dancefinder/dancefinder-app
5
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Activity

Build(deps): [security] bump undici from 5.22.1 to 5.26.3 #1516

Merged
argoyle merged 1 commits from dependabot-npm_and_yarn-undici-5.26.3 into master 2023-10-17 05:06:07 +00:00
Conversation 1 Commits 1 Files Changed 1
+9 -4
argoyle commented 2023-10-17 04:51:21 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

Bumps undici from 5.22.1 to 5.26.3. This update includes a security fix.

Vulnerabilities fixed

Undici's cookie header not cleared on cross-origin redirect in fetch

Impact

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.

Patched versions: 5.26.2 Affected versions: < 5.26.2

Release notes

Sourced from undici's releases.

v5.26.3

No release notes provided.

v5.26.2

Security Release, CVE-2023-45143.

v5.26.1

What's Changed

Full Changelog: https://github.com/nodejs/undici/compare/v5.26.0...v5.26.1

v5.26.0

What's Changed

New Contributors

Full Changelog: https://github.com/nodejs/undici/compare/v5.23.4...v5.26.0

v5.25.3

What's Changed

New Contributors

... (truncated)

Commits

Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts
Bumps [undici](https://github.com/nodejs/undici) from 5.22.1 to 5.26.3. **This update includes a security fix.** <details> <summary>Vulnerabilities fixed</summary> <blockquote> <p><strong>Undici's cookie header not cleared on cross-origin redirect in fetch</strong></p> <h3>Impact</h3> <p>Undici clears Authorization headers on cross-origin redirects, but does not clear <code>Cookie</code> headers. By design, <code>cookie</code> headers are <a href="https://fetch.spec.whatwg.org/#forbidden-request-header">forbidden request headers</a>, disallowing them to be set in <code>RequestInit.headers</code> in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.</p> <p>As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.</p> <h3>Patches</h3> <p>This was patched in <a href="https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76">e041de359221ebeae04c469e8aff4145764e6d76</a>, which is included in version 5.26.2.</p> <p>Patched versions: 5.26.2 Affected versions: &lt; 5.26.2</p> </blockquote> </details> <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v5.26.3</h2> <p>No release notes provided.</p> <h2>v5.26.2</h2> <p>Security Release, CVE-2023-45143.</p> <h2>v5.26.1</h2> <h2>What's Changed</h2> <ul> <li>Fix publish undici-types once and for all! by <a href="https://github.com/Ethan-Arrowood"><code>@​Ethan-Arrowood</code></a> in <a href="https://github.com/nodejs/undici/pull/2338">nodejs/undici#2338</a></li> <li>Fix node detection omfg by <a href="https://github.com/KhafraDev"><code>@​KhafraDev</code></a> in <a href="https://github.com/nodejs/undici/pull/2341">nodejs/undici#2341</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v5.26.0...v5.26.1">https://github.com/nodejs/undici/compare/v5.26.0...v5.26.1</a></p> <h2>v5.26.0</h2> <h2>What's Changed</h2> <ul> <li>use npm install instead of npm ci by <a href="https://github.com/Ethan-Arrowood"><code>@​Ethan-Arrowood</code></a> in <a href="https://github.com/nodejs/undici/pull/2309">nodejs/undici#2309</a></li> <li>change default header to <code>node</code> by <a href="https://github.com/Ethan-Arrowood"><code>@​Ethan-Arrowood</code></a> in <a href="https://github.com/nodejs/undici/pull/2310">nodejs/undici#2310</a></li> <li>chore: change order of the pseudo-headers by <a href="https://github.com/kyrylodolynskyi"><code>@​kyrylodolynskyi</code></a> in <a href="https://github.com/nodejs/undici/pull/2308">nodejs/undici#2308</a></li> <li>fix: Agent.Options.factory should accept URL object or string as parameter by <a href="https://github.com/nicole0707"><code>@​nicole0707</code></a> in <a href="https://github.com/nodejs/undici/pull/2295">nodejs/undici#2295</a></li> <li>build(deps-dev): bump sinon from 15.2.0 to 16.1.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://github.com/nodejs/undici/pull/2312">nodejs/undici#2312</a></li> <li>test: handle npm ignore-scripts settings by <a href="https://github.com/panva"><code>@​panva</code></a> in <a href="https://github.com/nodejs/undici/pull/2313">nodejs/undici#2313</a></li> <li>feat: respect <code>--max-http-header-size</code> Node.js flag by <a href="https://github.com/balazsorban44"><code>@​balazsorban44</code></a> in <a href="https://github.com/nodejs/undici/pull/2234">nodejs/undici#2234</a></li> <li>fix(<a href="https://github.com/nodejs/undici/issues/2311">#2311</a>): End stream after body sent by <a href="https://github.com/metcoder95"><code>@​metcoder95</code></a> in <a href="https://github.com/nodejs/undici/pull/2314">nodejs/undici#2314</a></li> <li>disallow setting host header in fetch by <a href="https://github.com/KhafraDev"><code>@​KhafraDev</code></a> in <a href="https://github.com/nodejs/undici/pull/2322">nodejs/undici#2322</a></li> <li>[StepSecurity] ci: Harden GitHub Actions by <a href="https://github.com/step-security-bot"><code>@​step-security-bot</code></a> in <a href="https://github.com/nodejs/undici/pull/2325">nodejs/undici#2325</a></li> <li>fix fetch with coverage enabled by <a href="https://github.com/KhafraDev"><code>@​KhafraDev</code></a> in <a href="https://github.com/nodejs/undici/pull/2330">nodejs/undici#2330</a></li> <li>Fix stuck when using http2 POST Buffer by <a href="https://github.com/binsee"><code>@​binsee</code></a> in <a href="https://github.com/nodejs/undici/pull/2336">nodejs/undici#2336</a></li> <li>fix: 🏷️ add allowH2 to BuildOptions by <a href="https://github.com/binsee"><code>@​binsee</code></a> in <a href="https://github.com/nodejs/undici/pull/2334">nodejs/undici#2334</a></li> <li>fix: 🐛 fix process http2 header by <a href="https://github.com/binsee"><code>@​binsee</code></a> in <a href="https://github.com/nodejs/undici/pull/2332">nodejs/undici#2332</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/kyrylodolynskyi"><code>@​kyrylodolynskyi</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2308">nodejs/undici#2308</a></li> <li><a href="https://github.com/nicole0707"><code>@​nicole0707</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2295">nodejs/undici#2295</a></li> <li><a href="https://github.com/balazsorban44"><code>@​balazsorban44</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2234">nodejs/undici#2234</a></li> <li><a href="https://github.com/binsee"><code>@​binsee</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2336">nodejs/undici#2336</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v5.23.4...v5.26.0">https://github.com/nodejs/undici/compare/v5.23.4...v5.26.0</a></p> <h2>v5.25.3</h2> <h2>What's Changed</h2> <ul> <li>perf: improve parse-url implementation by <a href="https://github.com/anonrig"><code>@​anonrig</code></a> in <a href="https://github.com/nodejs/undici/pull/2286">nodejs/undici#2286</a></li> <li>test: enable websockets inclusion in WPTReport by <a href="https://github.com/panva"><code>@​panva</code></a> in <a href="https://github.com/nodejs/undici/pull/2284">nodejs/undici#2284</a></li> <li>remove npm run test from pre-commit hook by <a href="https://github.com/dancastillo"><code>@​dancastillo</code></a> in <a href="https://github.com/nodejs/undici/pull/2296">nodejs/undici#2296</a></li> <li>perf: use <code>@​fastify/busboy</code> by <a href="https://github.com/gurgunday"><code>@​gurgunday</code></a> in <a href="https://github.com/nodejs/undici/pull/2211">nodejs/undici#2211</a></li> <li>Disable finalizationregistry if node code cov by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://github.com/nodejs/undici/pull/2298">nodejs/undici#2298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gurgunday"><code>@​gurgunday</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2211">nodejs/undici#2211</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/227b9bedf233f741b86dda4ae9d1c7ad69f5d75c"><code>227b9be</code></a> 5.26.3</li> <li><a href="https://github.com/nodejs/undici/commit/5351f1fdb1f49f86e356056d7beb291af0144390"><code>5351f1f</code></a> include esbuild script in files</li> <li><a href="https://github.com/nodejs/undici/commit/12a62187d45f332cf39dd405f7c52b759cf40cdd"><code>12a6218</code></a> Bumped v5.26.2</li> <li><a href="https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76"><code>e041de3</code></a> Merge pull request from GHSA-wqq4-5wpv-mx2g</li> <li><a href="https://github.com/nodejs/undici/commit/c8c80b1115d668664d8cf3acec7535b0258c3079"><code>c8c80b1</code></a> 5.26.1</li> <li><a href="https://github.com/nodejs/undici/commit/7bcb80c0a22509ceba1b786847faba5aded1bea0"><code>7bcb80c</code></a> Fix node detection omfg (<a href="https://github.com/nodejs/undici/issues/2341">#2341</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/69ea7b94434e2a3746e6ad1477d122a8d4075c76"><code>69ea7b9</code></a> hopefully this fixes it for good (<a href="https://github.com/nodejs/undici/issues/2338">#2338</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/4006aaf43ac8b30e16d6d3b89fa2e0df4b7eef33"><code>4006aaf</code></a> Bumped v5.26.0</li> <li><a href="https://github.com/nodejs/undici/commit/df9795883fb75eb97d27f86ce97a491bf023717c"><code>df97958</code></a> fix: 🐛 fix process http2 header (<a href="https://github.com/nodejs/undici/issues/2332">#2332</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/b9d83681443405bcc4e77a4c196e559944f1dfa1"><code>b9d8368</code></a> fix: 🏷️ add allowH2 to BuildOptions (<a href="https://github.com/nodejs/undici/issues/2334">#2334</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v5.22.1...v5.26.3">compare view</a></li> </ul> </details> <br /> --- <details> <summary>Dependabot commands</summary> <br /> You can trigger Dependabot actions by commenting on this MR - `$dependabot recreate` will recreate this MR rewriting all the manual changes and resolving conflicts </details>
argoyle commented 2023-10-17 05:05:48 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

added 4 commits

  • 69932121...60a58888 - 3 commits from branch master
  • 27ea7ddd - Build(deps): [security] bump undici from 5.22.1 to 5.26.3

Compare with previous version

added 4 commits <ul><li>69932121...60a58888 - 3 commits from branch <code>master</code></li><li>27ea7ddd - Build(deps): [security] bump undici from 5.22.1 to 5.26.3</li></ul> [Compare with previous version](/unboundsoftware/dancefinder/dancefinder-app/-/merge_requests/1467/diffs?diff_id=817401801&start_sha=69932121e179ca7f54758fd72d75db7387aad0e4)
argoyle (Migrated from gitlab.com) merged commit into master 2023-10-17 05:06:07 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
javascript
security
Pull requests that address a security vulnerability
 severity:critical
severity:high
severity:low
severity:moderate
No Label dependencies javascript security severity:low
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dancefinder/dancefinder-app#1516
Delete Branch "dependabot-npm_and_yarn-undici-5.26.3"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?