Update All (major) - #10

Open

renovate[bot] wants to merge 1 commit into

renovate/major-all

renovate Bot commented Nov 16, 2023 •

edited

Loading

Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@prisma/extension-accelerate	`^0.6.2` → `^3.0.0`
@types/eslint (source)	`8.44.3` → `9.6.1`
prisma (source)	`^5.3.1` → `^7.0.0`
typescript (source)	`5.2.2` → `7.0.2`
undici (source)	`^5.25.4` → `^8.0.0`
vite (source)	`4.4.11` → `8.3.0`
vite-tsconfig-paths	`4.2.1` → `6.1.1`
wrangler (source)	`^3.0.0` → `^4.0.0`
zod (source)	`^3.22.4` → `^4.0.0`

Release Notes

microsoft/TypeScript (typescript)

`v7.0.2`

`v6.0.3`: TypeScript 6.0.3

For release notes, check out the release announcement blog post.

Downloads are available on:

npm

`v6.0.2`: TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

npm

`v5.9.3`: TypeScript 5.9.3

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

fixed issues query for Typescript 5.9.0 (Beta).
fixed issues query for Typescript 5.9.1 (RC).
No specific changes for TypeScript 5.9.2 (Stable)
fixed issues query for Typescript 5.9.3 (Stable).

Downloads are available on:

npm

`v5.9.2`: TypeScript 5.9

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

fixed issues query for Typescript 5.9.0 (Beta).
fixed issues query for Typescript 5.9.1 (RC).
No specific changes for TypeScript 5.9.2 (Stable)

Downloads are available on:

npm

`v5.8.3`: TypeScript 5.8.3

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement.

Downloads are available on:

npm

`v5.8.2`: TypeScript 5.8

For release notes, check out the release announcement.

Downloads are available on:

npm

`v5.7.3`: TypeScript 5.7.3

For release notes, check out the release announcement.

Downloads are available on npm

`v5.7.2`: TypeScript 5.7

For release notes, check out the release announcement.

Downloads are available on:

npm

`v5.6.3`: TypeScript 5.6.3

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

`v5.6.2`: TypeScript 5.6

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

`v5.5.4`: TypeScript 5.5.4

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

npm
NuGet package (soon!)

`v5.5.3`: TypeScript 5.5.3

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

`v5.5.2`: TypeScript 5.5

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

npm

`v5.4.5`: TypeScript 5.4.5

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

NuGet package

`v5.4.4`: TypeScript 5.4.4

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

NuGet package

`v5.4.3`: TypeScript 5.4.3

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

NuGet package

`v5.4.2`: TypeScript 5.4

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

NuGet package

`v5.3.3`: TypeScript 5.3.3

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

NuGet package

`v5.3.2`: TypeScript 5.3

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

Downloads are available on:

NuGet package

nodejs/undici (undici)

`v8.10.2`

⚠️ Security fixes

High severity

GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.
GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.
GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.
GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.
GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.
GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.
GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.
GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

build(deps-dev): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in #5653
build(deps-dev): bump jest from 30.4.2 to 30.5.0 by @dependabot[bot] in #5750
build(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.9 by @dependabot[bot] in #5752
build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.9 by @dependabot[bot] in #5754
test(h2): cover stream reset with NGHTTP2_INTERNAL_ERROR by @zeexzeex in #5725
fix(retry): reject invalid resumed responses by @mcollina in #5724
test: make stale-while-revalidate cache update test deterministic by @mcollina in #5722
fix: avoid unbounded recursion in Set-Cookie attribute parser by @mcollina in #5757
fix: honor SOCKS5 connection timeout by @mcollina in #5733
fix(eventsource): validate Last-Event-ID on reconnect by @mcollina in #5746
fix: avoid duplicate release attempts by @mcollina in #5745
fix(cache): refetch when 304 adds vary fields by @mcollina in #5732
types: expose PendingInterceptor and PendingInterceptorsFormatter on the MockAgent namespace by @RaphaelFakhri in #5721
ci(codeql): align CodeQL action versions to v4.37.9 by @mcollina in #5759
build(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 by @dependabot[bot] in #5760
fix(proxy-agent): guard Proxy-Authorization in iterable header containers by @mcollina in #5758
docs: name the parameters these two blocks describe by @darkdi in #5735
fix(websocket): fail the connection on a non-200 h2 extended CONNECT response by @kjsik11 in #5751
test(node-fetch): re-enable the set-cookie header combining test by @pacocartones in #5730
fix(retry): forward rawHeaders writes through RetryController by @official-burak in #5727
fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs by @kjsik11 in #5738

New Contributors

@darkdi made their first contribution in #5735
@kjsik11 made their first contribution in #5751
@official-burak made their first contribution in #5727

Full Changelog: nodejs/undici@v8.10.1...v8.10.2

`v8.10.1`

`v8.10.0`

What's Changed

feat: namespace h2 options by @metcoder95 in #5498
test: update WPT expectations by @mcollina in #5587
test: add cache/dedupe + dns re-dispatch integration tests by @GiHoon1123 in #5535
fix(websocket): support process.unref by @mcollina in #5578
fix(h2): ensure every request settles by @mcollina in #5603
fix(readable): consume a body whose end has already been emitted by @marko1olo in #5617
fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by @marko1olo in #5610
fix: revert idle socket validation to setTimeout(0) to prevent stall on idle event loop by @marceli1404 in #5606
fix(env-http-proxy-agent): match bare IPv6 addresses in no_proxy by @marko1olo in #5623
test: handle aggregate balanced pool errors by @marko1olo in #5377
fix(readable): keep body bytes that arrive after setEncoding() by @mcollina in #5620
fix(socks5): evict unused origin pools by @Kkartik14 in #5595
fix: skip deduplication for upgrade requests by @Ram-blip in #5593
fix(retry): forward informational responses by @mcollina in #5625
fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by @marko1olo in #5619
fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin by @marko1olo in #5628
build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #5633
build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 by @dependabot[bot] in #5634
build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #5636
fix(mock): emit request body lifecycle hooks by @marko1olo in #5367
fix(h2): detach upgrade close handler after GOAWAY by @pacocartones in #5641
fix: retry refused HTTP/2 streams by @mcollina in #5598
fix: preserve DNS origin hostname on sockets by @cyphercodes in #5577

New Contributors

@marceli1404 made their first contribution in #5606
@Kkartik14 made their first contribution in #5595
@pacocartones made their first contribution in #5641
@cyphercodes made their first contribution in #5577

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

`v8.9.0`

What's Changed

fix(decompress): preserve response trailers by @Ram-blip in #5572
build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @dependabot[bot] in #5576
fix: validate coerced header values for CRLF by @mcollina in #5579
fix: handle frozen globalThis in setGlobalDispatcher by @mhayk in #5574
Ignore auto-generated .npmrc on Windows by @tsctx in #5583

New Contributors

@mhayk made their first contribution in #5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

`v8.8.0`

What's Changed

fetch: use ReadableStreamTee for cloning streams by @KhafraDev in #5517
fix(benchmarks): adjust got after v15 upgrade by @slagiewka in #5526
feat(mock): support asynchronous reply options callbacks by @Develop-KIM in #5534
docs: clarify proxy threat model by @mcollina in #5530
docs: clarify MockAgent pool usage by @vibhor-aggr in #5542
docs: clarify parser timeout precision by @vibhor-aggr in #5543
fix: handle flat alternating header arrays in cache normalizeHeaders by @mcollina in #5536
chore(benchmarks): require(esm) on ESM-only packages by @slagiewka in #5527
fix: run idle socket validation off setImmediate instead of setTimeout by @carlotestor in #5499
docs: add custom interceptor example by @vibhor-aggr in #5548
fix(h1): ignore type of service errors by @mcollina in #5547
fix(fetch): convert null init in Response.json by @Ram-blip in #5540
fix(redirect): remove body headers after POST-to-GET by @Ram-blip in #5551
build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @dependabot[bot] in #5556
fix(h2): allow stream-bodied requests to multiplex on a busy session by @GiHoon1123 in #5538
fix(h2): destroy aborted stream synchronously instead of via setImmediate by @staylor in #5559
fix(decompress): skip HEAD responses by @Ram-blip in #5564
ci: build undici with node.js v26 by @shivarm in #5237
docs: clarify top-level request option url fields by @vibhor-aggr in #5545
test: add unexpected disconnect guards to http2 tests by @Develop-KIM in #5533
fix: track origins by client map key in Agent teardown by @emmayusufu in #5537
fix: enforce must-revalidate and proxy-revalidate over max-stale and stale-if-error by @jeswr in #5511
fix(retry): handle Retry-After zero delay by @Ram-blip in #5519
fix: honor stale-if-error on connection errors during revalidation by @jeswr in #5513
fix: store revalidation-only responses so etag revalidation can engage by @jeswr in #5515
fix(h2): prevent uncaughtException from onHttp2SocketError accessing undefined kClient by @mcollina in #5546
fix(h2): complete request stream on 'end' instead of waiting for 'close' by @staylor in #5560
fix: invalidate Location and Content-Location URIs on unsafe methods by @jeswr in #5514
test: deflake invalid websocket close status test by @mcollina in #5550
refactor: replace tspl with node:test t.plan in connect-timeout tests by @mcollina in #5518
fix(h2): release completed requests from queue by @staylor in #5569

New Contributors

@Develop-KIM made their first contribution in #5534
@carlotestor made their first contribution in #5499
@GiHoon1123 made their first contribution in #5538
@emmayusufu made their first contribution in #5537

Full Changelog: nodejs/undici@v8.7.0...v8.8.0

`v8.7.0`

What's Changed

test: guard balanced-pool error port lookup by @mcollina in #5463
perf: optimize http/2 request hot path by @mcollina in #5483
fix: do not reject open-ended Range values in simpleRangeHeaderValue by @spokodev in #5490
fix(eventsource): set use-URL-credentials flag by @Ram-blip in #5489
test: deflake connect-timeout watchdog by @mcollina in #5197
docs: correct npm script name and JSON syntax in examples by @lenoxfernando in #5496
fix: reject non-ascii octets in validateCookiePath by @spokodev in #5452
fix(readable): ignore late consume chunks by @marko1olo in #5375
fix(h2): destroy the stream on abort instead of relying on close() by @staylor in #5462
fix: ignore an unparseable Set-Cookie Expires attribute by @spokodev in #5488
docs: add reproduction guide and update bug report template by @mcollina in #5451
fix(h2): guard onResponse against a 'response' event delivered after completion by @staylor in #5440
fix(h2): requeue request on GOAWAY'd session instead of crashing by @staylor in #5453
fix: add static buildDispatch method to RedirectHandler type definition by @matthieusieben in #5442
fix: auto-detect HTTP proxy tunneling by @mcollina in #5116

New Contributors

@spokodev made their first contribution in #5490
@lenoxfernando made their first contribution in #5496
@staylor made their first contribution in #5462

Full Changelog: nodejs/undici@v8.6.0...v8.7.0

`v8.6.0`

`v8.5.0`

⚠️ Security Release

This release line addresses 8 security advisories. Most are fixed in
v8.5.0; the SOCKS5 pool-reuse issue was fixed earlier in v8.2.0.

Action required: Upgrade to undici 8.5.0 or later.
npm install undici@^8.5.0

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	8.5.0	`32dbf0b3`
GHSA-38rv-x7px-6hhq	CVE-2026-9675	High (7.5)	8.5.0	`b4c287b3`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	8.5.0	`42d49559`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	8.2.0	`a516f870`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	8.5.0	`cb105d7c`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	8.5.0	`5655ea43`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	8.5.0	`5655ea43`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	8.5.0	`6ea54ef8`

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix: 32dbf0b3 websocket: limit the number of fragments in a message (also c5ed7875 handle empty fragments and stream limits)

A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.

Affected: applications using new WebSocket(...) or WebSocketStream
against untrusted endpoints.
Workaround: none — upgrade is required.

WebSocket DoS via cumulative fragment bypass — CVE-2026-9675

**[GHSA-38rv-x7px-6hhq](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cloudflare-workers-and-pages Bot commented Nov 16, 2023 •

edited

Loading

Deploying transcript with Cloudflare Pages

Latest commit:	`cbe41d7`
Status:	🚫 Build failed.

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from a6018f6 to b0823f2 Compare

November 21, 2023 15:49

renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from a17dfcd to 76e850d Compare

December 4, 2023 11:33

renovate Bot changed the title ~~Update dependency vite to v5~~ Update All (major)

renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from 73b38d3 to bacb2e5 Compare

December 8, 2023 13:26

renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from 5ca1df3 to 1bced79 Compare

December 15, 2023 16:46

renovate Bot force-pushed the renovate/major-all branch from 1bced79 to ed9e2ce Compare

January 5, 2024 09:30

renovate Bot force-pushed the renovate/major-all branch from ed9e2ce to 7260331 Compare

January 19, 2024 17:25

renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from 180a578 to b05e8f1 Compare

February 14, 2024 18:18

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from d4d2ace to 1c94144 Compare

February 21, 2024 13:47

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from 742186d to 33c6572 Compare

March 4, 2024 20:16

renovate Bot force-pushed the renovate/major-all branch from 33c6572 to 1faf494 Compare

March 11, 2024 15:49

renovate Bot force-pushed the renovate/major-all branch 6 times, most recently from 720dcff to 317760e Compare

March 24, 2024 14:20

renovate Bot force-pushed the renovate/major-all branch from 317760e to 08eef04 Compare

March 29, 2024 09:02

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from ec3559c to 576c16b Compare

July 3, 2024 07:15

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from 34f102d to 2be2ec1 Compare

July 22, 2024 17:56

renovate Bot force-pushed the renovate/major-all branch from 2be2ec1 to 349ebe1 Compare

July 25, 2024 09:43

renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from 6746be1 to 17fcb85 Compare

August 8, 2024 23:25

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from 5d247cb to edfb209 Compare

August 20, 2024 17:42

renovate Bot force-pushed the renovate/major-all branch from edfb209 to ab0cdfd Compare

August 26, 2024 10:33

renovate Bot force-pushed the renovate/major-all branch from ab0cdfd to df4bf25 Compare

September 3, 2024 18:53

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from e054e80 to 0e5ec30 Compare

September 13, 2024 09:14

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from 8916334 to 7ed73ed Compare

September 25, 2024 06:12

renovate Bot force-pushed the renovate/major-all branch from 7ed73ed to 0e5746e Compare

October 14, 2024 19:31

renovate Bot force-pushed the renovate/major-all branch from 0e5746e to 129d1c4 Compare

October 23, 2024 05:13

renovate Bot force-pushed the renovate/major-all branch 4 times, most recently from afb197e to 70ea7bd Compare

November 11, 2024 10:04

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from 8e4b60f to 3a04eeb Compare

November 26, 2024 10:10

renovate Bot force-pushed the renovate/major-all branch 3 times, most recently from 96981dc to 8f27ed4 Compare

December 2, 2024 08:17

renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from f2c6e69 to 3b4c725 Compare

December 6, 2024 17:53


          Update All

cbe41d7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet