aaeae8ebcd792103ab34fb8f900ec027d3f4c5cb
7
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 renovate
|
aaeae8ebcd |
chore: bump up stripe version to v15 (#6512)
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [stripe](https://togithub.com/stripe/stripe-node) | [`^14.18.0` -> `^15.0.0`](https://renovatebot.com/diffs/npm/stripe/14.18.0/15.0.0) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>stripe/stripe-node (stripe)</summary> ### [`v15.0.0`](https://togithub.com/stripe/stripe-node/blob/HEAD/CHANGELOG.md#1500---2024-04-10) [Compare Source](https://togithub.com/stripe/stripe-node/compare/v14.25.0...v15.0.0) - [#​2057](https://togithub.com/stripe/stripe-node/pull/2057) - This release changes the pinned API version to `2024-04-10`. Please read the [API Upgrade Guide](https://stripe.com/docs/upgrades#2024-04-10) and carefully review the API changes before upgrading. ##### ⚠️ Breaking changes - Rename event type `InvoiceitemCreatedEvent` to `InvoiceItemCreatedEvent` - Rename event type `InvoiceitemDeletedEvent` to `InvoiceItemDeletedEvent` - Rename `features` to `marketing_features` on `ProductCreateOptions`, `ProductUpdateOptions`, and `Product`. ##### ⚠️ Removal of enum values, properties and events that are no longer part of the publicly documented Stripe API - Remove `subscription_pause` from the below as the feature to pause subscription on the portal has been deprecated. - `BillingPortal.Configuration.Features` - `BillingPortal.ConfigurationCreateParams.Features` - `BillingPortal.ConfigurationUpdateParams.Features` - Remove the below deprecated values for the type `BalanceTransaction.Type` - `obligation_inbound` - `obligation_payout` - `obligation_payout_failure` - `'obligation_reversal_outbound'` - Remove deprecated value `various` for the type `Climate.Supplier.RemovalPathway` - Remove deprecated events - `invoiceitem.updated` - `order.created` - `recipient.created` - `recipient.deleted` - `recipient.updated` - `sku.created` - `sku.deleted` - `sku.updated` - Remove types for the deprecated events - `InvoiceItemUpdatedEvent` - `OrderCreatedEvent` - `RecipientCreatedEvent` - `RecipientDeletedEvent` - `RecipientUpdatedEvent` - `SKUCreatedEvent` - `SKUDeletedEvent` - Remove the deprecated value `include_and_require` for the type`InvoiceCreateParams.PendingInvoiceItemsBehavior` - Remove the deprecated value `service_tax` for the types `TaxRate.TaxType`, `TaxRateCreateParams.TaxType`, `TaxRateUpdateParams.TaxType`, and `InvoiceUpdateLineItemParams.TaxAmount.TaxRateData` - Remove `request_incremental_authorization` from `PaymentIntentCreateParams.PaymentMethodOptions.CardPresent`, `PaymentIntentUpdateParams.PaymentMethodOptions.CardPresent` and `PaymentIntentConfirmParams.PaymentMethodOptions.CardPresent` - Remove support for `id_bank_transfer`, `multibanco`, `netbanking`, `pay_by_bank`, and `upi` on `PaymentMethodConfiguration` - Remove the deprecated value `obligation` for the type `Reporting.ReportRunCreateParams.Parameters.ReportingCategory` - Remove the deprecated value `challenge_only` from the type `SetupIntent.PaymentMethodOptions.Card.RequestThreeDSecure` - Remove the legacy field `rendering_options` in `Invoice`, `InvoiceCreateOptions` and `InvoiceUpdateOptions`. Use `rendering` instead. ### [`v14.25.0`](https://togithub.com/stripe/stripe-node/blob/HEAD/CHANGELOG.md#14250---2024-04-09) [Compare Source](https://togithub.com/stripe/stripe-node/compare/v14.24.0...v14.25.0) - [#​2059](https://togithub.com/stripe/stripe-node/pull/2059) Update generated code - Add support for new resources `Entitlements.ActiveEntitlement` and `Entitlements.Feature` - Add support for `list` and `retrieve` methods on resource `ActiveEntitlement` - Add support for `create`, `list`, `retrieve`, and `update` methods on resource `Feature` - Add support for `controller` on `AccountCreateParams` - Add support for `fees`, `losses`, `requirement_collection`, and `stripe_dashboard` on `Account.controller` - Add support for new value `none` on enum `Account.type` - Add support for `event_name` on `Billing.MeterEventAdjustmentCreateParams` and `Billing.MeterEventAdjustment` - Add support for `cancel` and `type` on `Billing.MeterEventAdjustment` ### [`v14.24.0`](https://togithub.com/stripe/stripe-node/blob/HEAD/CHANGELOG.md#14240---2024-04-04) [Compare Source](https://togithub.com/stripe/stripe-node/compare/v14.23.0...v14.24.0) - [#​2053](https://togithub.com/stripe/stripe-node/pull/2053) Update generated code - Change `Charge.payment_method_details.us_bank_account.payment_reference`, `PaymentIntent.next_action.swish_handle_redirect_or_display_qr_code.hosted_instructions_url`, `PaymentIntent.next_action.swish_handle_redirect_or_display_qr_code.mobile_auth_url`, `PaymentIntent.next_action.swish_handle_redirect_or_display_qr_code.qr_code.data`, `PaymentIntent.next_action.swish_handle_redirect_or_display_qr_code.qr_code.image_url_png`, `PaymentIntent.next_action.swish_handle_redirect_or_display_qr_code.qr_code.image_url_svg`, `PaymentIntent.next_action.swish_handle_redirect_or_display_qr_code.qr_code`, and `PaymentIntent.payment_method_options.swish.reference` to be required - Change type of `Checkout.SessionCreateParams.payment_method_options.swish.reference` from `emptyable(string)` to `string` - Add support for `subscription_item` on `Discount` - Add support for `email` and `phone` on `Identity.VerificationReport`, `Identity.VerificationSession.options`, `Identity.VerificationSession.verified_outputs`, `Identity.VerificationSessionCreateParams.options`, and `Identity.VerificationSessionUpdateParams.options` - Add support for `verification_flow` on `Identity.VerificationReport`, `Identity.VerificationSessionCreateParams`, and `Identity.VerificationSession` - Add support for new value `verification_flow` on enums `Identity.VerificationReport.type` and `Identity.VerificationSession.type` - Add support for `provided_details` on `Identity.VerificationSessionCreateParams`, `Identity.VerificationSessionUpdateParams`, and `Identity.VerificationSession` - Change `Identity.VerificationSessionCreateParams.type` to be optional - Add support for new values `email_unverified_other`, `email_verification_declined`, `phone_unverified_other`, and `phone_verification_declined` on enum `Identity.VerificationSession.last_error.code` - Add support for `promotion_code` on `InvoiceCreateParams.discounts[]`, `InvoiceItemCreateParams.discounts[]`, `InvoiceItemUpdateParams.discounts[]`, `InvoiceUpdateParams.discounts[]`, `QuoteCreateParams.discounts[]`, and `QuoteUpdateParams.discounts[]` - Add support for `discounts` on `InvoiceUpcomingLinesParams.subscription_items[]`, `InvoiceUpcomingParams.subscription_items[]`, `QuoteCreateParams.line_items[]`, `QuoteUpdateParams.line_items[]`, `SubscriptionCreateParams.add_invoice_items[]`, `SubscriptionCreateParams.items[]`, `SubscriptionCreateParams`, `SubscriptionItemCreateParams`, `SubscriptionItemUpdateParams`, `SubscriptionItem`, `SubscriptionSchedule.phases[].add_invoice_items[]`, `SubscriptionSchedule.phases[].items[]`, `SubscriptionSchedule.phases[]`, `SubscriptionScheduleCreateParams.phases[].add_invoice_items[]`, `SubscriptionScheduleCreateParams.phases[].items[]`, `SubscriptionScheduleCreateParams.phases[]`, `SubscriptionScheduleUpdateParams.phases[].add_invoice_items[]`, `SubscriptionScheduleUpdateParams.phases[].items[]`, `SubscriptionScheduleUpdateParams.phases[]`, `SubscriptionUpdateParams.add_invoice_items[]`, `SubscriptionUpdateParams.items[]`, `SubscriptionUpdateParams`, and `Subscription` - Change type of `Invoice.discounts` from `array(expandable(deletable($Discount))) | null` to `array(expandable(deletable($Discount)))` - Add support for `allowed_merchant_countries` and `blocked_merchant_countries` on `Issuing.Card.spending_controls`, `Issuing.CardCreateParams.spending_controls`, `Issuing.CardUpdateParams.spending_controls`, `Issuing.Cardholder.spending_controls`, `Issuing.CardholderCreateParams.spending_controls`, and `Issuing.CardholderUpdateParams.spending_controls` - Add support for `zip` on `PaymentMethodConfigurationCreateParams`, `PaymentMethodConfigurationUpdateParams`, and `PaymentMethodConfiguration` - Add support for `offline` on `SetupAttempt.payment_method_details.card_present` - Add support for `card_present` on `SetupIntent.payment_method_options`, `SetupIntentConfirmParams.payment_method_options`, `SetupIntentCreateParams.payment_method_options`, and `SetupIntentUpdateParams.payment_method_options` - Add support for new value `mobile_phone_reader` on enums `Terminal.Reader.device_type` and `Terminal.ReaderListParams.device_type` ### [`v14.23.0`](https://togithub.com/stripe/stripe-node/blob/HEAD/CHANGELOG.md#14230---2024-03-28) [Compare Source](https://togithub.com/stripe/stripe-node/compare/v14.22.0...v14.23.0) - [#​2046](https://togithub.com/stripe/stripe-node/pull/2046) Update generated code - Add support for new resources `Billing.MeterEventAdjustment`, `Billing.MeterEvent`, and `Billing.Meter` - Add support for `create`, `deactivate`, `list`, `reactivate`, `retrieve`, and `update` methods on resource `Meter` - Add support for `create` method on resources `MeterEventAdjustment` and `MeterEvent` - Add support for `amazon_pay_payments` on `Account.capabilities`, `AccountCreateParams.capabilities`, and `AccountUpdateParams.capabilities` - Add support for new value `verification_failed_representative_authority` on enums `Account.future_requirements.errors[].code`, `Account.requirements.errors[].code`, `BankAccount.future_requirements.errors[].code`, and `BankAccount.requirements.errors[].code` - Add support for `destination_on_behalf_of_charge_management` on `AccountSession.components.payment_details.features`, `AccountSession.components.payments.features`, `AccountSessionCreateParams.components.payment_details.features`, and `AccountSessionCreateParams.components.payments.features` - Add support for `mandate` on `Charge.payment_method_details.us_bank_account`, `Treasury.InboundTransfer.origin_payment_method_details.us_bank_account`, `Treasury.OutboundPayment.destination_payment_method_details.us_bank_account`, and `Treasury.OutboundTransfer.destination_payment_method_details.us_bank_account` - Add support for `second_line` on `Issuing.CardCreateParams` - Add support for `meter` on `PlanCreateParams`, `Plan`, `Price.recurring`, `PriceCreateParams.recurring`, and `PriceListParams.recurring` - [#​2045](https://togithub.com/stripe/stripe-node/pull/2045) esbuild test project fixes ### [`v14.22.0`](https://togithub.com/stripe/stripe-node/blob/HEAD/CHANGELOG.md#14220---2024-03-21) [Compare Source](https://togithub.com/stripe/stripe-node/compare/v14.21.0...v14.22.0) - [#​2040](https://togithub.com/stripe/stripe-node/pull/2040) Update generated code - Add support for new resources `ConfirmationToken` and `Forwarding.Request` - Add support for `retrieve` method on resource `ConfirmationToken` - Add support for `create`, `list`, and `retrieve` methods on resource `Request` - Add support for `mobilepay_payments` on `Account.capabilities`, `AccountCreateParams.capabilities`, and `AccountUpdateParams.capabilities` - Add support for new values `forwarding_api_inactive`, `forwarding_api_invalid_parameter`, `forwarding_api_upstream_connection_error`, and `forwarding_api_upstream_connection_timeout` on enums `Invoice.last_finalization_error.code`, `PaymentIntent.last_payment_error.code`, `SetupAttempt.setup_error.code`, `SetupIntent.last_setup_error.code`, and `StripeError.code` - Add support for `mobilepay` on `Charge.payment_method_details`, `PaymentIntent.payment_method_options`, `PaymentIntentConfirmParams.payment_method_data`, `PaymentIntentConfirmParams.payment_method_options`, `PaymentIntentCreateParams.payment_method_data`, `PaymentIntentCreateParams.payment_method_options`, `PaymentIntentUpdateParams.payment_method_data`, `PaymentIntentUpdateParams.payment_method_options`, `PaymentMethodCreateParams`, `PaymentMethod`, `SetupIntentConfirmParams.payment_method_data`, `SetupIntentCreateParams.payment_method_data`, and `SetupIntentUpdateParams.payment_method_data` - Add support for `payment_reference` on `Charge.payment_method_details.us_bank_account` - Add support for new value `mobilepay` on enums `CustomerListPaymentMethodsParams.type`, `PaymentMethodCreateParams.type`, and `PaymentMethodListParams.type` - Add support for `confirmation_token` on `PaymentIntentConfirmParams`, `PaymentIntentCreateParams`, `SetupIntentConfirmParams`, and `SetupIntentCreateParams` - Add support for new value `mobilepay` on enums `PaymentIntentConfirmParams.payment_method_data.type`, `PaymentIntentCreateParams.payment_method_data.type`, `PaymentIntentUpdateParams.payment_method_data.type`, `SetupIntentConfirmParams.payment_method_data.type`, `SetupIntentCreateParams.payment_method_data.type`, and `SetupIntentUpdateParams.payment_method_data.type` - Add support for new value `mobilepay` on enum `PaymentMethod.type` - Add support for `name` on `Terminal.ConfigurationCreateParams`, `Terminal.ConfigurationUpdateParams`, and `Terminal.Configuration` - Add support for `payout` on `Treasury.ReceivedDebit.linked_flows` - [#​2043](https://togithub.com/stripe/stripe-node/pull/2043) Don't mutate error.type during minification ### [`v14.21.0`](https://togithub.com/stripe/stripe-node/blob/HEAD/CHANGELOG.md#14210---2024-03-14) [Compare Source](https://togithub.com/stripe/stripe-node/compare/v14.20.0...v14.21.0) - [#​2035](https://togithub.com/stripe/stripe-node/pull/2035) Update generated code - Add support for new resources `Issuing.PersonalizationDesign` and `Issuing.PhysicalBundle` - Add support for `create`, `list`, `retrieve`, and `update` methods on resource `PersonalizationDesign` - Add support for `list` and `retrieve` methods on resource `PhysicalBundle` - Add support for `personalization_design` on `Issuing.CardCreateParams`, `Issuing.CardListParams`, `Issuing.CardUpdateParams`, and `Issuing.Card` - Change type of `SubscriptionCreateParams.application_fee_percent` and `SubscriptionUpdateParams.application_fee_percent` from `number` to `emptyStringable(number)` - Add support for `sepa_debit` on `Subscription.payment_settings.payment_method_options`, `SubscriptionCreateParams.payment_settings.payment_method_options`, and `SubscriptionUpdateParams.payment_settings.payment_method_options` ### [`v14.20.0`](https://togithub.com/stripe/stripe-node/blob/HEAD/CHANGELOG.md#14200---2024-03-07) [Compare Source](https://togithub.com/stripe/stripe-node/compare/v14.19.0...v14.20.0) - [#​2033](https://togithub.com/stripe/stripe-node/pull/2033) Update generated code - Add support for `documents` on `AccountSession.components` and `AccountSessionCreateParams.components` - Add support for `request_three_d_secure` on `Checkout.Session.payment_method_options.card` and `Checkout.SessionCreateParams.payment_method_options.card` - Add support for `created` on `CreditNoteListParams` - Add support for `sepa_debit` on `Invoice.payment_settings.payment_method_options`, `InvoiceCreateParams.payment_settings.payment_method_options`, and `InvoiceUpdateParams.payment_settings.payment_method_options` ### [`v14.19.0`](https://togithub.com/stripe/stripe-node/blob/HEAD/CHANGELOG.md#14190---2024-02-29) [Compare Source](https://togithub.com/stripe/stripe-node/compare/v14.18.0...v14.19.0) - [#​2029](https://togithub.com/stripe/stripe-node/pull/2029) Update generated code - Change `Identity.VerificationReport.type`, `SubscriptionSchedule.default_settings.invoice_settings.account_tax_ids`, `SubscriptionSchedule.phases[].invoice_settings.account_tax_ids`, and `TaxId.owner` to be required - Change type of `Identity.VerificationSession.type` from `enum('document'|'id_number') | null` to `enum('document'|'id_number')` - Add support for `number` on `InvoiceCreateParams` and `InvoiceUpdateParams` - Add support for `enable_customer_cancellation` on `Terminal.Reader.action.process_payment_intent.process_config`, `Terminal.Reader.action.process_setup_intent.process_config`, `Terminal.ReaderProcessPaymentIntentParams.process_config`, and `Terminal.ReaderProcessSetupIntentParams.process_config` - Add support for `refund_payment_config` on `Terminal.Reader.action.refund_payment` and `Terminal.ReaderRefundPaymentParams` - Add support for `payment_method` on `TokenCreateParams.bank_account` - [#​2027](https://togithub.com/stripe/stripe-node/pull/2027) vscode settings: true -> "explicit" </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=--> |
||
|
renovate
|
891ab6ab51 |
chore: bump up style-loader version to v4 (#6490)
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [style-loader](https://togithub.com/webpack-contrib/style-loader) | [`^3.3.4` -> `^4.0.0`](https://renovatebot.com/diffs/npm/style-loader/3.3.4/4.0.0) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>webpack-contrib/style-loader (style-loader)</summary> ### [`v4.0.0`](https://togithub.com/webpack-contrib/style-loader/blob/HEAD/CHANGELOG.md#400-2024-04-08) [Compare Source](https://togithub.com/webpack-contrib/style-loader/compare/v3.3.4...v4.0.0) ##### ⚠ BREAKING CHANGES - minimum supported webpack version is `5.27.0` - minimum support Node.js version is `18.12.0` - the `insert` option can only be a selector or the path to the module Migration: Before: **webpack.config.js** ```js module.exports = { module: { rules: [ { test: /\.css$/i, use: [ { loader: "style-loader", options: { injectType: "styleTag", styleTagTransform: function (css, style) { // Do something ... style.innerHTML = `${css}.modify{}\n`; document.head.appendChild(style); }, }, }, "css-loader", ], }, ], }, }; ``` After: **insert-function.js** ```js function insert(css, style) { var parent = options.target || document.head; parent.appendChild(element); } module.exports = insert; ``` **webpack.config.js** ```js module.exports = { module: { rules: [ { test: /\.css$/i, use: [ { loader: "style-loader", options: { insert: require.resolve("./insert.js"), }, }, "css-loader", ], }, ], }, }; ``` - the `styleTagTransform` option can only be the path to the module Migration: Before: **webpack.config.js** ```js module.exports = { module: { rules: [ { test: /\.css$/i, use: [ { loader: "style-loader", options: { injectType: "styleTag", styleTagTransform: function (css, style) { // Do something ... style.innerHTML = `${css}.modify{}\n`; document.head.appendChild(style); }, }, }, "css-loader", ], }, ], }, }; ``` After: **style-tag-transform-function.js** ```js function styleTagTransform(css, style) { // Do something ... style.innerHTML = `${css}.modify{}\n`; document.head.appendChild(style); } module.exports = styleTagTransform; ``` **webpack.config.js** ```js module.exports = { module: { rules: [ { test: /\.css$/i, use: [ { loader: "style-loader", options: { styleTagTransform: require.resolve("./style-tag-transform-function.js"), }, }, "css-loader", ], }, ], }, }; ``` ##### Bug Fixes - css experiments logic ([#​617](https://togithub.com/webpack-contrib/style-loader/issues/617)) ([8b9fc97](https://togithub.com/webpack-contrib/style-loader/commit/8b9fc976628341d3e33b77b5eb4b6ebad009fd19)) ##### [3.3.3](https://togithub.com/webpack-contrib/style-loader/compare/v3.3.2...v3.3.3) (2023-05-19) ##### Bug Fixes - compatibility with built-in CSS support ([#​605](https://togithub.com/webpack-contrib/style-loader/issues/605)) ([9636f58](https://togithub.com/webpack-contrib/style-loader/commit/9636f5805407734f587a87e69dd048e5cc7f1021)) ##### [3.3.2](https://togithub.com/webpack-contrib/style-loader/compare/v3.3.1...v3.3.2) (2023-03-13) ##### Bug Fixes - noop in environment without DOM API ([#​597](https://togithub.com/webpack-contrib/style-loader/issues/597)) ([03d3df3](https://togithub.com/webpack-contrib/style-loader/commit/03d3df3c363484c18a1e9a5e468a7600ea1322f3)) ##### [3.3.1](https://togithub.com/webpack-contrib/style-loader/compare/v3.3.0...v3.3.1) (2021-10-21) ##### Bug Fixes - small perf improvement ([#​544](https://togithub.com/webpack-contrib/style-loader/issues/544)) ([610524e](https://togithub.com/webpack-contrib/style-loader/commit/610524ef6266c27e147d3c0003e7825b08f17454)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=--> |
||
|
renovate
|
f590d84711 |
chore: bump up vite version to v5.0.13 [SECURITY] (#6455)
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [vite](https://vitejs.dev) ([source](https://togithub.com/vitejs/vite/tree/HEAD/packages/vite)) | [`5.0.12` -> `5.0.13`](https://renovatebot.com/diffs/npm/vite/5.0.12/5.0.13) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-31207](https://togithub.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g) ### Summary [Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`. ### Impact Only apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected. ### Patches Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18 ### Details `server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug ([https://github.com/micromatch/picomatch/issues/89](https://togithub.com/micromatch/picomatch/issues/89)). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined. **Reproduction** Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`. * with `matchBase: true`, you can get any file under `.git/` (config, HEAD, etc). * with `matchBase: false`, you cannot get any file under `.git/` (config, HEAD, etc). --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v5.0.13`](https://togithub.com/vitejs/vite/releases/tag/v5.0.13) [Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.12...v5.0.13) Please refer to [CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md) for details. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=--> |
||
|
renovate
|
4736776ae9 |
chore: bump up jotai-effect version to v1 (#6472)
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [jotai-effect](https://togithub.com/jotaijs/jotai-effect) | [`^0.6.0` -> `^1.0.0`](https://renovatebot.com/diffs/npm/jotai-effect/0.6.0/1.0.0) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>jotaijs/jotai-effect (jotai-effect)</summary> ### [`v1.0.0`](https://togithub.com/jotaijs/jotai-effect/releases/tag/v1.0.0) [Compare Source](https://togithub.com/jotaijs/jotai-effect/compare/v0.6.0...v1.0.0) I am thrilled to announce the release of Jotai Effect version 1.0! This milestone represents a significant achievement marking its readiness for production use. Jotai Effect was started last October with the aim of providing a utility package for reactive side effects within the Jotai ecosystem. Over the past six months, I have been closely monitoring the API's stability and its effectiveness in real-world applications. For those eagerly waiting for Jotai to be considered production-ready, the moment has finally arrived. The feedback from our community has been overwhelmingly positive, and today, I'm confident that Jotai Effect is ready for its prime time. I couldn't have reached this point without the help of our amazing contributors, Daishi Kato ([@​dai-shi](https://togithub.com/dai-shi)) and Alex Yang ([@​himself65](https://togithub.com/himself65)). Their early contributions were pivotal in honing the library to what it is today. Additionally, I want to extend my gratitude to our vibrant community on [Discord](https://discord.com/invite/poimandres) for their continuous support and feedback. Thank you. As we celebrate this release, I encourage you to explore [Jotai Effect](https://jotai.org/docs/extensions/effect) and discover how it can streamline your reactive programming workflows. Happy Coding! Best regards, David Maskasky *The full discussion can be viewed [here](https://togithub.com/jotaijs/jotai-effect/discussions/34).* </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=--> |
||
|
renovate
|
4351dc8541 |
chore: bump up css-loader version to v7 (#6458)
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [css-loader](https://togithub.com/webpack-contrib/css-loader) | [`^6.10.0` -> `^7.0.0`](https://renovatebot.com/diffs/npm/css-loader/6.10.0/7.0.0) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>webpack-contrib/css-loader (css-loader)</summary> ### [`v7.0.0`](https://togithub.com/webpack-contrib/css-loader/blob/HEAD/CHANGELOG.md#700-2024-04-04) [Compare Source](https://togithub.com/webpack-contrib/css-loader/compare/v6.11.0...v7.0.0) ##### ⚠ BREAKING CHANGES - The `modules.namedExport` option is `true` by default if you enable the `esModule` option Migration guide: Before: ```js import style from "./style.css"; console.log(style.myClass); ``` After: ```js import * as style from "./style.css"; console.log(style.myClass); ``` - The `modules.exportLocalsConvention` has the value `as-is` when the `modules.namedExport` option is `true` and you don't specify a value - Minimum supported webpack version is `5.27.0` - Minimum supported Node.js version is `18.12.0` ##### Features - The `modules.namedExports` option works fine with any `modules.exportLocalsConvention` values ([f96a110](https://togithub.com/webpack-contrib/css-loader/commit/f96a11007da55a632de7f58167895e1b5814d717)) - Added dashed variants for the `modules.exportLocalsConvention` options ([40e1668](https://togithub.com/webpack-contrib/css-loader/commit/40e1668b8366f0df63343efe706ba848c2b5dfb2)) ### [`v6.11.0`](https://togithub.com/webpack-contrib/css-loader/blob/HEAD/CHANGELOG.md#6110-2024-04-03) [Compare Source](https://togithub.com/webpack-contrib/css-loader/compare/v6.10.0...v6.11.0) ##### Features - supports multiple composes ([#​1582](https://togithub.com/webpack-contrib/css-loader/issues/1582)) ([bbca614](https://togithub.com/webpack-contrib/css-loader/commit/bbca61411dc5f82964653a6d1aa27854519b743d)) ##### Bug Fixes - do not break `@scope` at-rule without params ([#​1581](https://togithub.com/webpack-contrib/css-loader/issues/1581)) ([e022e3b](https://togithub.com/webpack-contrib/css-loader/commit/e022e3bb405472ac7d51ff1114783fc2811dfe04)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=--> |
||
|
renovate
|
39c90a4428 |
chore: bump up undici version to v6.11.1 [SECURITY] (#6457)
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [undici](https://undici.nodejs.org) ([source](https://togithub.com/nodejs/undici)) | [`6.6.2` -> `6.11.1`](https://renovatebot.com/diffs/npm/undici/6.6.2/6.11.1) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-30260](https://togithub.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7) ### Impact Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. ### Patches This has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75. Fixes has been released in v5.28.4 and v6.11.1. ### Workarounds use `fetch()` or disable `maxRedirections`. ### References Linzi Shang reported this. * https://hackerone.com/reports/2408074 * https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3 #### [CVE-2024-30261](https://togithub.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672) ### Impact If an attacker can alter the `integrity` option passed to `fetch()`, they can let `fetch()` accept requests as valid even if they have been tampered. ### Patches Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1. ### Workarounds Ensure that `integrity` cannot be tampered with. ### References https://hackerone.com/reports/2377760 --- ### Release Notes <details> <summary>nodejs/undici (undici)</summary> ### [`v6.11.1`](https://togithub.com/nodejs/undici/compare/v6.11.0...6df3c738d03dc4014a26640316bf699950d62024) [Compare Source](https://togithub.com/nodejs/undici/compare/v6.11.0...v6.11.1) ### [`v6.11.0`](https://togithub.com/nodejs/undici/compare/v6.10.2...ee5f892f3955eaca37730ed30349153ba203e9cd) [Compare Source](https://togithub.com/nodejs/undici/compare/v6.10.2...v6.11.0) ### [`v6.10.2`](https://togithub.com/nodejs/undici/releases/tag/v6.10.2) [Compare Source](https://togithub.com/nodejs/undici/compare/v6.10.1...v6.10.2) ##### What's Changed - Do not fail test if streams support typed arrays by [@​mcollina](https://togithub.com/mcollina) in [https://github.com/nodejs/undici/pull/2978](https://togithub.com/nodejs/undici/pull/2978) - fix(fetch): properly redirect non-ascii location header url by [@​Xvezda](https://togithub.com/Xvezda) in [https://github.com/nodejs/undici/pull/2971](https://togithub.com/nodejs/undici/pull/2971) - perf: Remove double-stringify in setCookie by [@​peterver](https://togithub.com/peterver) in [https://github.com/nodejs/undici/pull/2980](https://togithub.com/nodejs/undici/pull/2980) - \[fix [#​2982](https://togithub.com/nodejs/undici/issues/2982)] use DispatcherInterceptor type for Dispatcher#Compose by [@​clovis-guillemot](https://togithub.com/clovis-guillemot) in [https://github.com/nodejs/undici/pull/2983](https://togithub.com/nodejs/undici/pull/2983) - fix: make EventSource properties enumerable by [@​MattBidewell](https://togithub.com/MattBidewell) in [https://github.com/nodejs/undici/pull/2987](https://togithub.com/nodejs/undici/pull/2987) - docs: ✏️ fixed benchmark links by [@​benhalverson](https://togithub.com/benhalverson) in [https://github.com/nodejs/undici/pull/2991](https://togithub.com/nodejs/undici/pull/2991) - fix([#​2986](https://togithub.com/nodejs/undici/issues/2986)): bad start check by [@​metcoder95](https://togithub.com/metcoder95) in [https://github.com/nodejs/undici/pull/2992](https://togithub.com/nodejs/undici/pull/2992) - fix(H2 Client): bind stream 'data' listener only after received 'response' event by [@​St3ffGv4](https://togithub.com/St3ffGv4) in [https://github.com/nodejs/undici/pull/2985](https://togithub.com/nodejs/undici/pull/2985) - feat: added search input by [@​benhalverson](https://togithub.com/benhalverson) in [https://github.com/nodejs/undici/pull/2993](https://togithub.com/nodejs/undici/pull/2993) - chore: validate responses can be consumed without a Content-Length or… by [@​jacob-ebey](https://togithub.com/jacob-ebey) in [https://github.com/nodejs/undici/pull/2995](https://togithub.com/nodejs/undici/pull/2995) - fix error message by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2998](https://togithub.com/nodejs/undici/pull/2998) - Revert "perf: reuse TextDecoder instance ([#​2863](https://togithub.com/nodejs/undici/issues/2863))" by [@​panva](https://togithub.com/panva) in [https://github.com/nodejs/undici/pull/2999](https://togithub.com/nodejs/undici/pull/2999) - test: remove only by [@​metcoder95](https://togithub.com/metcoder95) in [https://github.com/nodejs/undici/pull/3001](https://togithub.com/nodejs/undici/pull/3001) ##### New Contributors - [@​Xvezda](https://togithub.com/Xvezda) made their first contribution in [https://github.com/nodejs/undici/pull/2971](https://togithub.com/nodejs/undici/pull/2971) - [@​peterver](https://togithub.com/peterver) made their first contribution in [https://github.com/nodejs/undici/pull/2980](https://togithub.com/nodejs/undici/pull/2980) - [@​clovis-guillemot](https://togithub.com/clovis-guillemot) made their first contribution in [https://github.com/nodejs/undici/pull/2983](https://togithub.com/nodejs/undici/pull/2983) - [@​MattBidewell](https://togithub.com/MattBidewell) made their first contribution in [https://github.com/nodejs/undici/pull/2987](https://togithub.com/nodejs/undici/pull/2987) - [@​benhalverson](https://togithub.com/benhalverson) made their first contribution in [https://github.com/nodejs/undici/pull/2991](https://togithub.com/nodejs/undici/pull/2991) - [@​St3ffGv4](https://togithub.com/St3ffGv4) made their first contribution in [https://github.com/nodejs/undici/pull/2985](https://togithub.com/nodejs/undici/pull/2985) - [@​jacob-ebey](https://togithub.com/jacob-ebey) made their first contribution in [https://github.com/nodejs/undici/pull/2995](https://togithub.com/nodejs/undici/pull/2995) **Full Changelog**: https://github.com/nodejs/undici/compare/v6.10.0...v6.10.2 ### [`v6.10.1`](https://togithub.com/nodejs/undici/compare/v6.10.0...dd3918fee4f90e02fb93ff1bc04e707144041938) [Compare Source](https://togithub.com/nodejs/undici/compare/v6.10.0...v6.10.1) ### [`v6.10.0`](https://togithub.com/nodejs/undici/releases/tag/v6.10.0) [Compare Source](https://togithub.com/nodejs/undici/compare/v6.9.0...v6.10.0) #### What's Changed - test: fix flakyness of issue-803 test by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2960](https://togithub.com/nodejs/undici/pull/2960) - Cleanup format by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2959](https://togithub.com/nodejs/undici/pull/2959) - Chore: run tests daily against node nightly by [@​mweberxyz](https://togithub.com/mweberxyz) in [https://github.com/nodejs/undici/pull/2969](https://togithub.com/nodejs/undici/pull/2969) - fix: fix retry handler option by [@​acommodari](https://togithub.com/acommodari) in [https://github.com/nodejs/undici/pull/2962](https://togithub.com/nodejs/undici/pull/2962) - build(deps): bump node from `4999fa1` to `577f8eb` in /build by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2974](https://togithub.com/nodejs/undici/pull/2974) - feat(TS): add types for composed dispatchers by [@​metcoder95](https://togithub.com/metcoder95) in [https://github.com/nodejs/undici/pull/2967](https://togithub.com/nodejs/undici/pull/2967) - fix: count for error response and network errors by [@​metcoder95](https://togithub.com/metcoder95) in [https://github.com/nodejs/undici/pull/2966](https://togithub.com/nodejs/undici/pull/2966) #### New Contributors - [@​mweberxyz](https://togithub.com/mweberxyz) made their first contribution in [https://github.com/nodejs/undici/pull/2969](https://togithub.com/nodejs/undici/pull/2969) - [@​acommodari](https://togithub.com/acommodari) made their first contribution in [https://github.com/nodejs/undici/pull/2962](https://togithub.com/nodejs/undici/pull/2962) **Full Changelog**: https://github.com/nodejs/undici/compare/v6.9.0...v6.10.0 ### [`v6.9.0`](https://togithub.com/nodejs/undici/releases/tag/v6.9.0) [Compare Source](https://togithub.com/nodejs/undici/compare/v6.8.0...v6.9.0) #### What's Changed - feat: add new dispatch compose by [@​metcoder95](https://togithub.com/metcoder95) in [https://github.com/nodejs/undici/pull/2826](https://togithub.com/nodejs/undici/pull/2826) - ci: add macos-latest to test-matrix by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2952](https://togithub.com/nodejs/undici/pull/2952) - types: align RequestInit.body type with lib.dom.ts by [@​jdufresne](https://togithub.com/jdufresne) in [https://github.com/nodejs/undici/pull/2956](https://togithub.com/nodejs/undici/pull/2956) - ci: pin versions of github actions by [@​UlisesGascon](https://togithub.com/UlisesGascon) in [https://github.com/nodejs/undici/pull/2957](https://togithub.com/nodejs/undici/pull/2957) - fetch: improve output for FormData, Response, Request by [@​mertcanaltin](https://togithub.com/mertcanaltin) in [https://github.com/nodejs/undici/pull/2955](https://togithub.com/nodejs/undici/pull/2955) - perf: optimize collectASequenceOfBytes by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2958](https://togithub.com/nodejs/undici/pull/2958) #### New Contributors - [@​jdufresne](https://togithub.com/jdufresne) made their first contribution in [https://github.com/nodejs/undici/pull/2956](https://togithub.com/nodejs/undici/pull/2956) - [@​UlisesGascon](https://togithub.com/UlisesGascon) made their first contribution in [https://github.com/nodejs/undici/pull/2957](https://togithub.com/nodejs/undici/pull/2957) **Full Changelog**: https://github.com/nodejs/undici/compare/v6.8.0...v6.9.0 ### [`v6.8.0`](https://togithub.com/nodejs/undici/releases/tag/v6.8.0) [Compare Source](https://togithub.com/nodejs/undici/compare/v6.7.1...v6.8.0) #### What's Changed - fix: send correct SNI for proxy connections by [@​chrros95](https://togithub.com/chrros95) in [https://github.com/nodejs/undici/pull/2939](https://togithub.com/nodejs/undici/pull/2939) - build(deps): bump node from `8bf9240` to `7bfef1d` in /build by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2937](https://togithub.com/nodejs/undici/pull/2937) - fetch: improve util.inspect output for web specifications by [@​mertcanaltin](https://togithub.com/mertcanaltin) in [https://github.com/nodejs/undici/pull/2938](https://togithub.com/nodejs/undici/pull/2938) - ci: fix broken ci on windows and node v21 because of libuv bug by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2941](https://togithub.com/nodejs/undici/pull/2941) - perf: improve getResolveErrorBodyCallback by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2940](https://togithub.com/nodejs/undici/pull/2940) - fix: don't assign kAgent twice by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2942](https://togithub.com/nodejs/undici/pull/2942) - perf: dump immediatly if known size exceeds limit by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2882](https://togithub.com/nodejs/undici/pull/2882) - build(deps): bump node from `7bfef1d` to `4999fa1` in /build by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2946](https://togithub.com/nodejs/undici/pull/2946) - try to fix windows failure by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2950](https://togithub.com/nodejs/undici/pull/2950) - perf: improve parsing form-data by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2944](https://togithub.com/nodejs/undici/pull/2944) #### New Contributors - [@​chrros95](https://togithub.com/chrros95) made their first contribution in [https://github.com/nodejs/undici/pull/2939](https://togithub.com/nodejs/undici/pull/2939) **Full Changelog**: https://github.com/nodejs/undici/compare/v6.7.1...v6.8.0 ### [`v6.7.1`](https://togithub.com/nodejs/undici/releases/tag/v6.7.1) [Compare Source](https://togithub.com/nodejs/undici/compare/v6.7.0...v6.7.1) #### What's Changed - fetch: use EOL of os-module by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2915](https://togithub.com/nodejs/undici/pull/2915) - ci: only send codecov from ubuntu and node by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2914](https://togithub.com/nodejs/undici/pull/2914) - tests: improve skip for unix.js tests, remove skipped tests by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2916](https://togithub.com/nodejs/undici/pull/2916) - chore: fix typo in isHistoryNavigation comments by [@​kachick](https://togithub.com/kachick) in [https://github.com/nodejs/undici/pull/2920](https://togithub.com/nodejs/undici/pull/2920) - fix(benchmark): set body correctly by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2918](https://togithub.com/nodejs/undici/pull/2918) - chore: increase test coverage to 100% for /lib/api/api-request.js by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2912](https://togithub.com/nodejs/undici/pull/2912) - fix: chunksDecode cuts off 3 characters at the end if having BOM by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2922](https://togithub.com/nodejs/undici/pull/2922) - docs: clarify URI parsing behavior of ProxyAgent constructor by [@​rossilor95](https://togithub.com/rossilor95) in [https://github.com/nodejs/undici/pull/2893](https://togithub.com/nodejs/undici/pull/2893) - implement sync formdata parser by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2911](https://togithub.com/nodejs/undici/pull/2911) - Fix docs links and add examples to sidebar by [@​tastypackets](https://togithub.com/tastypackets) in [https://github.com/nodejs/undici/pull/2895](https://togithub.com/nodejs/undici/pull/2895) - doc: update diagnostics channel request headers type change by [@​jessezhang91](https://togithub.com/jessezhang91) in [https://github.com/nodejs/undici/pull/2925](https://togithub.com/nodejs/undici/pull/2925) - perf: optimize getResolveErrorBodyCallback by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2921](https://togithub.com/nodejs/undici/pull/2921) - override request dispatcher from init by [@​matthieusieben](https://togithub.com/matthieusieben) in [https://github.com/nodejs/undici/pull/2928](https://togithub.com/nodejs/undici/pull/2928) - add busboy tests by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2924](https://togithub.com/nodejs/undici/pull/2924) - fix(benchmark): make it fair by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2929](https://togithub.com/nodejs/undici/pull/2929) - Revert "chore: remove no-simd wasm" by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2935](https://togithub.com/nodejs/undici/pull/2935) - build(deps): bump node from `d3271e4` to `8bf9240` in /build by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2936](https://togithub.com/nodejs/undici/pull/2936) - Flip link between docs and README by [@​mcollina](https://togithub.com/mcollina) in [https://github.com/nodejs/undici/pull/2933](https://togithub.com/nodejs/undici/pull/2933) #### New Contributors - [@​kachick](https://togithub.com/kachick) made their first contribution in [https://github.com/nodejs/undici/pull/2920](https://togithub.com/nodejs/undici/pull/2920) - [@​tastypackets](https://togithub.com/tastypackets) made their first contribution in [https://github.com/nodejs/undici/pull/2895](https://togithub.com/nodejs/undici/pull/2895) - [@​jessezhang91](https://togithub.com/jessezhang91) made their first contribution in [https://github.com/nodejs/undici/pull/2925](https://togithub.com/nodejs/undici/pull/2925) - [@​matthieusieben](https://togithub.com/matthieusieben) made their first contribution in [https://github.com/nodejs/undici/pull/2928](https://togithub.com/nodejs/undici/pull/2928) **Full Changelog**: https://github.com/nodejs/undici/compare/v6.7.0...v6.7.1 ### [`v6.7.0`](https://togithub.com/nodejs/undici/releases/tag/v6.7.0) [Compare Source](https://togithub.com/nodejs/undici/compare/v6.6.2...v6.7.0) #### What's Changed - test: remove t.diagnostics() calls in push-dont-push.js test by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2715](https://togithub.com/nodejs/undici/pull/2715) - fix: fix flaky debug test by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2714](https://togithub.com/nodejs/undici/pull/2714) - fix: HTTP2 tweaks by [@​metcoder95](https://togithub.com/metcoder95) in [https://github.com/nodejs/undici/pull/2711](https://togithub.com/nodejs/undici/pull/2711) - test: improve cookie tests by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2693](https://togithub.com/nodejs/undici/pull/2693) - test: response.url after redirect is set to target url by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2716](https://togithub.com/nodejs/undici/pull/2716) - chore: remove mocha and chai by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2696](https://togithub.com/nodejs/undici/pull/2696) - test: replace t.pass with t.ok by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2721](https://togithub.com/nodejs/undici/pull/2721) - perf: remove redundant operation in FormData by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2726](https://togithub.com/nodejs/undici/pull/2726) - Add support for passing iterable objects as headers by [@​JaoodxD](https://togithub.com/JaoodxD) in [https://github.com/nodejs/undici/pull/2708](https://togithub.com/nodejs/undici/pull/2708) - chore: refine esbuild & node detection by [@​mochaaP](https://togithub.com/mochaaP) in [https://github.com/nodejs/undici/pull/2677](https://togithub.com/nodejs/undici/pull/2677) - chore: rephrase some comments by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2717](https://togithub.com/nodejs/undici/pull/2717) - test: replace t.type with t.ok and instanceof by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2720](https://togithub.com/nodejs/undici/pull/2720) - remove useless options in web streams by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2729](https://togithub.com/nodejs/undici/pull/2729) - Let's add superagent to the benchmark. closes [#​2730](https://togithub.com/nodejs/undici/issues/2730) by [@​eddienubes](https://togithub.com/eddienubes) in [https://github.com/nodejs/undici/pull/2731](https://togithub.com/nodejs/undici/pull/2731) - convert node build to latin1 by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2673](https://togithub.com/nodejs/undici/pull/2673) - simplify formData body parsing by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2735](https://togithub.com/nodejs/undici/pull/2735) - chore: migrate a batch of tests to node test runner no. 1 by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2719](https://togithub.com/nodejs/undici/pull/2719) - chore: migrate a batch of tests to node test runner no. 2 by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2737](https://togithub.com/nodejs/undici/pull/2737) - chore: migrate a batch of tests to node test runner no. 4 by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2739](https://togithub.com/nodejs/undici/pull/2739) - chore: migrate a batch of tests to node test runner no. 5 by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2740](https://togithub.com/nodejs/undici/pull/2740) - chore: migrate a batch of tests to node test runner no. 3 by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2738](https://togithub.com/nodejs/undici/pull/2738) - chore: migrate a batch of tests to node test runner no. 6 by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2741](https://togithub.com/nodejs/undici/pull/2741) - chore: migrate a batch of tests to node test runner no. 8 by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2744](https://togithub.com/nodejs/undici/pull/2744) - chore: migrate a batch of tests to node test runner no. 7 by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2742](https://togithub.com/nodejs/undici/pull/2742) - build(deps-dev): bump cronometro from 2.0.2 to 3.0.1 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2749](https://togithub.com/nodejs/undici/pull/2749) - perf: always use the same prototype Iterator by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2743](https://togithub.com/nodejs/undici/pull/2743) - chore: migrate a batch of tests to node test runner no. 9, remove tap by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2746](https://togithub.com/nodejs/undici/pull/2746) - chore: remove usage of http-errors in proxy example by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2753](https://togithub.com/nodejs/undici/pull/2753) - fix: dont ship wasm files of llhttp via npm by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2752](https://togithub.com/nodejs/undici/pull/2752) - fix: handle request body as late as possible by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2734](https://togithub.com/nodejs/undici/pull/2734) - perf(tree): avoid recursive calls by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2755](https://togithub.com/nodejs/undici/pull/2755) - docs: fix favicon by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2758](https://togithub.com/nodejs/undici/pull/2758) - chore: use mermaid engine and mermaid in markdown by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2759](https://togithub.com/nodejs/undici/pull/2759) - chore: remove sinon dev dependency by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2767](https://togithub.com/nodejs/undici/pull/2767) - tests: skip test/node-test/debug on node 21.6.2 and windows by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2765](https://togithub.com/nodejs/undici/pull/2765) - chore: improve usage of skip in tests by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2761](https://togithub.com/nodejs/undici/pull/2761) - feat: improve mock error breadcrumbs by [@​rossilor95](https://togithub.com/rossilor95) in [https://github.com/nodejs/undici/pull/2774](https://togithub.com/nodejs/undici/pull/2774) - expose MessageEvent in fetch bundle by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2770](https://togithub.com/nodejs/undici/pull/2770) - test: always exit with 0 when running in Node's Daily WPT Report CI job by [@​panva](https://togithub.com/panva) in [https://github.com/nodejs/undici/pull/2778](https://togithub.com/nodejs/undici/pull/2778) - fix: add node prefix for util to fix issue in env with min version node 18 by [@​riderx](https://togithub.com/riderx) in [https://github.com/nodejs/undici/pull/2775](https://togithub.com/nodejs/undici/pull/2775) - perf: improve perf of parseRawHeaders by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2781](https://togithub.com/nodejs/undici/pull/2781) - fix: make mock-agent.js test more resilient by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2780](https://togithub.com/nodejs/undici/pull/2780) - chore: make some test run even without internet connection by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2786](https://togithub.com/nodejs/undici/pull/2786) - mock: improve validateReplyParameters by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2783](https://togithub.com/nodejs/undici/pull/2783) - perf: improve TernarySearchTree by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2782](https://togithub.com/nodejs/undici/pull/2782) - fix: convert HeadersInit to sequence/dictionary correctly by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2784](https://togithub.com/nodejs/undici/pull/2784) - chore: improve getFieldValue by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2785](https://togithub.com/nodejs/undici/pull/2785) - Add RetryHandler to sidebar by [@​mcollina](https://togithub.com/mcollina) in [https://github.com/nodejs/undici/pull/2797](https://togithub.com/nodejs/undici/pull/2797) - Add RetryAgent by [@​mcollina](https://togithub.com/mcollina) in [https://github.com/nodejs/undici/pull/2798](https://togithub.com/nodejs/undici/pull/2798) - build(deps): bump step-security/harden-runner from 2.6.0 to 2.7.0 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2690](https://togithub.com/nodejs/undici/pull/2690) - build(deps): bump actions/checkout from 4.1.0 to 4.1.1 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2393](https://togithub.com/nodejs/undici/pull/2393) - build(deps): bump actions/upload-artifact from 3.1.3 to 4.3.1 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2799](https://togithub.com/nodejs/undici/pull/2799) - build(deps): bump node from 20-alpine to 21-alpine in /build by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2803](https://togithub.com/nodejs/undici/pull/2803) - perf: improve sort algorithm by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2756](https://togithub.com/nodejs/undici/pull/2756) - refactor: move web stuff into their own folder by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2793](https://togithub.com/nodejs/undici/pull/2793) - `s/ dispactgher/dispatcher/` by [@​steveluscher](https://togithub.com/steveluscher) in [https://github.com/nodejs/undici/pull/2807](https://togithub.com/nodejs/undici/pull/2807) - Use paralellelRequests instead of connections to calculate req/sec in benchmarks by [@​mcollina](https://togithub.com/mcollina) in [https://github.com/nodejs/undici/pull/2800](https://togithub.com/nodejs/undici/pull/2800) - Split out documentation into separate directory by [@​Ethan-Arrowood](https://togithub.com/Ethan-Arrowood) in [https://github.com/nodejs/undici/pull/2788](https://togithub.com/nodejs/undici/pull/2788) - build(deps): bump fastify/github-action-merge-dependabot from 3.9.1 to 3.10.1 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2820](https://togithub.com/nodejs/undici/pull/2820) - build(deps): bump actions/dependency-review-action from 4.0.0 to 4.1.3 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2821](https://togithub.com/nodejs/undici/pull/2821) - build(deps): bump github/codeql-action from 3.23.2 to 3.24.4 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2818](https://togithub.com/nodejs/undici/pull/2818) - build(deps): bump actions/setup-node from 4.0.1 to 4.0.2 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2819](https://togithub.com/nodejs/undici/pull/2819) - fix: move CNAME and .nojekyll to root by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2822](https://togithub.com/nodejs/undici/pull/2822) - remove all fetchParam event handlers by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2823](https://togithub.com/nodejs/undici/pull/2823) - feat: refactor ProxyAgent constructor to also accept single URL argument by [@​rossilor95](https://togithub.com/rossilor95) in [https://github.com/nodejs/undici/pull/2810](https://togithub.com/nodejs/undici/pull/2810) - fix: isCTLExcludingHtab by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2790](https://togithub.com/nodejs/undici/pull/2790) - refactor: move files into logical folders by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2813](https://togithub.com/nodejs/undici/pull/2813) - refactor: move fixed-queeu to dispatcher and rm node folder by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2827](https://togithub.com/nodejs/undici/pull/2827) - chore: create package.json in benchmarks by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2766](https://togithub.com/nodejs/undici/pull/2766) - build(deps): bump github/codeql-action from 3.24.4 to 3.24.5 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2829](https://togithub.com/nodejs/undici/pull/2829) - chore: use lts for pubish types workflow by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2830](https://togithub.com/nodejs/undici/pull/2830) - add dispatcher option to Request by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2831](https://togithub.com/nodejs/undici/pull/2831) - fix url referrer wpt by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2832](https://togithub.com/nodejs/undici/pull/2832) - refactor: remove own sort logic by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2834](https://togithub.com/nodejs/undici/pull/2834) - fix(fetch): prevent crash when `fetch` is aborted with `null` as the `AbortSignal's` `reason` by [@​steveluscher](https://togithub.com/steveluscher) in [https://github.com/nodejs/undici/pull/2833](https://togithub.com/nodejs/undici/pull/2833) - refactor: avoid http2 dynamic dispatch in socket handlers by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2839](https://togithub.com/nodejs/undici/pull/2839) - build(deps-dev): bump proxy from 1.0.2 to 2.1.1 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2137](https://togithub.com/nodejs/undici/pull/2137) - perf(tree): reduce overhead of build TernarySearchTree by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2840](https://togithub.com/nodejs/undici/pull/2840) - webidl: implement resizable arraybuffer checks by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2094](https://togithub.com/nodejs/undici/pull/2094) - websocket server only needs to reply with a single subprotocol by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2845](https://togithub.com/nodejs/undici/pull/2845) - unite webidl stringification by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2843](https://togithub.com/nodejs/undici/pull/2843) - fix: deflake connect-timeout test by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2851](https://togithub.com/nodejs/undici/pull/2851) - fix: coverage reporting by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2763](https://togithub.com/nodejs/undici/pull/2763) - fix: pipelining logic is not relevant for h2 by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2850](https://togithub.com/nodejs/undici/pull/2850) - processBody doesn't need to return a promise by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2858](https://togithub.com/nodejs/undici/pull/2858) - refactor: split client into client-h1/h2 by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2848](https://togithub.com/nodejs/undici/pull/2848) - ci: fix concurrency by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2862](https://togithub.com/nodejs/undici/pull/2862) - perf: improve performance of isValidSubprotocol by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2861](https://togithub.com/nodejs/undici/pull/2861) - perf: reuse TextDecoder instance by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2863](https://togithub.com/nodejs/undici/pull/2863) - chore: restructure benchmarks, use kebab-case by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2864](https://togithub.com/nodejs/undici/pull/2864) - cookies: improve perf of toIMFDate by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2867](https://togithub.com/nodejs/undici/pull/2867) - cookies: fix validateCookiePath by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2866](https://togithub.com/nodejs/undici/pull/2866) - refactor: move out more h2 from core client by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2860](https://togithub.com/nodejs/undici/pull/2860) - mock: improve test coverage of buildHeadersFromArray by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2872](https://togithub.com/nodejs/undici/pull/2872) - fix: remove broken build request hack by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2874](https://togithub.com/nodejs/undici/pull/2874) - chore: filenames should use kebab-case by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2873](https://togithub.com/nodejs/undici/pull/2873) - refactor: split out last h1 specific code from core by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2876](https://togithub.com/nodejs/undici/pull/2876) - fix: make pipelining limit work for h2 by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2875](https://togithub.com/nodejs/undici/pull/2875) - fix: http2 doesn't have pipelining queue by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2878](https://togithub.com/nodejs/undici/pull/2878) - fix: minor connect cleanup by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2877](https://togithub.com/nodejs/undici/pull/2877) - Request headers types by [@​JaoodxD](https://togithub.com/JaoodxD) in [https://github.com/nodejs/undici/pull/2879](https://togithub.com/nodejs/undici/pull/2879) - ci: remove concurrency by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2880](https://togithub.com/nodejs/undici/pull/2880) - fix: prefer queueMicrotask by [@​ronag](https://togithub.com/ronag) in [https://github.com/nodejs/undici/pull/2881](https://togithub.com/nodejs/undici/pull/2881) - chore: remove no-simd wasm by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2871](https://togithub.com/nodejs/undici/pull/2871) - cookies: improve validateCookieValue by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2883](https://togithub.com/nodejs/undici/pull/2883) - cookies: improve validateCookieName by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2884](https://togithub.com/nodejs/undici/pull/2884) - Properly parse set-cookie header using http2 by [@​jeanp413](https://togithub.com/jeanp413) in [https://github.com/nodejs/undici/pull/2886](https://togithub.com/nodejs/undici/pull/2886) - doc deprecate bodymixin.formData by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2892](https://togithub.com/nodejs/undici/pull/2892) - perf: optimize check invalid field-vchar by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2889](https://togithub.com/nodejs/undici/pull/2889) - build(deps): bump github/codeql-action from 3.24.5 to 3.24.6 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/nodejs/undici/pull/2897](https://togithub.com/nodejs/undici/pull/2897) - fix issue 2898 by [@​KhafraDev](https://togithub.com/KhafraDev) in [https://github.com/nodejs/undici/pull/2900](https://togithub.com/nodejs/undici/pull/2900) - tests: ignore catch block when requiring crypto module by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2901](https://togithub.com/nodejs/undici/pull/2901) - websocket: remove dead code in parseCloseBody by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2902](https://togithub.com/nodejs/undici/pull/2902) - fix: tests dont need process.exit by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2909](https://togithub.com/nodejs/undici/pull/2909) - chore: remove proxyquire by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2906](https://togithub.com/nodejs/undici/pull/2906) - chore: remove import-fresh as devDependency by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2908](https://togithub.com/nodejs/undici/pull/2908) - perf(headers): a single set-cookie by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2903](https://togithub.com/nodejs/undici/pull/2903) - websocket: improve .close() by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2865](https://togithub.com/nodejs/undici/pull/2865) - feat: add sending data benchmark by [@​tsctx](https://togithub.com/tsctx) in [https://github.com/nodejs/undici/pull/2905](https://togithub.com/nodejs/undici/pull/2905) - ci: integrate workflows into nodejs.yml by [@​Uzlopak](https://togithub.com/Uzlopak) in [https://github.com/nodejs/undici/pull/2899](https://togithub.com/nodejs/undici/pull/2899) #### New Contributors - [@​JaoodxD](https://togithub.com/JaoodxD) made their first contribution in [https://github.com/nodejs/undici/pull/2708](https://togithub.com/nodejs/undici/pull/2708) - [@​eddienubes](https://togithub.com/eddienubes) made their first contribution in [https://github.com/nodejs/undici/pull/2731](https://togithub.com/nodejs/undici/pull/2731) - [@​riderx](https://togithub.com/riderx) made their first contribution in [https://github.com/nodejs/undici/pull/2775](https://togithub.com/nodejs/undici/pull/2775) - [@​steveluscher](https://togithub.com/steveluscher) made their first contribution in [https://github.com/nodejs/undici/pull/2807](https://togithub.com/nodejs/undici/pull/2807) - [@​jeanp413](https://togithub.com/jeanp413) made their first contribution in [https://github.com/nodejs/undici/pull/2886](https://togithub.com/nodejs/undici/pull/2886) **Full Changelog**: https://github.com/nodejs/undici/compare/v6.6.2...v6.7.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=--> |
||
|
renovate
|
2662ba763c |
chore: bump up express version to v4.19.2 [SECURITY] (#6308)
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [express](http://expressjs.com/) ([source](https://togithub.com/expressjs/express)) | [`4.18.2` -> `4.19.2`](https://renovatebot.com/diffs/npm/express/4.18.2/4.19.2) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-29041](https://togithub.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc) ### Impact Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://togithub.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. ### Patches https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94 An initial fix went out with `express@4.19.0`, we then patched a feature regression in `4.19.1` and added improved handling for the bypass in `4.19.2`. ### Workarounds The fix for this involves pre-parsing the url string with either `require('node:url').parse` or `new URL`. These are steps you can take on your own before passing the user input string to `res.location` or `res.redirect`. ### References [https://github.com/expressjs/express/pull/5539](https://togithub.com/expressjs/express/pull/5539) [https://github.com/koajs/koa/issues/1800](https://togithub.com/koajs/koa/issues/1800) https://expressjs.com/en/4x/api.html#res.location --- ### Release Notes <details> <summary>expressjs/express (express)</summary> ### [`v4.19.2`](https://togithub.com/expressjs/express/blob/HEAD/History.md#4192--2024-03-25) [Compare Source](https://togithub.com/expressjs/express/compare/4.19.1...4.19.2) \========== - Improved fix for open redirect allow list bypass ### [`v4.19.1`](https://togithub.com/expressjs/express/blob/HEAD/History.md#4191--2024-03-20) [Compare Source](https://togithub.com/expressjs/express/compare/4.19.0...4.19.1) \========== - Allow passing non-strings to res.location with new encoding handling checks ### [`v4.19.0`](https://togithub.com/expressjs/express/compare/4.18.3...83e77aff6a3859d58206f3ff9501277023c03f87) [Compare Source](https://togithub.com/expressjs/express/compare/4.18.3...4.19.0) ### [`v4.18.3`](https://togithub.com/expressjs/express/blob/HEAD/History.md#4183--2024-02-26) [Compare Source](https://togithub.com/expressjs/express/compare/4.18.2...4.18.3) \========== - Fix routing requests without method - deps: body-parser@1.20.2 - Fix strict json error message on Node.js 19+ - deps: content-type@~1.0.5 - deps: raw-body@2.5.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=--> |
