Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: updates undici to keep up with latest security release #1099

Merged
merged 2 commits into from
Apr 22, 2024

Conversation

asciidisco
Copy link
Collaborator

Updates undici to keep up with latest security related release of the 5.x.x. version branch, see undici release info for more information.

npm audit output:

undici  <=5.28.3
Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline - https://github.com/advisories/GHSA-m4v8-wqvr-p9f7
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - https://github.com/advisories/GHSA-9qxr-qj54-h672

@asciidisco asciidisco added the dependencies Pull requests that update a dependency file label Apr 14, 2024
Copy link
Collaborator

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure why it's not ranged.

package.json Outdated Show resolved Hide resolved
@asciidisco
Copy link
Collaborator Author

@mcollina Thanks. Yeah, as it wasn't ranged I did not want to re-introduce that. I think you pinned it because of the Node 16 compat with this commit

You know unidici way better than I do, but I believe it's semver at the heart, so ranging should be fine.

@mcollina mcollina merged commit e9873db into mercurius-js:master Apr 22, 2024
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants