patches Upgrade to `6.29.1`, `7.30.1`, or `8.12.2`. undici now validates the content-encoding chain before creating the internal body stream and aborts the response when the limit is exceeded, so no error can surface on an orphaned stream. ##### Workarounds None. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c) - [https://nvd.nist.gov/vuln/detail/CVE-2026-109869](https://nvd.nist.gov/vuln/detail/CVE-2026-109869) - [https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429](https://redirect.github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429) - [https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436](https://redirect.github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436) - [https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5](https://redirect.github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/nodejs/undici](https://redirect.github.com/nodejs/undici) - [https://github.com/nodejs/undici/releases/tag/v6.29.1](https://redirect.github.com/nodejs/undici/releases/tag/v6.29.1) - [https://github.com/nodejs/undici/releases/tag/v7.30.1](https://redirect.github.com/nodejs/undici/releases/tag/v7.30.1) - [https://github.com/nodejs/undici/releases/tag/v8.12.2](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xjj6-f33q-929c) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>nodejs/undici (undici@7)</summary> ### [`v8.12.2`](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.2) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.12.1...v8.12.2) #### Security fixes ##### High severity ##### Denial of service via TLS 1.2 certificate-changing renegotiation **CVE-2026-87018 · [GHSA-qrxm-fqhp-jwvm](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)** A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process. ##### TLS certificate validation bypass through dropped `Agent` options **CVE-2026-109383 · [GHSA-2m5v-pch6-74hx](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)** `Agent` used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as `checkServerIdentity`. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers. ##### Cache poisoning and cross-user disclosure through cross-origin redirects **CVE-2026-109829 · [GHSA-4w7w-5xrc-9h26](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26)** When an originless `Agent` combined redirect and shared-cache interceptors as `compose(redirect(), cache())`, a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy. ##### Denial of service through excessive `Content-Encoding` values **CVE-2026-109869 · [GHSA-xjj6-f33q-929c](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c)** A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although `fetch()` rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely. ##### Medium severity ##### Denial of service through the `decompress` interceptor **CVE-2026-87029 · [GHSA-55wc-3pg8-jfw6](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6)** An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when `decompress` was composed with a handler such as `dump` with a size limit. This release converts downstream handler exceptions into per-request errors. ##### Subresource Integrity bypass with non-lowercase algorithm tokens **CVE-2026-109841 · [GHSA-f72v-6w45-q472](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472)** `fetch()` treated valid mixed-case or uppercase SRI algorithm tokens, such as `SHA256`, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection. ##### Denial of service through unbounded EventSource parser state **CVE-2026-109924 · [GHSA-4qv8-2p9j-2685](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)** A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny `data:` fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data. ##### Denial of service through unbounded automatic WebSocket PONG buffering **CVE-2026-109932 · [GHSA-9fm3-97px-rjf6](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)** A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains. **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.12.1...v8.12.2> ### [`v8.12.1`](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.1) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.12.0...v8.12.1) #### What's Changed - fix: restore build:wasm npm script by [@​mcollina](https://redirect.github.com/mcollina) in [#​6009](https://redirect.github.com/nodejs/undici/pull/6009) - test: add unexpected disconnect guards to http2-body-delete.js by [@​Kesavamoorthig06](https://redirect.github.com/Kesavamoorthig06) in [#​5970](https://redirect.github.com/nodejs/undici/pull/5970) #### New Contributors - [@​Kesavamoorthig06](https://redirect.github.com/Kesavamoorthig06) made their first contribution in [#​5970](https://redirect.github.com/nodejs/undici/pull/5970) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.12.0...v8.12.1> ### [`v8.12.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.0) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.11.2...v8.12.0) #### What's Changed - fix(cookies): ignore a numeric expires outside the Date range by [@​xia-chao](https://redirect.github.com/xia-chao) in [#​5832](https://redirect.github.com/nodejs/undici/pull/5832) - fix(http2): pause bodyTimeout while applying backpressure by [@​jasnell](https://redirect.github.com/jasnell) in [#​5884](https://redirect.github.com/nodejs/undici/pull/5884) - fix(cache): track cached response abort state by [@​mcollina](https://redirect.github.com/mcollina) in [#​5820](https://redirect.github.com/nodejs/undici/pull/5820) - fix(deduplicate): make terminal callbacks exception-safe by [@​mcollina](https://redirect.github.com/mcollina) in [#​5838](https://redirect.github.com/nodejs/undici/pull/5838) - fix(decompress): stop inflating compress and x-compress by [@​luantaraschi](https://redirect.github.com/luantaraschi) in [#​5665](https://redirect.github.com/nodejs/undici/pull/5665) - fix(cache): evict least recently used entries in MemoryCacheStore by [@​jasnell](https://redirect.github.com/jasnell) in [#​5869](https://redirect.github.com/nodejs/undici/pull/5869) - fix(eventsource): fix redirect targets in eventsource by [@​jasnell](https://redirect.github.com/jasnell) in [#​5878](https://redirect.github.com/nodejs/undici/pull/5878) - fix(redirect): fix throwOnMaxRedirect edge by [@​jasnell](https://redirect.github.com/jasnell) in [#​5879](https://redirect.github.com/nodejs/undici/pull/5879) - fix: normalize HTTP/2 headers for legacy dispatch handlers by [@​Knowzzz](https://redirect.github.com/Knowzzz) in [#​5867](https://redirect.github.com/nodejs/undici/pull/5867) - fix(session cache): fix bug in tls session caching by [@​jasnell](https://redirect.github.com/jasnell) in [#​5882](https://redirect.github.com/nodejs/undici/pull/5882) - docs: fix relative links broken by the README move by [@​v1teka](https://redirect.github.com/v1teka) in [#​5843](https://redirect.github.com/nodejs/undici/pull/5843) - fix(redirect): add error code to max redirects error by [@​mcollina](https://redirect.github.com/mcollina) in [#​5895](https://redirect.github.com/nodejs/undici/pull/5895) - fix(eventsource): fix retry wrap bug by [@​jasnell](https://redirect.github.com/jasnell) in [#​5875](https://redirect.github.com/nodejs/undici/pull/5875) - fix(retry): keep request headers when resuming a download by [@​jasnell](https://redirect.github.com/jasnell) in [#​5870](https://redirect.github.com/nodejs/undici/pull/5870) - fix(proxyagent): correct handling of the host header by [@​jasnell](https://redirect.github.com/jasnell) in [#​5868](https://redirect.github.com/nodejs/undici/pull/5868) - fix(http1): fix handling of 204/304 responses by [@​jasnell](https://redirect.github.com/jasnell) in [#​5864](https://redirect.github.com/nodejs/undici/pull/5864) - test: add unexpected disconnect guards to two more h2 tests by [@​zeexzeex](https://redirect.github.com/zeexzeex) in [#​5825](https://redirect.github.com/nodejs/undici/pull/5825) - fix(cache): preserve 304 response event order with async stores by [@​marcopiraccini](https://redirect.github.com/marcopiraccini) in [#​5797](https://redirect.github.com/nodejs/undici/pull/5797) - fix(dns): handle a null pick, and stop failing over to an expired record by [@​datrixlab](https://redirect.github.com/datrixlab) in [#​5791](https://redirect.github.com/nodejs/undici/pull/5791) - fix: keep a header named **proto** across features by [@​luantaraschi](https://redirect.github.com/luantaraschi) in [#​5688](https://redirect.github.com/nodejs/undici/pull/5688) - ci: exclude tests from CodeQL analysis by [@​mcollina](https://redirect.github.com/mcollina) in [#​5905](https://redirect.github.com/nodejs/undici/pull/5905) - fix(pool): ensure that removed clients don't pick up requests by [@​jasnell](https://redirect.github.com/jasnell) in [#​5881](https://redirect.github.com/nodejs/undici/pull/5881) - feat: Added [@​perseveranza-pets/milo](https://redirect.github.com/perseveranza-pets/milo) as alternative experimental HTTP parser by [@​ShogunPanda](https://redirect.github.com/ShogunPanda) in [#​5492](https://redirect.github.com/nodejs/undici/pull/5492) - extractBody fixes 2 by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5926](https://redirect.github.com/nodejs/undici/pull/5926) - reenable cachestorage wpts by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5907](https://redirect.github.com/nodejs/undici/pull/5907) - fix(fetch): parse language tag in filename\* parameters by [@​fallintoplace](https://redirect.github.com/fallintoplace) in [#​5908](https://redirect.github.com/nodejs/undici/pull/5908) - fix(client): preserve tracked response header field boundaries by [@​ronag](https://redirect.github.com/ronag) in [#​5940](https://redirect.github.com/nodejs/undici/pull/5940) - fix(http1): fixup strictContentLength handling by [@​jasnell](https://redirect.github.com/jasnell) in [#​5897](https://redirect.github.com/nodejs/undici/pull/5897) - feat(cache): compress big sqlite cache entries with zstd by [@​mcollina](https://redirect.github.com/mcollina) in [#​5744](https://redirect.github.com/nodejs/undici/pull/5744) - fix(eventsource): enforce maxEventSize on unterminated lines by [@​mcollina](https://redirect.github.com/mcollina) in [#​5814](https://redirect.github.com/nodejs/undici/pull/5814) - limit zstd window size to 8 MB by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5955](https://redirect.github.com/nodejs/undici/pull/5955) - test: add unexpected disconnect guards to http2-body.js by [@​GhostCoder6969](https://redirect.github.com/GhostCoder6969) in [#​5914](https://redirect.github.com/nodejs/undici/pull/5914) - test: fix "specifiy" typo in cache interceptor test by [@​ump45nose](https://redirect.github.com/ump45nose) in [#​5922](https://redirect.github.com/nodejs/undici/pull/5922) - Wpt/wpt runner fixes by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5959](https://redirect.github.com/nodejs/undici/pull/5959) - fix(h2): unref a session detached by GOAWAY with no open streams by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5960](https://redirect.github.com/nodejs/undici/pull/5960) - feat: Throw an error when WebAssembly is not available. by [@​ShogunPanda](https://redirect.github.com/ShogunPanda) in [#​5966](https://redirect.github.com/nodejs/undici/pull/5966) - chore: Vendor milo 0.9.0. by [@​ShogunPanda](https://redirect.github.com/ShogunPanda) in [#​5954](https://redirect.github.com/nodejs/undici/pull/5954) - build(deps-dev): bump ws from 8.21.3 to 8.22.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5968](https://redirect.github.com/nodejs/undici/pull/5968) - build(deps-dev): bump undici from 6.28.0 to 6.29.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5933](https://redirect.github.com/nodejs/undici/pull/5933) - fix(typemap): `.md` -> `.html` by [@​avivkeller](https://redirect.github.com/avivkeller) in [#​5602](https://redirect.github.com/nodejs/undici/pull/5602) - build(deps): bump js-yaml from 4.1.1 to 4.3.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5810](https://redirect.github.com/nodejs/undici/pull/5810) - build(deps): bump brace-expansion by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5934](https://redirect.github.com/nodejs/undici/pull/5934) - build(deps-dev): bump fast-check from 4.10.1 to 4.10.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5921](https://redirect.github.com/nodejs/undici/pull/5921) - test(fetch): settle h2 internal stream errors by [@​Yahiro025](https://redirect.github.com/Yahiro025) in [#​5927](https://redirect.github.com/nodejs/undici/pull/5927) - docs(errors): clarify timeout error codes and related options by [@​theamodhshetty](https://redirect.github.com/theamodhshetty) in [#​4856](https://redirect.github.com/nodejs/undici/pull/4856) - fix(interceptor): limit response error body size by [@​mcollina](https://redirect.github.com/mcollina) in [#​5942](https://redirect.github.com/nodejs/undici/pull/5942) - build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5946](https://redirect.github.com/nodejs/undici/pull/5946) - build(deps): bump hendrikmuhs/ccache-action from 1.2.23 to 1.2.24 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5951](https://redirect.github.com/nodejs/undici/pull/5951) - build(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5952](https://redirect.github.com/nodejs/undici/pull/5952) - build(deps): bump github/codeql-action/autobuild from 4.37.9 to 4.38.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5950](https://redirect.github.com/nodejs/undici/pull/5950) - build(deps): bump github/codeql-action/init from 4.37.9 to 4.38.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5948](https://redirect.github.com/nodejs/undici/pull/5948) - build(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5947](https://redirect.github.com/nodejs/undici/pull/5947) - build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5630](https://redirect.github.com/nodejs/undici/pull/5630) - fix(http1): reset connections for no-body transfer encoding by [@​mcollina](https://redirect.github.com/mcollina) in [#​5941](https://redirect.github.com/nodejs/undici/pull/5941) - fix: exclude experimental milo from node.js core bundle by [@​mcollina](https://redirect.github.com/mcollina) in [#​5935](https://redirect.github.com/nodejs/undici/pull/5935) - test: re-enable HTTP/2 churn test on Node.js 26 by [@​mcollina](https://redirect.github.com/mcollina) in [#​5961](https://redirect.github.com/nodejs/undici/pull/5961) - test: keep the h2c unix socket path within sun_path limits by [@​mcollina](https://redirect.github.com/mcollina) in [#​5978](https://redirect.github.com/nodejs/undici/pull/5978) - fix(cache): preserve abort reasons after completion by [@​domenic](https://redirect.github.com/domenic) in [#​5958](https://redirect.github.com/nodejs/undici/pull/5958) - test: update milo paths in bundle-parser test by [@​mcollina](https://redirect.github.com/mcollina) in [#​5979](https://redirect.github.com/nodejs/undici/pull/5979) - fix(cache): always treat zero-lifetime entries as stale by [@​mcollina](https://redirect.github.com/mcollina) in [#​5980](https://redirect.github.com/nodejs/undici/pull/5980) - build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5949](https://redirect.github.com/nodejs/undici/pull/5949) - fix(websocket,eventsource): keep receive limits behind dispatcher wrappers by [@​jasnell](https://redirect.github.com/jasnell) in [#​5896](https://redirect.github.com/nodejs/undici/pull/5896) - fix(http2): enforce max concurrent streams by [@​jasnell](https://redirect.github.com/jasnell) in [#​5885](https://redirect.github.com/nodejs/undici/pull/5885) - docs: sync WG collaborators with nodejs/undici team by [@​mcollina](https://redirect.github.com/mcollina) in [#​5991](https://redirect.github.com/nodejs/undici/pull/5991) - build(deps-dev): bump [@​fastify/busboy](https://redirect.github.com/fastify/busboy) from 3.2.2 to 3.2.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​6005](https://redirect.github.com/nodejs/undici/pull/6005) - fix: ignore missing release ref during cleanup by [@​mcollina](https://redirect.github.com/mcollina) in [#​5891](https://redirect.github.com/nodejs/undici/pull/5891) - fix: reject unsupported FormData request bodies by [@​mcollina](https://redirect.github.com/mcollina) in [#​5913](https://redirect.github.com/nodejs/undici/pull/5913) - split wpt out of npm test by [@​mcollina](https://redirect.github.com/mcollina) in [#​5588](https://redirect.github.com/nodejs/undici/pull/5588) #### New Contributors - [@​xia-chao](https://redirect.github.com/xia-chao) made their first contribution in [#​5832](https://redirect.github.com/nodejs/undici/pull/5832) - [@​jasnell](https://redirect.github.com/jasnell) made their first contribution in [#​5884](https://redirect.github.com/nodejs/undici/pull/5884) - [@​Knowzzz](https://redirect.github.com/Knowzzz) made their first contribution in [#​5867](https://redirect.github.com/nodejs/undici/pull/5867) - [@​v1teka](https://redirect.github.com/v1teka) made their first contribution in [#​5843](https://redirect.github.com/nodejs/undici/pull/5843) - [@​datrixlab](https://redirect.github.com/datrixlab) made their first contribution in [#​5791](https://redirect.github.com/nodejs/undici/pull/5791) - [@​fallintoplace](https://redirect.github.com/fallintoplace) made their first contribution in [#​5908](https://redirect.github.com/nodejs/undici/pull/5908) - [@​GhostCoder6969](https://redirect.github.com/GhostCoder6969) made their first contribution in [#​5914](https://redirect.github.com/nodejs/undici/pull/5914) - [@​ump45nose](https://redirect.github.com/ump45nose) made their first contribution in [#​5922](https://redirect.github.com/nodejs/undici/pull/5922) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.11.2...v8.12.0> ### [`v8.11.2`](https://redirect.github.com/nodejs/undici/releases/tag/v8.11.2) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.11.1...v8.11.2) #### What's Changed - fix: close rejected HTTP/2 WebSocket handshake streams by [@​mcollina](https://redirect.github.com/mcollina) in [#​5873](https://redirect.github.com/nodejs/undici/pull/5873) - fix: avoid reconnecting aborted requests by [@​Junaid-PK](https://redirect.github.com/Junaid-PK) in [#​5846](https://redirect.github.com/nodejs/undici/pull/5846) #### New Contributors - [@​Junaid-PK](https://redirect.github.com/Junaid-PK) made their first contribution in [#​5846](https://redirect.github.com/nodejs/undici/pull/5846) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.11.1...v8.11.2> ### [`v8.11.1`](https://redirect.github.com/nodejs/undici/releases/tag/v8.11.1) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.11.0...v8.11.1) #### What's Changed - deslopify websocket test by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5851](https://redirect.github.com/nodejs/undici/pull/5851) - Revert "fix: preserve HTTP/2 for legacy fetch consumers" by [@​mcollina](https://redirect.github.com/mcollina) in [#​5860](https://redirect.github.com/nodejs/undici/pull/5860) - fix websocketstream bugs by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5863](https://redirect.github.com/nodejs/undici/pull/5863) - fix hang on 3xx response with large body by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5850](https://redirect.github.com/nodejs/undici/pull/5850) - docs: warn about buffering response bodies by [@​mcollina](https://redirect.github.com/mcollina) in [#​5872](https://redirect.github.com/nodejs/undici/pull/5872) - test: cover native fetch gzip decoding through the legacy bridge by [@​mcollina](https://redirect.github.com/mcollina) in [#​5874](https://redirect.github.com/nodejs/undici/pull/5874) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.11.0...v8.11.1> ### [`v8.11.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.11.0) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.10.2...v8.11.0) #### What's Changed - fix: complete upgrade diagnostics lifecycle by [@​BridgeAR](https://redirect.github.com/BridgeAR) in [#​5761](https://redirect.github.com/nodejs/undici/pull/5761) - build(deps): bump step-security/harden-runner from 2.19.4 to 2.21.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5753](https://redirect.github.com/nodejs/undici/pull/5753) - fix(decompress): join a repeated content-encoding header by [@​luantaraschi](https://redirect.github.com/luantaraschi) in [#​5664](https://redirect.github.com/nodejs/undici/pull/5664) - fix(cookies): keep a cookie named **proto** in getCookies by [@​luantaraschi](https://redirect.github.com/luantaraschi) in [#​5663](https://redirect.github.com/nodejs/undici/pull/5663) - build(deps-dev): bump jest from 30.5.0 to 30.5.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5784](https://redirect.github.com/nodejs/undici/pull/5784) - build(deps): bump got from 15.1.0 to 16.0.0 in /benchmarks by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5785](https://redirect.github.com/nodejs/undici/pull/5785) - fix: selectively re-enable SIMD for ppc64 by [@​richardlau](https://redirect.github.com/richardlau) in [#​5776](https://redirect.github.com/nodejs/undici/pull/5776) - use private fields for brand checks by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5792](https://redirect.github.com/nodejs/undici/pull/5792) - fix(h2): do not unref a session with open streams by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5782](https://redirect.github.com/nodejs/undici/pull/5782) - fix(h2): avoid pool fan-out during ALPN negotiation by [@​mcollina](https://redirect.github.com/mcollina) in [#​5799](https://redirect.github.com/nodejs/undici/pull/5799) - fix issue [#​5715](https://redirect.github.com/nodejs/undici/issues/5715) by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5805](https://redirect.github.com/nodejs/undici/pull/5805) - ci: extend macOS Node.js workflow timeout by [@​mcollina](https://redirect.github.com/mcollina) in [#​5775](https://redirect.github.com/nodejs/undici/pull/5775) - fix(env-http-proxy-agent): NO_PROXY wildcard semantics by [@​mcollina](https://redirect.github.com/mcollina) in [#​5777](https://redirect.github.com/nodejs/undici/pull/5777) - fix(h2): do not replay a request whose response already started after GOAWAY by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5788](https://redirect.github.com/nodejs/undici/pull/5788) - test: skip HTTP/2 churn test on Node.js 25 on all platforms by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5790](https://redirect.github.com/nodejs/undici/pull/5790) - fix(proxy-agent): preserve repeated iterable headers by [@​GiHoon1123](https://redirect.github.com/GiHoon1123) in [#​5779](https://redirect.github.com/nodejs/undici/pull/5779) - docs(errors): document ProxyConnectionError (UND_ERR_PRX_CONN) by [@​kilisamemarisaaa](https://redirect.github.com/kilisamemarisaaa) in [#​5781](https://redirect.github.com/nodejs/undici/pull/5781) - dataurl parsing improvements + update WPT by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5812](https://redirect.github.com/nodejs/undici/pull/5812) - fix(decompress): treat inherited Object.prototype names as unsupported encodings by [@​NgoQuocViet2001](https://redirect.github.com/NgoQuocViet2001) in [#​5807](https://redirect.github.com/nodejs/undici/pull/5807) - test(h2): stabilize http2-connection by [@​ViniciusDev26](https://redirect.github.com/ViniciusDev26) in [#​5801](https://redirect.github.com/nodejs/undici/pull/5801) - fix: preserve HTTP/2 for non-upgrade legacy requests by [@​mcollina](https://redirect.github.com/mcollina) in [#​5811](https://redirect.github.com/nodejs/undici/pull/5811) - fix: skip drain dispatch for clientTtl-evicted clients in PoolBase by [@​vwong](https://redirect.github.com/vwong) in [#​5677](https://redirect.github.com/nodejs/undici/pull/5677) - chore: update tests blocking release by [@​vwong](https://redirect.github.com/vwong) in [#​5828](https://redirect.github.com/nodejs/undici/pull/5828) - build(deps): bump uWebSockets.js from v20.68.0 to v20.70.0 in /benchmarks by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5824](https://redirect.github.com/nodejs/undici/pull/5824) - fix(deduplicate): settle requests when composed with retry by [@​mcollina](https://redirect.github.com/mcollina) in [#​5817](https://redirect.github.com/nodejs/undici/pull/5817) - fix(cache): do not report aborted on successful cache hits by [@​Yahiro025](https://redirect.github.com/Yahiro025) in [#​5819](https://redirect.github.com/nodejs/undici/pull/5819) - fix(cookies): keep an Expires of 0 when serializing a cookie by [@​NgoQuocViet2001](https://redirect.github.com/NgoQuocViet2001) in [#​5808](https://redirect.github.com/nodejs/undici/pull/5808) - fix: honor backpressure in decompression interceptor by [@​mcollina](https://redirect.github.com/mcollina) in [#​5829](https://redirect.github.com/nodejs/undici/pull/5829) - fix(h2): validate h2Options.maxConcurrentStreams itself by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5830](https://redirect.github.com/nodejs/undici/pull/5830) - test(fetch): make pull-dont-push exceed any socket buffer by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5840](https://redirect.github.com/nodejs/undici/pull/5840) - test(decompress): wait for highWaterMark via readable instead of setImmediate loop by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5841](https://redirect.github.com/nodejs/undici/pull/5841) - fix(h2): keep the session ref'd while requests are queued by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5839](https://redirect.github.com/nodejs/undici/pull/5839) - fix cache.addAll and cache.add hanging by [@​KhafraDev](https://redirect.github.com/KhafraDev) in [#​5844](https://redirect.github.com/nodejs/undici/pull/5844) - fix(retry): settle responses after connection close by [@​mcollina](https://redirect.github.com/mcollina) in [#​5815](https://redirect.github.com/nodejs/undici/pull/5815) - fix(h2): validate response content-length by [@​mcollina](https://redirect.github.com/mcollina) in [#​5816](https://redirect.github.com/nodejs/undici/pull/5816) - fix(redirect): ignore informational responses in history by [@​mcollina](https://redirect.github.com/mcollina) in [#​5813](https://redirect.github.com/nodejs/undici/pull/5813) - fix(websocket): reset the compressed flag when a message completes by [@​askalf](https://redirect.github.com/askalf) in [#​5827](https://redirect.github.com/nodejs/undici/pull/5827) - fix(h2): keep queued requests alive when the last stream closes by [@​kjsik11](https://redirect.github.com/kjsik11) in [#​5847](https://redirect.github.com/nodejs/undici/pull/5847) - build(deps-dev): bump jest from 30.5.1 to 30.5.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5854](https://redirect.github.com/nodejs/undici/pull/5854) - build(deps-dev): bump fast-check from 4.9.0 to 4.10.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5852](https://redirect.github.com/nodejs/undici/pull/5852) - build(deps): bump uWebSockets.js from v20.70.0 to v20.71.0 in /benchmarks by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5856](https://redirect.github.com/nodejs/undici/pull/5856) - build(deps-dev): bump [@​metcoder95/https-pem](https://redirect.github.com/metcoder95/https-pem) from 1.0.0 to 1.0.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​5853](https://redirect.github.com/nodejs/undici/pull/5853) #### New Contributors - [@​luantaraschi](https://redirect.github.com/luantaraschi) made their first contribution in [#​5664](https://redirect.github.com/nodejs/undici/pull/5664) - [@​kilisamemarisaaa](https://redirect.github.com/kilisamemarisaaa) made their first contribution in [#​5781](https://redirect.github.com/nodejs/undici/pull/5781) - [@​NgoQuocViet2001](https://redirect.github.com/NgoQuocViet2001) made their first contribution in [#​5807](https://redirect.github.com/nodejs/undici/pull/5807) - [@​ViniciusDev26](https://redirect.github.com/ViniciusDev26) made their first contribution in [#​5801](https://redirect.github.com/nodejs/undici/pull/5801) - [@​vwong](https://redirect.github.com/vwong) made their first contribution in [#​5677](https://redirect.github.com/nodejs/undici/pull/5677) - [@​Yahiro025](https://redirect.github.com/Yahiro025) made their first contribution in [#​5819](https://redirect.github.com/nodejs/undici/pull/5819) - [@​askalf](https://redirect.github.com/askalf) made their first contribution in [#​5827](https://redirect.github.com/nodejs/undici/pull/5827) **Full Changelog**: <https://github.com/nodejs/undici/compare/v8.10.2...v8.11.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/go-vikunja/vikunja). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
|
ca2b8ce16f |
chore(deps): update dependency fast-uri@3 to v4.2.3 [security] (#4241)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fast-uri@3](https://redirect.github.com/fastify/fast-uri) | [`4.1.5` → `4.2.3`](https://renovatebot.com/diffs/npm/fast-uri@3/4.1.5/4.2.3) |  |  | --- ### fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references [CVE-2026-110725](https://nvd.nist.gov/vuln/detail/CVE-2026-110725) / [GHSA-333x-w4r6-6crp](https://redirect.github.com/advisories/GHSA-333x-w4r6-6crp) <details> <summary>More information</summary> #### Details ##### Impact `fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a `path-noscheme` reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. `fast-uri`'s default serialization escapes that colon, but the suffix path does not. For example, `normalize('javascript:alert(1)', { reference: 'suffix' })` returns `javascript:alert(1)`, which reparses as a live `javascript:` scheme; `data:` and `vbscript:` behave the same. Applications that serialize or normalize a relative reference with `reference: 'suffix'` and then treat the result as a URI can turn inert input into a live `javascript:`, `data:`, or `vbscript:` URL (a cross-site scripting vector), and `equal()` can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default `reference: 'suffix'` option. ##### Patches Upgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`. ##### Workarounds Do not use the `reference: 'suffix'` option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI. #### Severity - CVSS Score: 3.7 / 10 (Low) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N` #### References - [https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp) - [https://nvd.nist.gov/vuln/detail/CVE-2026-110725](https://nvd.nist.gov/vuln/detail/CVE-2026-110725) - [https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e](https://redirect.github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e) - [https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b](https://redirect.github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/fastify/fast-uri](https://redirect.github.com/fastify/fast-uri) - [https://github.com/fastify/fast-uri/releases/tag/v2.4.8](https://redirect.github.com/fastify/fast-uri/releases/tag/v2.4.8) - [https://github.com/fastify/fast-uri/releases/tag/v3.1.9](https://redirect.github.com/fastify/fast-uri/releases/tag/v3.1.9) - [https://github.com/fastify/fast-uri/releases/tag/v4.2.3](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-333x-w4r6-6crp) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding [CVE-2026-110306](https://nvd.nist.gov/vuln/detail/CVE-2026-110306) / [GHSA-w74x-v6f9-j3xg](https://redirect.github.com/advisories/GHSA-w74x-v6f9-j3xg) <details> <summary>More information</summary> #### Details ##### Impact `fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but `fast-uri` does. For example, `normalize('%6Aavascript:alert(1)')` returns `javascript:alert(1)`, `resolve('https://a.example/', '%6Aavascript:alert(1)')` returns `javascript:alert(1)`, and `parse('%6Aavascript:alert(1)').scheme` returns `javascript`. The `%uXXXX` form (`%u006Aavascript:`) produces the same result, and `equal('%68ttp://a/', 'http://a/')` returns `true`. An application that screens dangerous schemes on the raw input and then stores or renders `normalize(input)` or `resolve(base, input)` turns an inert string into an executable `javascript:`, `data:`, or `vbscript:` URL, a stored or reflected cross-site scripting vector in the consuming application. `equal()` also treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. ##### Patches Upgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`. ##### Workarounds Reject input whose scheme part (before the first `:`, and before any `/`, `?`, or `#`) contains `%`. Alternatively, check `parse(x).scheme` against an allowlist after normalization and use that same parsed result rather than the raw string. #### Severity - CVSS Score: 6.1 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` #### References - [https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg) - [https://nvd.nist.gov/vuln/detail/CVE-2026-110306](https://nvd.nist.gov/vuln/detail/CVE-2026-110306) - [https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4](https://redirect.github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4) - [https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3](https://redirect.github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3) - [https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f](https://redirect.github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/fastify/fast-uri](https://redirect.github.com/fastify/fast-uri) - [https://github.com/fastify/fast-uri/releases/tag/v2.4.8](https://redirect.github.com/fastify/fast-uri/releases/tag/v2.4.8) - [https://github.com/fastify/fast-uri/releases/tag/v3.1.9](https://redirect.github.com/fastify/fast-uri/releases/tag/v3.1.9) - [https://github.com/fastify/fast-uri/releases/tag/v4.2.3](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-w74x-v6f9-j3xg) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization [CVE-2026-110180](https://nvd.nist.gov/vuln/detail/CVE-2026-110180) / [GHSA-wjr9-j795-jxcr](https://redirect.github.com/advisories/GHSA-wjr9-j795-jxcr) <details> <summary>More information</summary> #### Details ##### Impact `fast-uri` versions `>= 2.4.2, <= 2.4.7`, `>= 3.1.3, <= 3.1.8`, and `>= 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme with `domainHost: true`). For those schemes `canonicalizeHost()` passes the parsed host to the WHATWG `URL` parser and adopts its `.hostname` without checking that the parser read the whole input as a host. RFC 3986 permits `@` inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority `fast-uri` reports is rewritten by that second parser with no `error` set: data before an `@` is dropped and whitespace is removed. For example, `fast-uri` parses `http://a@b@evil.example/` to host `evil.example` (dropping the `b` segment), and a host containing a raw TAB, CR, or LF has those characters stripped. `equal()` then treats a whitespace-smuggled host as the same as the clean one, and `resolve()` rewrites the authority the same way. Applications that use `fast-uri` to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host `fast-uri` returns differs from what was checked, and traffic can be steered to an unintended destination. ##### Patches Upgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`. ##### Workarounds Reject URIs whose authority contains more than one `@`, or contains TAB, CR, or LF, before calling `fast-uri`. Alternatively, treat any non-empty `parse(x).error` as fatal, and compare hosts only from the same `parse()` result. #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N` #### References - [https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr) - [https://nvd.nist.gov/vuln/detail/CVE-2026-110180](https://nvd.nist.gov/vuln/detail/CVE-2026-110180) - [https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a](https://redirect.github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a) - [https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c](https://redirect.github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c) - [https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646](https://redirect.github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/fastify/fast-uri](https://redirect.github.com/fastify/fast-uri) - [https://github.com/fastify/fast-uri/releases/tag/v2.4.8](https://redirect.github.com/fastify/fast-uri/releases/tag/v2.4.8) - [https://github.com/fastify/fast-uri/releases/tag/v3.1.9](https://redirect.github.com/fastify/fast-uri/releases/tag/v3.1.9) - [https://github.com/fastify/fast-uri/releases/tag/v4.2.3](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-wjr9-j795-jxcr) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### fast-uri vulnerable to improper path equivalence in relative reference normalization [CVE-2026-110095](https://nvd.nist.gov/vuln/detail/CVE-2026-110095) / [GHSA-xhq7-xmqj-769h](https://redirect.github.com/advisories/GHSA-xhq7-xmqj-769h) <details> <summary>More information</summary> #### Details ##### Impact `fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading `..` segments and can turn a document-relative reference into a root-relative one. For example, `normalize('a/../b')` returns `/b` and `normalize('../x')` returns `x`, so `resolve(base, normalize(ref))` points at a different resource than `resolve(base, ref)`, and `equal()` treats distinct references as the same. Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource. ##### Patches Upgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`. ##### Workarounds Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result. #### Severity - CVSS Score: 3.7 / 10 (Low) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N` #### References - [https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h) - [https://nvd.nist.gov/vuln/detail/CVE-2026-110095](https://nvd.nist.gov/vuln/detail/CVE-2026-110095) - [https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47](https://redirect.github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47) - [https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9](https://redirect.github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9) - [https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058](https://redirect.github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058) - [https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd](https://redirect.github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd) - [https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a](https://redirect.github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a) - [https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424](https://redirect.github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424) - [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html) - [https://github.com/fastify/fast-uri](https://redirect.github.com/fastify/fast-uri) - [https://github.com/fastify/fast-uri/releases/tag/v2.4.8](https://redirect.github.com/fastify/fast-uri/releases/tag/v2.4.8) - [https://github.com/fastify/fast-uri/releases/tag/v3.1.9](https://redirect.github.com/fastify/fast-uri/releases/tag/v3.1.9) - [https://github.com/fastify/fast-uri/releases/tag/v4.2.3](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xhq7-xmqj-769h) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>fastify/fast-uri (fast-uri@3)</summary> ### [`v4.2.3`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.3) [Compare Source](https://redirect.github.com/fastify/fast-uri/compare/v4.2.2...v4.2.3) #### Security This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3. - **Medium — URI scheme spoofing through percent-encoded schemes** ([GHSA-w74x-v6f9-j3xg](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg), CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme. - **Medium — Host confusion during domain-host canonicalization** ([GHSA-wjr9-j795-jxcr](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr), CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten. - **Low — Incorrect relative-reference normalization** ([GHSA-xhq7-xmqj-769h](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h), CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references. - **Low — Scheme injection in suffix references** ([GHSA-333x-w4r6-6crp](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp), CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme. Upgrade with: ```sh npm install fast-uri@4.2.3 ``` Thanks to [@​zekth](https://redirect.github.com/zekth) for reporting the scheme, host, and relative-reference issues, and to [@​UlisesGascon](https://redirect.github.com/UlisesGascon) for finding the suffix-reference issue and reviewing the remediations. #### What's Changed - ci: allow prerelease bump types in the release workflow by [@​mcollina](https://redirect.github.com/mcollina) in [#​230](https://redirect.github.com/fastify/fast-uri/pull/230) **Full Changelog**: <https://github.com/fastify/fast-uri/compare/v4.2.2...v4.2.3> ### [`v4.2.2`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.2) [Compare Source](https://redirect.github.com/fastify/fast-uri/compare/v4.2.1...v4.2.2) #### What's Changed - fix: reject invalid URI reference edges by [@​mcollina](https://redirect.github.com/mcollina) in [#​221](https://redirect.github.com/fastify/fast-uri/pull/221) - fix: encode invalid host characters by [@​mcollina](https://redirect.github.com/mcollina) in [#​223](https://redirect.github.com/fastify/fast-uri/pull/223) - fix: preserve dot segments in URN namespace strings by [@​mcollina](https://redirect.github.com/mcollina) in [#​222](https://redirect.github.com/fastify/fast-uri/pull/222) - ci: enable trusted publishing releases by [@​Puppo](https://redirect.github.com/Puppo) in [#​225](https://redirect.github.com/fastify/fast-uri/pull/225) - chore: bump playwright-test from 14.1.15 to 15.0.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​226](https://redirect.github.com/fastify/fast-uri/pull/226) **Full Changelog**: <https://github.com/fastify/fast-uri/compare/v4.2.1...v4.2.2> ### [`v4.2.1`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/fastify/fast-uri/compare/v4.2.0...v4.2.1) #### What's Changed - fix: make mailto normalization idempotent for authority recipients by [@​mcollina](https://redirect.github.com/mcollina) in [#​219](https://redirect.github.com/fastify/fast-uri/pull/219) **Full Changelog**: <https://github.com/fastify/fast-uri/compare/v4.2.0...v4.2.1> ### [`v4.2.0`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.2.0) [Compare Source](https://redirect.github.com/fastify/fast-uri/compare/v4.1.5...v4.2.0) #### What's Changed - docs: clarify security vulnerability scope by [@​mcollina](https://redirect.github.com/mcollina) in [#​220](https://redirect.github.com/fastify/fast-uri/pull/220) - fix: keep IPv6 zone identifiers stable across parse/normalize/serialize/equal by [@​mcollina](https://redirect.github.com/mcollina) in [#​218](https://redirect.github.com/fastify/fast-uri/pull/218) **Full Changelog**: <https://github.com/fastify/fast-uri/compare/v4.1.5...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/go-vikunja/vikunja). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
|
e810915e6f |
chore(deps): update dependency electron to v43.8.1 [security] (#4232)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [electron](https://redirect.github.com/electron/electron) | [`43.7.0` → `43.8.1`](https://renovatebot.com/diffs/npm/electron/43.7.0/43.8.1) |  |  | --- ### Electron: Frame subscription trusts GPU-supplied frame geometry [CVE-2026-114122](https://nvd.nist.gov/vuln/detail/CVE-2026-114122) / [GHSA-3qxv-5xgr-q7w9](https://redirect.github.com/advisories/GHSA-3qxv-5xgr-q7w9) <details> <summary>More information</summary> #### Details ##### Impact Frame data received from the GPU process for `webContents.beginFrameSubscription` was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app. Apps are only affected if they use `webContents.beginFrameSubscription` and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected. ##### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ##### Fixed Versions * `45.0.0-alpha.9` * `44.4.3` * `43.7.3` * `42.11.6` ##### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 3.9 / 10 (Low) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L` #### References - [https://github.com/electron/electron/security/advisories/GHSA-3qxv-5xgr-q7w9](https://redirect.github.com/electron/electron/security/advisories/GHSA-3qxv-5xgr-q7w9) - [https://nvd.nist.gov/vuln/detail/CVE-2026-114122](https://nvd.nist.gov/vuln/detail/CVE-2026-114122) - [https://github.com/electron/electron/pull/54047](https://redirect.github.com/electron/electron/pull/54047) - [https://github.com/electron/electron/pull/54038](https://redirect.github.com/electron/electron/pull/54038) - [https://github.com/electron/electron/pull/54037](https://redirect.github.com/electron/electron/pull/54037) - [https://github.com/electron/electron/pull/54036](https://redirect.github.com/electron/electron/pull/54036) - [https://github.com/electron/electron/pull/54033](https://redirect.github.com/electron/electron/pull/54033) - [https://github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a](https://redirect.github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a) - [https://github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada](https://redirect.github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada) - [https://github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c](https://redirect.github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c) - [https://github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86](https://redirect.github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86) - [https://github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4](https://redirect.github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4) - [https://github.com/electron/electron/releases/tag/v42.11.6](https://redirect.github.com/electron/electron/releases/tag/v42.11.6) - [https://github.com/electron/electron/releases/tag/v43.7.3](https://redirect.github.com/electron/electron/releases/tag/v43.7.3) - [https://github.com/electron/electron/releases/tag/v44.4.3](https://redirect.github.com/electron/electron/releases/tag/v44.4.3) - [https://github.com/electron/electron/releases/tag/v45.0.0-alpha.9](https://redirect.github.com/electron/electron/releases/tag/v45.0.0-alpha.9) - [https://github.com/electron/electron](https://redirect.github.com/electron/electron) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-3qxv-5xgr-q7w9) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry [CVE-2026-114124](https://nvd.nist.gov/vuln/detail/CVE-2026-114124) / [GHSA-h3v5-h239-pg29](https://redirect.github.com/advisories/GHSA-h3v5-h239-pg29) <details> <summary>More information</summary> #### Details ##### Impact In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing `paint` event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths. Apps are only affected if they use offscreen rendering (`webPreferences.offscreen`) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected. ##### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ##### Fixed Versions * `45.0.0-alpha.9` * `44.4.3` * `43.7.3` * `42.11.6` ##### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 3.9 / 10 (Low) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L` #### References - [https://github.com/electron/electron/security/advisories/GHSA-h3v5-h239-pg29](https://redirect.github.com/electron/electron/security/advisories/GHSA-h3v5-h239-pg29) - [https://nvd.nist.gov/vuln/detail/CVE-2026-114124](https://nvd.nist.gov/vuln/detail/CVE-2026-114124) - [https://github.com/electron/electron/pull/54047](https://redirect.github.com/electron/electron/pull/54047) - [https://github.com/electron/electron/pull/54038](https://redirect.github.com/electron/electron/pull/54038) - [https://github.com/electron/electron/pull/54037](https://redirect.github.com/electron/electron/pull/54037) - [https://github.com/electron/electron/pull/54036](https://redirect.github.com/electron/electron/pull/54036) - [https://github.com/electron/electron/pull/54033](https://redirect.github.com/electron/electron/pull/54033) - [https://github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a](https://redirect.github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a) - [https://github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada](https://redirect.github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada) - [https://github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c](https://redirect.github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c) - [https://github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86](https://redirect.github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86) - [https://github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4](https://redirect.github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4) - [https://github.com/electron/electron/releases/tag/v42.11.6](https://redirect.github.com/electron/electron/releases/tag/v42.11.6) - [https://github.com/electron/electron/releases/tag/v43.7.3](https://redirect.github.com/electron/electron/releases/tag/v43.7.3) - [https://github.com/electron/electron/releases/tag/v44.4.3](https://redirect.github.com/electron/electron/releases/tag/v44.4.3) - [https://github.com/electron/electron/releases/tag/v45.0.0-alpha.9](https://redirect.github.com/electron/electron/releases/tag/v45.0.0-alpha.9) - [https://github.com/electron/electron](https://redirect.github.com/electron/electron) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-h3v5-h239-pg29) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Pointer lock permission requests can be attributed to the wrong frame [CVE-2026-113798](https://nvd.nist.gov/vuln/detail/CVE-2026-113798) / [GHSA-x562-297c-g43g](https://redirect.github.com/advisories/GHSA-x562-297c-g43g) <details> <summary>More information</summary> #### Details ##### Impact For `pointerLock` permission requests made from some cross-origin iframes, `session.setPermissionRequestHandler()` was given the top-level frame's `requestingUrl` and `isMainFrame` instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity. Apps are only affected if they embed untrusted content in iframes and decide `pointerLock` requests by origin in `setPermissionRequestHandler`. Apps that do not embed untrusted content, or that deny `pointerLock` for it, are not affected. ##### Workarounds Deny the `pointerLock` permission for web contents that embed untrusted frames. ##### Fixed Versions * `45.0.0-alpha.13` * `44.5.0` * `43.7.6` * `42.11.9` ##### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 5.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L` #### References - [https://github.com/electron/electron/security/advisories/GHSA-x562-297c-g43g](https://redirect.github.com/electron/electron/security/advisories/GHSA-x562-297c-g43g) - [https://nvd.nist.gov/vuln/detail/CVE-2026-113798](https://nvd.nist.gov/vuln/detail/CVE-2026-113798) - [https://github.com/electron/electron/pull/54466](https://redirect.github.com/electron/electron/pull/54466) - [https://github.com/electron/electron/pull/54465](https://redirect.github.com/electron/electron/pull/54465) - [https://github.com/electron/electron/pull/54464](https://redirect.github.com/electron/electron/pull/54464) - [https://github.com/electron/electron/pull/54463](https://redirect.github.com/electron/electron/pull/54463) - [https://github.com/electron/electron/pull/54432](https://redirect.github.com/electron/electron/pull/54432) - [https://github.com/electron/electron/commit/a48e6eaaafa85b6fc40f7431ceec4fd6ef4bb899](https://redirect.github.com/electron/electron/commit/a48e6eaaafa85b6fc40f7431ceec4fd6ef4bb899) - [https://github.com/electron/electron/commit/4073e9f4712f61e6b8abd5548673cc7638f6c1a1](https://redirect.github.com/electron/electron/commit/4073e9f4712f61e6b8abd5548673cc7638f6c1a1) - [https://github.com/electron/electron/commit/1755ee598697356959219beefee1e139bc3f8207](https://redirect.github.com/electron/electron/commit/1755ee598697356959219beefee1e139bc3f8207) - [https://github.com/electron/electron/commit/0b680cfa1ffa70a50282da53efde37a210d5223b](https://redirect.github.com/electron/electron/commit/0b680cfa1ffa70a50282da53efde37a210d5223b) - [https://github.com/electron/electron/commit/076c7496791a45968cf8d9e76e9657bc161ea979](https://redirect.github.com/electron/electron/commit/076c7496791a45968cf8d9e76e9657bc161ea979) - [https://github.com/electron/electron/releases/tag/v42.11.9](https://redirect.github.com/electron/electron/releases/tag/v42.11.9) - [https://github.com/electron/electron/releases/tag/v43.7.6](https://redirect.github.com/electron/electron/releases/tag/v43.7.6) - [https://github.com/electron/electron/releases/tag/v44.5.0](https://redirect.github.com/electron/electron/releases/tag/v44.5.0) - [https://github.com/electron/electron/releases/tag/v45.0.0-alpha.13](https://redirect.github.com/electron/electron/releases/tag/v45.0.0-alpha.13) - [https://github.com/electron/electron](https://redirect.github.com/electron/electron) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-x562-297c-g43g) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Mitigation for compromised eMudhra intermediate certificates [CVE-2026-115570](https://nvd.nist.gov/vuln/detail/CVE-2026-115570) / [GHSA-jr5w-w6x2-84p9](https://redirect.github.com/advisories/GHSA-jr5w-w6x2-84p9) <details> <summary>More information</summary> #### Details ##### Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app. Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected. Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470). ##### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ##### Fixed Versions * `45.0.0-beta.6` * `44.9.1` * `43.8.1` * `42.11.16` ##### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 7.4 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9](https://redirect.github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9) - [https://github.com/electron/electron/pull/55127](https://redirect.github.com/electron/electron/pull/55127) - [https://github.com/electron/electron/pull/55128](https://redirect.github.com/electron/electron/pull/55128) - [https://github.com/electron/electron/pull/55129](https://redirect.github.com/electron/electron/pull/55129) - [https://github.com/electron/electron/pull/55130](https://redirect.github.com/electron/electron/pull/55130) - [https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc](https://redirect.github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc) - [https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad](https://redirect.github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad) - [https://github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e7ad20](https://redirect.github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e7ad20) - [https://github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e800499](https://redirect.github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e800499) - [https://github.com/electron/electron](https://redirect.github.com/electron/electron) - [https://github.com/electron/electron/releases/tag/v42.11.16](https://redirect.github.com/electron/electron/releases/tag/v42.11.16) - [https://github.com/electron/electron/releases/tag/v43.8.1](https://redirect.github.com/electron/electron/releases/tag/v43.8.1) - [https://github.com/electron/electron/releases/tag/v44.9.1](https://redirect.github.com/electron/electron/releases/tag/v44.9.1) - [https://github.com/electron/electron/releases/tag/v45.0.0-beta.6](https://redirect.github.com/electron/electron/releases/tag/v45.0.0-beta.6) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jr5w-w6x2-84p9) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>electron/electron (electron)</summary> ### [`v43.8.1`](https://redirect.github.com/electron/electron/releases/tag/v43.8.1): electron v43.8.1 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.8.0...v43.8.1) ### Release Notes for v43.8.1 > \[!NOTE] > This release contains the fix for <https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9>, the mitigation for compromised eMudhra intermediate certificates #### Fixes - Fixed link-opened windows not using the opener's session and `webPreferences`. [#​55049](https://redirect.github.com/electron/electron/pull/55049) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/55050), [44](https://redirect.github.com/electron/electron/pull/55048), [45](https://redirect.github.com/electron/electron/pull/55051))</sup> - Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#​55047](https://redirect.github.com/electron/electron/pull/55047) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/55054), [44](https://redirect.github.com/electron/electron/pull/55046), [45](https://redirect.github.com/electron/electron/pull/55045))</sup> ### [`v43.8.0`](https://redirect.github.com/electron/electron/releases/tag/v43.8.0): electron v43.8.0 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.11...v43.8.0) ### Release Notes for v43.8.0 #### Fixes - Fixed a crash on Linux at startup or on theme change with GTK modules loaded. [#​55016](https://redirect.github.com/electron/electron/pull/55016) - Fixed a crash when creating a framed window on Wayland in environments where GTK could not initialize. [#​54893](https://redirect.github.com/electron/electron/pull/54893) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54420), [45](https://redirect.github.com/electron/electron/pull/54399))</sup> - Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#​54884](https://redirect.github.com/electron/electron/pull/54884) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54859), [45](https://redirect.github.com/electron/electron/pull/54846))</sup> - Fixed an issue where clicks posted to a background app were dropped on macOS. [#​54905](https://redirect.github.com/electron/electron/pull/54905) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54906), [44](https://redirect.github.com/electron/electron/pull/54819), [45](https://redirect.github.com/electron/electron/pull/54818))</sup> - Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#​54908](https://redirect.github.com/electron/electron/pull/54908) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54925), [44](https://redirect.github.com/electron/electron/pull/54909), [45](https://redirect.github.com/electron/electron/pull/54910))</sup> - Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#​54962](https://redirect.github.com/electron/electron/pull/54962) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/55000), [45](https://redirect.github.com/electron/electron/pull/54956))</sup> #### Other Changes - Backported fixes from upstream Chromium and V8. [#​55032](https://redirect.github.com/electron/electron/pull/55032) - Updated Node.js to v24.22.0. [#​55003](https://redirect.github.com/electron/electron/pull/55003) ### [`v43.7.11`](https://redirect.github.com/electron/electron/releases/tag/v43.7.11): electron v43.7.11 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.10...v43.7.11) ### Release Notes for v43.7.11 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#​54899](https://redirect.github.com/electron/electron/pull/54899) #### Documentation - Documentation changes: [#​54881](https://redirect.github.com/electron/electron/pull/54881) ### [`v43.7.10`](https://redirect.github.com/electron/electron/releases/tag/v43.7.10): electron v43.7.10 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.9...v43.7.10) ### Release Notes for v43.7.10 #### Fixes - Fixed a crash when starting without an available display server on Linux. [#​54795](https://redirect.github.com/electron/electron/pull/54795) <sup>(Also in [45](https://redirect.github.com/electron/electron/pull/54781))</sup> - Fixed a renderer crash when a `ResizeObserver` loop-limit error handler modified layout. [#​54611](https://redirect.github.com/electron/electron/pull/54611) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54610), [44](https://redirect.github.com/electron/electron/pull/54290), [45](https://redirect.github.com/electron/electron/pull/54289))</sup> ### [`v43.7.9`](https://redirect.github.com/electron/electron/releases/tag/v43.7.9): electron v43.7.9 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.8...v43.7.9) ### Release Notes for v43.7.9 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#​54667](https://redirect.github.com/electron/electron/pull/54667) - Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#​54658](https://redirect.github.com/electron/electron/pull/54658) ### [`v43.7.8`](https://redirect.github.com/electron/electron/releases/tag/v43.7.8): electron v43.7.8 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.7...v43.7.8) ### Release Notes for v43.7.8 #### Fixes - Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#​54597](https://redirect.github.com/electron/electron/pull/54597) - Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#​54584](https://redirect.github.com/electron/electron/pull/54584) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54586), [45](https://redirect.github.com/electron/electron/pull/54585))</sup> - Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#​54622](https://redirect.github.com/electron/electron/pull/54622) ### [`v43.7.7`](https://redirect.github.com/electron/electron/releases/tag/v43.7.7): electron v43.7.7 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.6...v43.7.7) ### Release Notes for v43.7.7 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn and V8. [#​54569](https://redirect.github.com/electron/electron/pull/54569) ### [`v43.7.6`](https://redirect.github.com/electron/electron/releases/tag/v43.7.6): electron v43.7.6 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.5...v43.7.6) ##### Release Notes for v43.7.6 ##### Fixes - Fixed `--xdg-portal-required-version` having no effect and a spurious portal warning being logged for file dialogs on Linux. [#​54304](https://redirect.github.com/electron/electron/pull/54304) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54303), [45](https://redirect.github.com/electron/electron/pull/54302))</sup> - Fixed a child `WebContentsView` losing focus when its window is reactivated. [#​54456](https://redirect.github.com/electron/electron/pull/54456) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54455), [45](https://redirect.github.com/electron/electron/pull/54454))</sup> - Fixed a crash when a WebAuthn request used a security key that required its PIN. [#​54404](https://redirect.github.com/electron/electron/pull/54404) <sup>(Also in [45](https://redirect.github.com/electron/electron/pull/54389))</sup> - Fixed a crash when sending a DevTools protocol command with a non-string value for an optional string parameter via `webContents.debugger`. [#​54443](https://redirect.github.com/electron/electron/pull/54443) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54445), [45](https://redirect.github.com/electron/electron/pull/54444))</sup> - Fixed a grey border around frameless windows on Linux WMs without compositing. [#​54390](https://redirect.github.com/electron/electron/pull/54390) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54391), [45](https://redirect.github.com/electron/electron/pull/54392))</sup> - Fixed a main process crash when a native API method was called with a `this` value of a different native type; it now throws a `TypeError`. [#​54316](https://redirect.github.com/electron/electron/pull/54316) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54315))</sup> - Fixed a possible crash during process exit when `vm.Script` or `vm` contexts created in the main process had been garbage collected shortly before quitting. [#​54268](https://redirect.github.com/electron/electron/pull/54268) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54266), [45](https://redirect.github.com/electron/electron/pull/54267))</sup> - Fixed a possible renderer crash in 32-bit Windows and Linux ARM builds caused by under-aligned Blink heap vector allocations. [#​54259](https://redirect.github.com/electron/electron/pull/54259) - Fixed a renderer crash calling `image.toPNG()` from a sandboxed preload script. [#​54503](https://redirect.github.com/electron/electron/pull/54503) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54502), [45](https://redirect.github.com/electron/electron/pull/54501))</sup> - Fixed `clipboard.read()`, `readText()` and `has()` resolving seconds late on Linux while the app was idle. [#​54309](https://redirect.github.com/electron/electron/pull/54309) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54310), [44](https://redirect.github.com/electron/electron/pull/54308), [45](https://redirect.github.com/electron/electron/pull/54307))</sup> - Fixed `desktopCapturer.getSources()` leaving non-resizable windows resizable on macOS. [#​54396](https://redirect.github.com/electron/electron/pull/54396) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54397), [45](https://redirect.github.com/electron/electron/pull/54398))</sup> - Fixed `fs.rmSync` failing to remove read-only files on Windows. [#​54256](https://redirect.github.com/electron/electron/pull/54256) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54257), [44](https://redirect.github.com/electron/electron/pull/54255), [45](https://redirect.github.com/electron/electron/pull/54190))</sup> - Fixed `GDK_BACKEND` leaking into processes spawned by Electron apps on Linux. [#​54426](https://redirect.github.com/electron/electron/pull/54426) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54425), [45](https://redirect.github.com/electron/electron/pull/54424))</sup> - Fixed `pointerLock` permission requests from some iframes reporting the parent frame. [#​54465](https://redirect.github.com/electron/electron/pull/54465) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54466), [44](https://redirect.github.com/electron/electron/pull/54464), [45](https://redirect.github.com/electron/electron/pull/54463))</sup> - Fixed `setIgnoreMouseEvents()` taking effect late on X11. [#​54498](https://redirect.github.com/electron/electron/pull/54498) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54497), [45](https://redirect.github.com/electron/electron/pull/54496))</sup> - Fixed `setIgnoreMouseEvents(true)` being undone by the next resize on X11. [#​54423](https://redirect.github.com/electron/electron/pull/54423) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54393), [45](https://redirect.github.com/electron/electron/pull/54394))</sup> - Added `setIgnoreMouseEvents` support on Wayland. - Fixed the default action label on Linux notifications not being localized. [#​54400](https://redirect.github.com/electron/electron/pull/54400) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54401), [45](https://redirect.github.com/electron/electron/pull/54402))</sup> - Fixed the GPU process crash-looping on Windows when the sandbox cannot read the install folder; the folder is now reported instead. [#​54485](https://redirect.github.com/electron/electron/pull/54485) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54484), [45](https://redirect.github.com/electron/electron/pull/54483))</sup> - Fixed the zoom level resetting on `file:` and other host-less pages after a `location.hash` change. [#​54440](https://redirect.github.com/electron/electron/pull/54440) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54442), [45](https://redirect.github.com/electron/electron/pull/54441))</sup> - Fixed typing not working after closing an `alert()` or `confirm()` on Windows. [#​54462](https://redirect.github.com/electron/electron/pull/54462) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54461), [45](https://redirect.github.com/electron/electron/pull/54460))</sup> - Fixed `utilityProcess` dropping `stdout`/`stderr` output that the child wrote immediately before exiting. [#​54279](https://redirect.github.com/electron/electron/pull/54279) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54332), [44](https://redirect.github.com/electron/electron/pull/54278), [45](https://redirect.github.com/electron/electron/pull/54335))</sup> - Fixed visual zoom limits resetting on navigation and not applying to webviews. [#​54450](https://redirect.github.com/electron/electron/pull/54450) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54449), [45](https://redirect.github.com/electron/electron/pull/54438))</sup> - Fixed WebAssembly exception handlers failing to catch, or crashing during tier-up, in modules using wasm exceptions. [#​54235](https://redirect.github.com/electron/electron/pull/54235) - Fixed WebAssembly modules loaded from the code cache crashing or throwing `RuntimeError: unreachable` after updating between certain patch releases. [#​54238](https://redirect.github.com/electron/electron/pull/54238) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54239), [44](https://redirect.github.com/electron/electron/pull/54246), [45](https://redirect.github.com/electron/electron/pull/54237))</sup> - Fixed `win.setEnabled(false)` and modal child windows not blocking input on Wayland. [#​54446](https://redirect.github.com/electron/electron/pull/54446) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54447), [45](https://redirect.github.com/electron/electron/pull/54448))</sup> - Fixed zoom in/out getting stuck after zooming past the 25%-500% range. [#​54422](https://redirect.github.com/electron/electron/pull/54422) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54421), [45](https://redirect.github.com/electron/electron/pull/54395))</sup> - Fixed `setVisualZoomLevelLimits()` shrinking pages when the minimum is under 1. ### [`v43.7.5`](https://redirect.github.com/electron/electron/releases/tag/v43.7.5): electron v43.7.5 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.4...v43.7.5) ##### Release Notes for v43.7.5 ##### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. [#​54221](https://redirect.github.com/electron/electron/pull/54221) ### [`v43.7.4`](https://redirect.github.com/electron/electron/releases/tag/v43.7.4): electron v43.7.4 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.3...v43.7.4) ##### Release Notes for v43.7.4 ##### Fixes - Fixed a crash when calling `setIgnoreMenuShortcuts()` on DevTools. [#​54117](https://redirect.github.com/electron/electron/pull/54117) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54116), [45](https://redirect.github.com/electron/electron/pull/54115))</sup> - Fixed a spurious "`sandboxed_renderer.bundle.js` script failed to run" console error when DevTools attached to a sandboxed frame before its first navigation. [#​54176](https://redirect.github.com/electron/electron/pull/54176) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54175))</sup> - Fixed an "Invalid `guestInstanceId`" error when removing a loaded `<webview>` from the DOM. [#​54097](https://redirect.github.com/electron/electron/pull/54097) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/54098), [44](https://redirect.github.com/electron/electron/pull/54099), [45](https://redirect.github.com/electron/electron/pull/54096))</sup> - Fixed `ready-to-show` never firing for some hidden windows on Windows and Linux. [#​54119](https://redirect.github.com/electron/electron/pull/54119) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54118), [45](https://redirect.github.com/electron/electron/pull/54110))</sup> ### [`v43.7.3`](https://redirect.github.com/electron/electron/releases/tag/v43.7.3): electron v43.7.3 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.2...v43.7.3) ##### Release Notes for v43.7.3 ##### Other Changes - Backported fixes from upstream Chromium, Dawn, PDFium, Skia and V8. [#​54082](https://redirect.github.com/electron/electron/pull/54082) ### [`v43.7.2`](https://redirect.github.com/electron/electron/releases/tag/v43.7.2): electron v43.7.2 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.1...v43.7.2) ##### Release Notes for v43.7.2 ##### Fixes - Fixed a potential UAF when a `select-usb-device` handler destroys the requesting `webContents`. [#​54007](https://redirect.github.com/electron/electron/pull/54007) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/54009), [45](https://redirect.github.com/electron/electron/pull/54008))</sup> - Fixed default protocol client APIs falsely returning `true` on Windows. [#​53960](https://redirect.github.com/electron/electron/pull/53960) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/53959), [45](https://redirect.github.com/electron/electron/pull/53958))</sup> ##### Other Changes - Backported fix from upstream V8. [#​53988](https://redirect.github.com/electron/electron/pull/53988) - Backported fixes from upstream ANGLE, Chromium, Skia and V8. [#​53984](https://redirect.github.com/electron/electron/pull/53984) ### [`v43.7.1`](https://redirect.github.com/electron/electron/releases/tag/v43.7.1): electron v43.7.1 [Compare Source](https://redirect.github.com/electron/electron/compare/v43.7.0...v43.7.1) ##### Release Notes for v43.7.1 ##### Fixes - Fixed a main-process crash when an app called `loadURL()` again right after a load failed because the renderer process exited before the page committed. [#​53944](https://redirect.github.com/electron/electron/pull/53944) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/53943), [45](https://redirect.github.com/electron/electron/pull/53942))</sup> - Fixed a memory leak on Windows when `app.getPreferredSystemLanguages()` was called. [#​53867](https://redirect.github.com/electron/electron/pull/53867) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/53868), [45](https://redirect.github.com/electron/electron/pull/53869))</sup> - Fixed a potential UAF in `app.getPreferredSystemLanguages()` on Windows. [#​53866](https://redirect.github.com/electron/electron/pull/53866) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/53865), [45](https://redirect.github.com/electron/electron/pull/53864))</sup> - Fixed a renderer crash when an iframe was removed right after loading with `nodeIntegrationInSubFrames` enabled and `sandbox` disabled, e.g. on pages that embed Meta Pixel. [#​53884](https://redirect.github.com/electron/electron/pull/53884) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/53886), [44](https://redirect.github.com/electron/electron/pull/53885), [45](https://redirect.github.com/electron/electron/pull/53883))</sup> - Fixed a Windows renderer crash when no default locale could be determined. [#​53948](https://redirect.github.com/electron/electron/pull/53948) - Fixed `webContents.capturePage()` on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's `offscreen.deviceScaleFactor`. [#​53818](https://redirect.github.com/electron/electron/pull/53818) <sup>(Also in [44](https://redirect.github.com/electron/electron/pull/53816), [45](https://redirect.github.com/electron/electron/pull/53817))</sup> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/go-vikunja/vikunja). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
kolaente
|
7d1fd9b732 | fix(desktop): restrict remote images to https in the CSP | ||
|
renovate[bot]andkolaente
|
864f198ae7 | chore(deps): lock file maintenance | ||
|
renovate[bot]andkolaente
|
081b8c1dbf | chore(deps): update dependency ip-address to v10.7.4 | ||
|
dependabot[bot]andkolaente
|
3b036fa677 |
build(deps): bump qs from 6.15.3 to 6.16.0 in /desktop
Bumps [qs](https://github.com/ljharb/qs) from 6.15.3 to 6.16.0. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/qs/compare/v6.15.3...v6.16.0) --- updated-dependencies: - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andkolaente
|
972e0fcb57 |
build(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /desktop
Bumps [proxy-addr](https://github.com/jshttp/proxy-addr) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
renovate[bot]andkolaente
|
1414336e14 | chore(deps): update dependency ip-address to v10.7.3 | ||
|
renovate[bot]andkolaente
|
e69d2bc68d | chore(deps): update dependency fast-uri@3 to v4.1.5 [security] | ||
 kolaenteandTink
|
e2f32c0b32 | refactor(client): delete shared legacy infrastructure and Axios | ||
|
kolaenteandTink
|
117f8be24e | refactor(client): store the API base suffix-less and canonicalize v2 URLs | ||
|
renovate[bot]andkolaente
|
fdfc50feb9 | chore(deps): update dependency brace-expansion@5 to v5.0.12 | ||
|
renovate[bot]andkolaente
|
7d49a82bee | chore(deps): update dependency ip-address to v10.7.2 | ||
|
renovate[bot]andkolaente
|
e82242702f | chore(deps): update pnpm to v11.27.0 | ||
|
renovate[bot]andkolaente
|
27ae756028 | chore(deps): update dependency js-yaml to v5.4.2 | ||
|
renovate[bot]andkolaente
|
27da2e450f | chore(deps): update dev-dependencies | ||
|
renovate[bot]andkolaente
|
23e5f31e28 | chore(deps): update pnpm to v11.26.0 | ||
|
renovate[bot]andkolaente
|
1ba458e825 | chore(deps): update dependency undici@6 to v8.10.2 | ||
|
renovate[bot]andkolaente
|
4994e9a07b | chore(deps): update dependency undici@7 to v8.10.2 | ||
|
renovate[bot]andkolaente
|
359af3d5d2 | chore(deps): update dev-dependencies | ||
|
kolaente
|
a881ac39ee | fix(desktop): re-add ad-hoc signing in macos builds | ||
|
renovate[bot]andkolaente
|
a13e1b21c6 | chore(deps): update dependency fast-uri@3 to v4.1.4 | ||
|
renovate[bot]andkolaente
|
ef920b6308 | chore(deps): update dev-dependencies | ||
|
renovate[bot]andkolaente
|
0a3d2c6353 | chore(deps): update dependency undici@6 to v8.10.1 | ||
|
renovate[bot]andkolaente
|
e30c4c9ddc | chore(deps): update dependency undici@7 to v8.10.1 | ||
|
renovate[bot]andkolaente
|
73e13eee52 | chore(deps): update dev-dependencies | ||
|
renovate[bot]andkolaente
|
da939e8e16 | chore(deps): update pnpm to v11.25.0 | ||
|
renovate[bot]andkolaente
|
cdf6e2dfc6 | chore(deps): update dependency ip-address to v10.7.0 | ||
|
renovate[bot]andkolaente
|
a7defc7538 | chore(deps): update dependency js-yaml to v5.4.1 | ||
|
renovate[bot]andkolaente
|
9431d98afd | chore(deps): update dependency js-yaml to v5.4.0 | ||
|
renovate[bot]andkolaente
|
b56a63d6c9 | chore(deps): update pnpm to v11.24.0 | ||
|
renovate[bot]andkolaente
|
472781f2f1 | chore(deps): update dependency picomatch to v4.0.7 | ||
|
renovate[bot]andkolaente
|
3b2e63d9ee | chore(deps): update pnpm to v11.23.0 | ||
|
renovate[bot]andkolaente
|
025c457810 | chore(deps): update dependency fast-uri@3 to v4.1.3 | ||
|
renovate[bot]andkolaente
|
ae5ab05955 | chore(deps): update dev-dependencies | ||
|
renovate[bot]andkolaente
|
592ba94bd5 | chore(deps): update pnpm to v11.22.0 | ||
|
renovate[bot]andkolaente
|
9f03f74693 | chore(deps): update dependency fast-uri@3 to v4 | ||
|
renovate[bot]andkolaente
|
8fd0c23421 | chore(deps): update dependency js-yaml to v5.3.0 | ||
|
renovate[bot]andkolaente
|
6df8e84adf | chore(deps): update dependency ip-address to v10.5.0 | ||
|
renovate[bot]andkolaente
|
5c3c127cc1 | chore(deps): update dependency undici@6 to v8.10.0 | ||
|
kolaente
|
b6037a2562 | chore(deps): update fast-uri to 3.1.5 | ||
|
kolaente
|
a9b7c89bfb | chore(deps): update brace-expansion to 5.0.9 in desktop |