fix(deps): update dependency @octokit/webhooks to v9 [security] #248
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| datasource | package | from | to | | ---------- | ----------------- | ------ | ------ | | npm | @octokit/webhooks | 7.24.3 | 9.26.3 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^7.12.2->^9.0.0GitHub Vulnerability Alerts
CVE-2023-50728
Impact
Versions v9.26.0, v10.9.x), v11.1.x, v12.0.x all contained the code that would throw the error.
Specifically, during a pentest we encountered a bug in the octokit/webhooks library (a dependency of Probot, a framework for building Github Apps). The resulting request was found to cause an uncaught exception that ends the nodejs process.
The problem is caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases.
Credit goes to @pb82 (for the early analysis) and @rh-tguittet (for discovery).
Patches
Maintenance releases for the Error being thrown by the verify method in octokit/webhooks.js
Maintenance release for the reference for octokit/webhooks.js in app.js
Maintenance release for the reference for octokit/webhooks.js in octokit.js
Maintenance release for the reference for octokit/webhooks.js in Protobot
Workarounds
It is recommend that all users upgrade to the latest version of octokit/webhooks.js or use one of the updated back ported versions.
Unauthenticated Denial of Service in the octokit/webhooks library
CVE-2023-50728 / GHSA-pwfr-8pq7-x9qv
More information
Details
Impact
Versions v9.26.0, v10.9.x), v11.1.x, v12.0.x all contained the code that would throw the error.
Specifically, during a pentest we encountered a bug in the octokit/webhooks library (a dependency of Probot, a framework for building Github Apps). The resulting request was found to cause an uncaught exception that ends the nodejs process.
The problem is caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases.
Credit goes to @pb82 (for the early analysis) and @rh-tguittet (for discovery).
Patches
Maintenance releases for the Error being thrown by the verify method in octokit/webhooks.js
Maintenance release for the reference for octokit/webhooks.js in app.js
Maintenance release for the reference for octokit/webhooks.js in octokit.js
Maintenance release for the reference for octokit/webhooks.js in Protobot
Workarounds
It is recommend that all users upgrade to the latest version of octokit/webhooks.js or use one of the updated back ported versions.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
octokit/webhooks.js (@octokit/webhooks)
v9.26.3Compare Source
Bug Fixes
v9.26.2Compare Source
Bug Fixes
v9.26.1Compare Source
Bug Fixes
v9.26.0Compare Source
Features
@octokit/webhooksv5.8.0 (#680) (c9b66b1)v9.25.0Compare Source
Features
projects_v2_itemevent (#679) (c8c6a38)v9.24.0Compare Source
Features
@octokit/webhooksv5.6.0 (#677) (637603b)v9.23.0Compare Source
Features
repository_vulnerability_alert.reopenevent, removeworkflow_job.startedevent, and many other type updates for events via@octokit/webhooks-typesto v5.5.1 (#674) (f147fa3)v9.22.0Compare Source
Features
deploymentanddeployment_statusevents, newdeploymentproperty forcheck_runevent (#662) (ebf8f49)v9.21.0Compare Source
Features
changes.baseproperty onpull_request#edited, newmerged_atproperty on issues common schema, newrerequestableproperty oncheck_suite#completed, newlog_urlproperty ondeployment#created, removecontent_referenceevent (#660) (9fdd549)v9.20.0Compare Source
Features
pull_request_review_threadevent (#659) (768ce13)v9.19.0Compare Source
Features
@octokit/webhooks-typesto v4.16 (#658) (d185662)v9.18.0Compare Source
Features
v9.17.0Compare Source
Features
@octokit/webooks-types@4.12.0(#650) (aa9570e)v9.16.0Compare Source
Features
workflow_job.in_progress, description updates forpushevent payload properties (#647) (07279dc)v9.15.1Compare Source
Bug Fixes
v9.15.0Compare Source
Features
workflow_job.queuedevent (#633) (b611fee)v9.14.2Compare Source
Bug Fixes
v9.14.1Compare Source
Bug Fixes
v9.14.0Compare Source
Features
emitterEventNames(#626) (976c7c4)v9.13.0Compare Source
Features
v9.12.0Compare Source
Features
workflow_jobevent (#614) (5700a1a)v9.11.0Compare Source
Features
InstallationandCommitcommon interfaces, updates toMemberAdded,RepositoryVulnerabilityAlertResolve,RepositoryEditedevents (#607) (406fd8f)v9.10.0Compare Source
Features
EmitterWebhookEventNametype (#604) (b09d164)v9.9.0Compare Source
Features
labeled&unlabeledactions forDiscussionEvent,Discussion#statecan beconverting,active_lock_reasoncan benullinDiscussionLockedEvent,LabelEditedEvent#changesnow contains adescriptionobject (#603) (68861f4)v9.8.4Compare Source
Bug Fixes
PackageEvent(#596) (984f3f5)v9.8.3Compare Source
Bug Fixes
v9.8.2Compare Source
Bug Fixes
changesobject forIssuesTransferredEventand forIssuesOpenedEventwhen the issue is transferred (#592) (7d6a81d), closes #590 #591v9.8.1Compare Source
Bug Fixes
@octokit/webhooks-methodsto^2.0.0(#587) (3344b9f)v9.8.0Compare Source
Features
octokit.verifyAndReceive()accepts raw string payload (#586) (435344b)v9.7.0Compare Source
Features
{App, Installation}#permissionswith additional permissions, addchangesproperty toRepositoryRenamedEvent,ReleaseAsset#labelcan benull,Installation#suspended_{at, by}are always present, fixWorkflowRun#pull_requestsis notPullRequest[]but a simpler type (01891fc)v9.6.3Compare Source
Bug Fixes
issue_commentevent description update (#573) (da05374)v9.6.2Compare Source
Bug Fixes
@octokit/webhooks-typesv3.75.1) (#570) (a2fd414)v9.6.1Compare Source
Bug Fixes
PullRequest#bodycan be of typestringornull,Release#{body, name}are only of typestring(#566) (7643a67)v9.6.0Compare Source
Features
workflow_run#conclusionis not alwaysnull, add newapp_idtoMarketplacePurchase#account, addrequestertoinstallation_repositories.removed, addenums for various properties (#565) (9eef640)v9.5.1Compare Source
Bug Fixes
null(#562) (7cb03b3), closes #561v9.5.0Compare Source
Features
withdrawnaction forsecurity_advisoryevent (#560) (610d82b)v9.4.0Compare Source
Features
InstallationRepositoriesAddedEventcan benulland is now set as required,closed_atinIssueCommentEventisn't alwaysnull(#558) (fcafa8d)v9.3.0Compare Source
Features
Installation#removed, addnullto various properties, list all events instead ofstring[]inInstallation#events, addstringtoPushEvent#base_ref(#557) (47211c7)v9.2.0Compare Source
Features
ProjectColumnEditedEventand makeProjectCard#content_urloptional (#550) (d4f9b4b)v9.1.2Compare Source
Bug Fixes
v9.1.1Compare Source
Bug Fixes
v9.1.0Compare Source
Features
@octokit/webhooks-defintions(#539) (698e793)v9.0.1Compare Source
Bug Fixes
nextmiddleware in case of express (#534) (07f19fe)v9.0.0Compare Source
BREAKING CHANGES
createWebhooksApi()has been removed. Usenew Webhooks()insteadwebhooks.middlewarehas been removed. UsecreateNodeMiddleware()insteadcreateMiddlewarehas been removed. UsecreateNodeMiddleware()insteaddeprecated
pathoption forWebhooksconstructor has been removed. UsecreateNodeMiddleware(webhooks, { path })insteadall usage of
debughas been removed. Use thelogoption insteadwebhooks.signnow default tosha256algorithm. In order to continue to usesha1, replacewith
webhooks.sign()andwebhooks.verify()are now asynchronousstatic
signandverifymethods are no longer exported. Use@octokit/webhooks-methodspackage insteadv8.12.3Compare Source
Bug Fixes
DiscussionTransferredEventevent name (#532) (5bd1901)v8.12.2Compare Source
Bug Fixes
v8.12.1Compare Source
Bug Fixes
v8.12.0Compare Source
Features
new is_one_timeandis_custom_ammounttoSponsorshipTier(e75d17a)v8.11.2Compare Source
Bug Fixes
IncomingMessageto have bodies of other types (#524) (01c38e8)v8.11.1Compare Source
Bug Fixes
options.onUnhandledRequestincreateNodeMiddleware(webhooks, options)(#519) (69c39f0)v8.11.0Compare Source
Features
DiscussionEventandDiscussionCommentEventtypes, fix types forInstallation#requesterto beUserand notnull(#523) (995b48d)v8.10.1Compare Source
Bug Fixes
descriptionfrom objects in order to stop duplication (#517) (5121039)v8.10.0Compare Source
Features
secretoption (#461) (deefd69)v8.9.0Compare Source
Features
createNodeMiddleware()(#509) (8292596)v8.8.3Compare Source
Bug Fixes
nulloverride onIssueCommentEditedEvent#issue.closed_at(#516) (8fef083)v8.8.2Compare Source
Bug Fixes
GollumEvent(#512) (0eb0783)v8.8.1Compare Source
Bug Fixes
TTransformedinWebhookstype parameter tounknown(#514) (21f21b0)v8.8.0Compare Source
Features
createWebhooksApi()(#511) (f8f3d15)v8.7.2Compare Source
Bug Fixes
WorkflowRun#conclusionproperty (#506) (f5f55b6)v8.7.1Compare Source
Bug Fixes
RepositoryVulnerabilityAlertEventandSecurityAdvisoryEvent(#505) (b2be1a1)v8.7.0Compare Source
Features
v8.6.2Compare Source
Bug Fixes
v8.6.1Compare Source
Bug Fixes
auto_mergeproperty toPullRequestand addemailpermission toApp(#500) (6ba0ae9)v8.6.0Compare Source
Features
v8.5.4Compare Source
Bug Fixes
v8.5.3Compare Source
Bug Fixes
v8.5.2Compare Source
Bug Fixes
v8.5.1Compare Source
Bug Fixes
WorkflowRun#pull_requestwith thePullRequestinterface instead ofunknown(2b7490f)v8.5.0Compare Source
Features
deploymentobject for CheckRunEvent; cleanup properties inissueandpull_requestevents; fix GitHubOrg interface values (#478) (639896f)v8.4.1Compare Source
Bug Fixes
v8.4.0Compare Source
Features
senderproperty inCodeScanningAlert(#468) (59d2ca9)v8.3.0Compare Source
Features
v8.2.0Compare Source
Features
v8.1.1Compare Source
Bug Fixes
v8.1.0Compare Source
Features
v8.0.3Compare Source
Bug Fixes
TTransformedfromcreateEventHandler()options (#459) (d2a0b73)v8.0.2Compare Source
First stable
8.xrelease, see release notes for v8.0.0Bug Fixes
delete#ref_typeto matchcreateevent (via@octokit/webhooks-definitionsv3.58.1) (#449) (fd1477c)v8.0.1Compare Source
Bug Fixes
*orerrorevents are passed to#on(560ff73)v8.0.0Compare Source
BREAKING CHANGES
*as an event name is no longer supportederroras an event name is no longer supportedFeatures
@octokit/webhooks-definitionsa dependency (c4ed3d8)*event (4b20ca7)errorevent (b2d5c70)Bug Fixes
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.