-
Notifications
You must be signed in to change notification settings - Fork 9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): update dependency semantic-release to v19 [security] #30
Open
renovate
wants to merge
1
commit into
master
Choose a base branch
from
renovate/npm-semantic-release-vulnerability
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+915
−1,336
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
changed the title
chore(deps): update dependency semantic-release to v19.0.3 [security]
chore(deps): update dependency semantic-release to 19.0.3 [security]
Jun 12, 2022
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
June 19, 2022 19:03
56f8047
to
59d8cc7
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
June 26, 2022 18:22
51aee90
to
479c0dc
Compare
renovate
bot
changed the title
chore(deps): update dependency semantic-release to 19.0.3 [security]
chore(deps): update dependency semantic-release to 19.0.3 [SECURITY]
Jun 27, 2022
renovate
bot
changed the title
chore(deps): update dependency semantic-release to 19.0.3 [SECURITY]
chore(deps): update dependency semantic-release to 19.0.3 [security]
Jun 28, 2022
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
3 times, most recently
from
July 10, 2022 18:06
a43d86e
to
e7349a4
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
July 24, 2022 17:04
688a6bd
to
4b0fe10
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
4 times, most recently
from
July 31, 2022 18:02
0fb575e
to
0cef816
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
from
August 7, 2022 18:17
0cef816
to
91e640a
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
from
August 21, 2022 18:00
91e640a
to
19d2a8e
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
from
August 28, 2022 19:03
19d2a8e
to
745ad29
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
from
September 11, 2022 18:33
745ad29
to
89e4283
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
from
September 18, 2022 19:51
89e4283
to
c293c96
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
from
September 26, 2022 03:16
c293c96
to
51157e3
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
3 times, most recently
from
October 16, 2022 18:08
397f3ec
to
8c9b12e
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
October 23, 2022 21:15
2302eb2
to
cc3f8ea
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
November 6, 2022 18:42
37a96d8
to
904010f
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
March 24, 2024 18:18
549b990
to
171605f
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
March 31, 2024 19:20
029af5c
to
3dd00fe
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
3 times, most recently
from
April 14, 2024 18:07
05c0f47
to
512ac8d
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
April 22, 2024 12:14
0aa509b
to
d7a9732
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
5 times, most recently
from
May 5, 2024 18:12
3be3ea4
to
0639e3f
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
May 12, 2024 19:28
4372c56
to
3aa3974
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
May 26, 2024 20:06
2109ff0
to
aab7126
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
from
June 2, 2024 18:37
aab7126
to
37696a4
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
3 times, most recently
from
June 16, 2024 18:40
9b58ff0
to
fa7916d
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
2 times, most recently
from
June 30, 2024 19:38
25387ec
to
c2a3c0a
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
3 times, most recently
from
July 8, 2024 16:51
bdf2903
to
b14d10d
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
from
July 14, 2024 20:21
b14d10d
to
50e6ef3
Compare
renovate
bot
force-pushed
the
renovate/npm-semantic-release-vulnerability
branch
from
July 14, 2024 21:47
50e6ef3
to
b6f52b2
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
17.4.7
->19.0.3
GitHub Vulnerability Alerts
CVE-2022-31051
Impact
What kind of vulnerability is it? Who is impacted?
Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials.
Patches
Has the problem been patched? What versions should users upgrade to?
Fixed in 19.0.3
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Secrets that do not contain characters that are excluded from encoding with
encodeURI
when included in a URL are already masked properly.References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
Release Notes
semantic-release/semantic-release (semantic-release)
v19.0.3
Compare Source
Bug Fixes
v19.0.2
Compare Source
Bug Fixes
v19.0.1
Compare Source
Bug Fixes
v19.0.0
Compare Source
Bug Fixes
marked
to resolve ReDos vulnerability (#2330) (d9e5bc0)BREAKING CHANGES
@semantic-release/npm
has also dropped support for node v15marked
andmarked-terminal
that resolved the ReDoS vulnerability. removal of support of this node version should be low since it was not an LTS version and has been EOL for several months already.v18.0.1
Compare Source
Bug Fixes
v18.0.0
Compare Source
This is a maintenance release. An increasing amount of dependencies required a node version higher than the Node 10 version supported by
semantic-release@17
. We decided to go straight to a recent Node LTS version because the release build is usually independent of others, requiring a higher node version is less disruptive to users, but helps us reduce the maintenance overhead.If you use GitHub Actions and need to bump the node version set up by
actions/node-setup
, you can useoctoherd-script-bump-node-version-in-workflows
BREAKING CHANGES
node-version: the minimum required version of node is now v14.17
Configuration
📅 Schedule: Branch creation - "" in timezone Asia/Seoul, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.