Skip to content

Update dependency node-fetch to 2.6.7 [SECURITY] - abandoned #296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Feb 1, 2022

Mend Renovate

This PR contains the following updates:

Package Change
node-fetch 2.6.0 -> 2.6.7

GitHub Vulnerability Alerts

CVE-2022-0235

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

CVE-2020-15168

Impact

Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.

For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Patches

We released patched versions for both stable and beta channels:

  • For v2: 2.6.1
  • For v3: 3.0.0-beta.9

Workarounds

None, it is strongly recommended to update as soon as possible.

For more information

If you have any questions or comments about this advisory:

  • Open an issue in node-fetch
  • Contact one of the core maintainers.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot force-pushed the renovate/npm-node-fetch-vulnerability branch from 6368a02 to 5f3c78a Compare February 4, 2022 19:59
@renovate renovate bot changed the title Update dependency node-fetch to 2.6.7 [SECURITY] Update dependency node-fetch [SECURITY] Feb 4, 2022
@renovate renovate bot force-pushed the renovate/npm-node-fetch-vulnerability branch 2 times, most recently from 6ff6add to b0ef927 Compare February 10, 2022 21:34
@renovate renovate bot force-pushed the renovate/npm-node-fetch-vulnerability branch 3 times, most recently from 222f173 to d32f5f2 Compare February 18, 2022 02:37
@renovate renovate bot force-pushed the renovate/npm-node-fetch-vulnerability branch 7 times, most recently from 96da2d0 to c9cc40d Compare March 1, 2022 05:23
@renovate renovate bot force-pushed the renovate/npm-node-fetch-vulnerability branch 6 times, most recently from 7ba9de7 to 2bb9660 Compare March 9, 2022 13:49
@renovate renovate bot force-pushed the renovate/npm-node-fetch-vulnerability branch from 2bb9660 to 242acf6 Compare March 15, 2022 04:37
@renovate renovate bot changed the title Update dependency node-fetch [SECURITY] Update dependency node-fetch [SECURITY] - autoclosed May 11, 2022
@renovate renovate bot closed this May 11, 2022
@renovate renovate bot deleted the renovate/npm-node-fetch-vulnerability branch May 11, 2022 20:01
@renovate renovate bot changed the title Update dependency node-fetch [SECURITY] - autoclosed Update dependency node-fetch [SECURITY] May 11, 2022
@renovate renovate bot reopened this May 11, 2022
@renovate renovate bot restored the renovate/npm-node-fetch-vulnerability branch May 11, 2022 21:50
@renovate renovate bot changed the title Update dependency node-fetch [SECURITY] Update dependency node-fetch to 2.6.7 [SECURITY] Sep 25, 2022
@renovate renovate bot changed the title Update dependency node-fetch to 2.6.7 [SECURITY] Update dependency node-fetch to 2.6.7 [SECURITY] - abandoned Mar 24, 2023
@renovate
Copy link
Author

renovate bot commented Mar 24, 2023

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant