Skip to content

Conversation

@renovate
Copy link

@renovate renovate bot commented Aug 6, 2024

This PR contains the following updates:

Package Change Age Confidence
node-fetch 2.6.1 -> 2.6.7 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

GitHub Vulnerability Alerts

CVE-2022-0235

node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.


Release Notes

node-fetch/node-fetch (node-fetch)

v2.6.7

Compare Source

Security patch release

Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred

What's Changed

Full Changelog: node-fetch/node-fetch@v2.6.6...v2.6.7

v2.6.6

Compare Source

What's Changed

Full Changelog: node-fetch/node-fetch@v2.6.5...v2.6.6

v2.6.5

Compare Source

v2.6.4

Compare Source

v2.6.3

Compare Source

v2.6.2

Compare Source

fixed main path in package.json


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@guardrails
Copy link

guardrails bot commented Aug 6, 2024

⚠️ We detected 3 security issues in this pull request:

Vulnerable Libraries (3)
Severity Details
Low @omega-shared-components/[email protected] (t) - no patch available
Low [email protected] (t) upgrade to: >=0.64.2
Medium [email protected] (t) upgrade to: >=4.9.2

More info on how to fix Vulnerable Libraries in JavaScript.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

@renovate renovate bot changed the title fix(deps): update dependency node-fetch to v2.6.7 [security] fix(deps): update dependency node-fetch to v2.6.7 [security] - autoclosed Dec 8, 2024
@renovate renovate bot closed this Dec 8, 2024
@renovate renovate bot deleted the renovate/npm-node-fetch-vulnerability branch December 8, 2024 18:57
@renovate renovate bot changed the title fix(deps): update dependency node-fetch to v2.6.7 [security] - autoclosed fix(deps): update dependency node-fetch to v2.6.7 [security] Dec 8, 2024
@renovate renovate bot reopened this Dec 8, 2024
@renovate renovate bot force-pushed the renovate/npm-node-fetch-vulnerability branch from a234b0c to 08b3157 Compare December 8, 2024 22:10
@renovate renovate bot force-pushed the renovate/npm-node-fetch-vulnerability branch from 08b3157 to e726d3c Compare November 10, 2025 20:15
@renovate
Copy link
Author

renovate bot commented Nov 10, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant