BryanLaura / Google-api-python-client

Creative Commons Attribution 4.0 International
2 stars 1 forks source link

Update dependency node-fetch to 3.2.10 [SECURITY] #394

Closed renovate[bot] closed 2 years ago

renovate[bot] commented 2 years ago

Mend Renovate

This PR contains the following updates:

Package Change
node-fetch 3.2.5 -> 3.2.10

GitHub Vulnerability Alerts

CVE-2022-2596

node-fetch is a light-weight module that brings window.fetch to node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.



This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] commented 2 years ago

âš  Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

â™» Renovate will retry this branch, including artifacts, only when one of the following happens:

The artifact failure details are included below:

File name: package-lock.json
npm WARN config optional Use `--omit=optional` to exclude optional dependencies, or
npm WARN config `--include=optional` to include them.
npm WARN config 
npm WARN config     Default value does install optional deps unless otherwise omitted.
npm WARN config optional Use `--omit=optional` to exclude optional dependencies, or
npm WARN config `--include=optional` to include them.
npm WARN config 
npm WARN config     Default value does install optional deps unless otherwise omitted.
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: ajv-keywords@3.5.2
npm WARN Found: ajv@8.6.3
npm WARN node_modules/ajv
npm WARN   dev ajv@"8.6.3" from the root project
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer ajv@"^6.9.1" from ajv-keywords@3.5.2
npm WARN node_modules/ajv-keywords
npm WARN   ajv-keywords@"^3.5.2" from schema-utils@3.0.0
npm WARN   node_modules/copy-webpack-plugin/node_modules/schema-utils
npm WARN   6 more (schema-utils, schema-utils, schema-utils, schema-utils, ...)
npm WARN 
npm WARN Conflicting peer dependency: ajv@6.12.6
npm WARN node_modules/ajv
npm WARN   peer ajv@"^6.9.1" from ajv-keywords@3.5.2
npm WARN   node_modules/ajv-keywords
npm WARN     ajv-keywords@"^3.5.2" from schema-utils@3.0.0
npm WARN     node_modules/copy-webpack-plugin/node_modules/schema-utils
npm WARN     6 more (schema-utils, schema-utils, schema-utils, schema-utils, ...)
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: jest-puppeteer@5.0.4
npm ERR! Found: puppeteer@13.1.2
npm ERR! node_modules/puppeteer
npm ERR!   dev puppeteer@"13.1.2" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer puppeteer@">= 1.5.0 < 10" from jest-puppeteer@5.0.4
npm ERR! node_modules/jest-puppeteer
npm ERR!   dev jest-puppeteer@"5.0.4" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: puppeteer@9.1.1
npm ERR! node_modules/puppeteer
npm ERR!   peer puppeteer@">= 1.5.0 < 10" from jest-puppeteer@5.0.4
npm ERR!   node_modules/jest-puppeteer
npm ERR!     dev jest-puppeteer@"5.0.4" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate-cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate-cache/others/npm/_logs/2022-08-04T18_21_53_687Z-debug-0.log