search

FigureTechnologies / digital-currency-consortium

Digital Currency Consortium middleware - interface between banks and digital currency smart contracts.
Apache License 2.0
12 stars 3 forks source link

Update dependency node-fetch from `3.1.0` to `3.2.10` [SECURITY] #131

Closed figure-renovate[bot] closed 1 year ago

figure-renovate[bot] commented 1 year ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
node-fetch 3.1.0 -> 3.2.10 age adoption passing confidence

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2022-0235

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

CVE-2022-2596

node-fetch is a light-weight module that brings window.fetch to node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.

Release Notes

node-fetch/node-fetch ### [`v3.2.10`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.10) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.9...v3.2.10) ##### Bug Fixes - ReDoS referrer ([#​1611](https://togithub.com/node-fetch/node-fetch/issues/1611)) ([2880238](https://togithub.com/node-fetch/node-fetch/commit/28802387292baee467e042e168d92597b5bbbe3d)) ### [`v3.2.9`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.9) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.8...v3.2.9) ##### Bug Fixes - **Headers:** don't forward secure headers on protocol change ([#​1599](https://togithub.com/node-fetch/node-fetch/issues/1599)) ([e87b093](https://togithub.com/node-fetch/node-fetch/commit/e87b093fd678a9ea39c5b17b2a1bdfc4691eedc7)) ### [`v3.2.8`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.8) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.7...v3.2.8) ##### Bug Fixes - possibly flaky test ([#​1523](https://togithub.com/node-fetch/node-fetch/issues/1523)) ([11b7033](https://togithub.com/node-fetch/node-fetch/commit/11b703361134340a8361f591d6e3a0bcf6a261fa)) ### [`v3.2.7`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.7) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.6...v3.2.7) ##### Bug Fixes - always warn Request.data ([#​1550](https://togithub.com/node-fetch/node-fetch/issues/1550)) ([4f43c9e](https://togithub.com/node-fetch/node-fetch/commit/4f43c9ed63da98f4b5167f0a8e447cd0f0133cd3)) ### [`v3.2.6`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.6) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.5...v3.2.6) ##### Bug Fixes - undefined reference to response.body when aborted ([#​1578](https://togithub.com/node-fetch/node-fetch/issues/1578)) ([1c5ed6b](https://togithub.com/node-fetch/node-fetch/commit/1c5ed6b981e6c5dd28bd50f5ab5418e5bd262b99)) ### [`v3.2.5`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.5) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.4...v3.2.5) ##### Bug Fixes - use space in accept-encoding values ([#​1572](https://togithub.com/node-fetch/node-fetch/issues/1572)) ([a92b5d5](https://togithub.com/node-fetch/node-fetch/commit/a92b5d5cf4457c2da95d8404b08cfd06a426a2fa)), closes [#​1571](https://togithub.com/node-fetch/node-fetch/issues/1571) ### [`v3.2.4`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.4) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.3...v3.2.4) ##### Bug Fixes - don't uppercase unknown methods ([#​1542](https://togithub.com/node-fetch/node-fetch/issues/1542)) ([004b3ac](https://togithub.com/node-fetch/node-fetch/commit/004b3ac8324e6cdbfb5d04b8bbdc6664ea48fbcf)) ### [`v3.2.3`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.3) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.2...v3.2.3) ##### Bug Fixes - handle bom in text and json ([#​1482](https://togithub.com/node-fetch/node-fetch/issues/1482)) ([6425e20](https://togithub.com/node-fetch/node-fetch/commit/6425e2021a7def096e13dbabcac2f10e6da83d11)) ### [`v3.2.2`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.2) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.1...v3.2.2) ##### Bug Fixes - add missing formdata export to types ([#​1518](https://togithub.com/node-fetch/node-fetch/issues/1518)) ([a4ea5f9](https://togithub.com/node-fetch/node-fetch/commit/a4ea5f9308f942400695cce261291d0a80cd1b02)), closes [#​1517](https://togithub.com/node-fetch/node-fetch/issues/1517) ### [`v3.2.1`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.1) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.2.0...v3.2.1) ##### Bug Fixes - cancel request example import ([#​1513](https://togithub.com/node-fetch/node-fetch/issues/1513)) ([61b3b5a](https://togithub.com/node-fetch/node-fetch/commit/61b3b5a06384003d332581080af6522bec19417f)) ### [`v3.2.0`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.2.0) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.1.1...v3.2.0) ##### Features - export Blob, File and FormData + utilities ([#​1463](https://togithub.com/node-fetch/node-fetch/issues/1463)) ([81b1378](https://togithub.com/node-fetch/node-fetch/commit/81b1378bb3bda555d3d2114e7d3dfddbd91f210c)) ### [`v3.1.1`](https://togithub.com/node-fetch/node-fetch/releases/tag/v3.1.1) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v3.1.0...v3.1.1) #### Security patch release Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred #### What's Changed - core: update fetch-blob by [@​jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1371](https://togithub.com/node-fetch/node-fetch/pull/1371) - docs: Fix typo around sending a file by [@​jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1381](https://togithub.com/node-fetch/node-fetch/pull/1381) - core: (http.request): Cast URL to string before sending it to NodeJS core by [@​jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1378](https://togithub.com/node-fetch/node-fetch/pull/1378) - core: handle errors from the request body stream by [@​mdmitry01](https://togithub.com/mdmitry01) in [https://github.com/node-fetch/node-fetch/pull/1392](https://togithub.com/node-fetch/node-fetch/pull/1392) - core: Better handle wrong redirect header in a response by [@​tasinet](https://togithub.com/tasinet) in [https://github.com/node-fetch/node-fetch/pull/1387](https://togithub.com/node-fetch/node-fetch/pull/1387) - core: Don't use buffer to make a blob by [@​jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1402](https://togithub.com/node-fetch/node-fetch/pull/1402) - docs: update readme for TS [@​types/node-fetch](https://togithub.com/types/node-fetch) by [@​adamellsworth](https://togithub.com/adamellsworth) in [https://github.com/node-fetch/node-fetch/pull/1405](https://togithub.com/node-fetch/node-fetch/pull/1405) - core: Fix logical operator priority to disallow GET/HEAD with non-empty body by [@​maxshirshin](https://togithub.com/maxshirshin) in [https://github.com/node-fetch/node-fetch/pull/1369](https://togithub.com/node-fetch/node-fetch/pull/1369) - core: Don't use global buffer by [@​jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1422](https://togithub.com/node-fetch/node-fetch/pull/1422) - ci: fix main branch by [@​dnalborczyk](https://togithub.com/dnalborczyk) in [https://github.com/node-fetch/node-fetch/pull/1429](https://togithub.com/node-fetch/node-fetch/pull/1429) - core: use more node: protocol imports by [@​dnalborczyk](https://togithub.com/dnalborczyk) in [https://github.com/node-fetch/node-fetch/pull/1428](https://togithub.com/node-fetch/node-fetch/pull/1428) - core: Warn when using data by [@​jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1421](https://togithub.com/node-fetch/node-fetch/pull/1421) - docs: Create SECURITY.md by [@​JamieSlome](https://togithub.com/JamieSlome) in [https://github.com/node-fetch/node-fetch/pull/1445](https://togithub.com/node-fetch/node-fetch/pull/1445) - core: don't forward secure headers to 3th party by [@​jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1449](https://togithub.com/node-fetch/node-fetch/pull/1449) #### New Contributors - [@​mdmitry01](https://togithub.com/mdmitry01) made their first contribution in [https://github.com/node-fetch/node-fetch/pull/1392](https://togithub.com/node-fetch/node-fetch/pull/1392) - [@​tasinet](https://togithub.com/tasinet) made their first contribution in [https://github.com/node-fetch/node-fetch/pull/1387](https://togithub.com/node-fetch/node-fetch/pull/1387) - [@​adamellsworth](https://togithub.com/adamellsworth) made their first contribution in [https://github.com/node-fetch/node-fetch/pull/1405](https://togithub.com/node-fetch/node-fetch/pull/1405) - [@​maxshirshin](https://togithub.com/maxshirshin) made their first contribution in [https://github.com/node-fetch/node-fetch/pull/1369](https://togithub.com/node-fetch/node-fetch/pull/1369) - [@​JamieSlome](https://togithub.com/JamieSlome) made their first contribution in [https://github.com/node-fetch/node-fetch/pull/1445](https://togithub.com/node-fetch/node-fetch/pull/1445) **Full Changelog**: https://github.com/node-fetch/node-fetch/compare/v3.1.0...v3.1.1

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.