Update external fixes#191
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
6fa8658 to
1954383
Compare
1954383 to
c31deb9
Compare
c31deb9 to
e098536
Compare
e098536 to
f0b5508
Compare
e314251 to
34d21c3
Compare
34d21c3 to
ec638a1
Compare
b7f24a0 to
ac43912
Compare
d24dbfd to
57f67db
Compare
6ab8c82 to
7009cd4
Compare
9d0338f to
52e7894
Compare
cf16351 to
dcf787e
Compare
dcf787e to
7f92a8b
Compare
7f92a8b to
ce599f2
Compare
fe739a4 to
9e87016
Compare
9e87016 to
e609b17
Compare
e609b17 to
34c7544
Compare
34c7544 to
61e94c5
Compare
61e94c5 to
7b78a87
Compare
7b78a87 to
862e90f
Compare
c9756f7 to
a49e16b
Compare
6cda8db to
2d856be
Compare
2d856be to
868cd67
Compare
868cd67 to
ada8b2d
Compare
4601e85 to
9f74173
Compare
9f74173 to
6c53b3a
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.3.0→1.4.02.0.1→2.0.21.1.0→v1.3.0^0.27.2→^0.32.04.3.5→4.5.03.20.3→3.49.07.28.0→7.37.51.5.16→1.11.58.2.0→8.2.70.13.9→0.14.1Release Notes
apache/openwhisk-wskdebug (@openwhisk/wskdebug)
v1.4.0Compare Source
Improvements
Fixes
adobe/aio-apps-action (adobe/aio-apps-action)
v2.0.2Compare Source
What's Changed
New Contributors
Full Changelog: adobe/aio-apps-action@v2.0.1...2.0.2
adobe/aio-cli-setup-action (adobe/aio-cli-setup-action)
v1.3.0: 1.3.0Compare Source
a84c76e10e1ffe0204d7da43e7c4v1.3.0: 1.3.0Compare Source
a84c76e10e1ffe0204d7da43e7c4v1.2.0Compare Source
Bug fix, for aio -v
New Contributors
Full Changelog: adobe/aio-cli-setup-action@1.1.0...1.2.0
axios/axios (axios)
v0.32.0Compare Source
v0.32.0 — May 4, 2026
This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.
🔒 Security Fixes
🔧 Maintenance & Chores
Full Changelog
v0.31.1Compare Source
This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed
dist/artefacts along with Bower support.dist/Removed:dist/bundles are no longer committed to the repo, andbower.jsonplus the Gruntpackage2bowertask have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)🔒 Security Fixes
isFormDatato reject plain/null-prototype objects and requireappend, and guarded the Node HTTP adapter sodata.getHeaders()is only merged when it is not inherited fromObject.prototype. Blocks injected headers via pollutedgetHeaders. (#10750)mergeConfig, defaults resolution, and the HTTP adapter now uses own-property checks fortransport,env,Blob,formSerializer, and transforms arrays, and merged configs are returned as null-prototype objects. Prevents hijacking of the request flow through polluted prototypes. (#10752)maxDepth(default100,Infinitydisables) totoFormDataand params serialisation, throwingAxiosErrorwith codeERR_FORM_DATA_DEPTH_EXCEEDEDwhen exceeded. Circular-reference detection is preserved. (#10728)%00→ null-byte substitution fromAxiosURLSearchParams.encodeso%00is preserved as-is. Other encoding behaviour (including%20→+) unchanged. (#10737)v0.x:maxContentLengthenforcement forresponseType: 'stream'via a guarded transform with deferred piping,maxBodyLengthenforcement for streamed uploads on nativehttp/httpswithmaxRedirects: 0, and stricterwithXSRFTokenhandling so only own booleantrueenables cross-origin XSRF headers. (#10764)🔧 Maintenance & Chores
.github/CODEOWNERSwith* @​jasonsaaymanto set a default reviewer for all paths. (#10740)Full Changelog
v0.31.0Compare Source
This release backports security fixes from v1.x, hardens the CI/CD supply chain with OIDC publishing and
zizmorscanning, resolves TypeScript typing issues inAxiosInstance, and fixes a performance regression inisEmptyObject().🔒 Security Fixes
Header Injection & Proxy Bypass: Backports v1 security hardening — sanitizes outgoing header values to strip invalid bytes, CRLF sequences, and boundary whitespace (including array values); adds proper
NO_PROXY/no_proxyenforcement covering wildcards, explicit ports, loopback aliases (localhost,127.0.0.1,::1), bracketed IPv6, and trailing-dot hostnames. Proxy bypass is now checked before the proxy URL is parsed, andparsed.hostis used for correct port and IPv6 handling. (#10688)CI Security: SHA-pins all actions and disables credential persistence in v0.x CI, introduces
zizmorsecurity scanning with SARIF upload to code scanning, adds an OIDC Trusted Publishing workflow with npm provenance attestations, and gates all publishes behind a requirednpm-publishGitHub Environment with configurable reviewer protections. (#10638, #10639, #10667)🐛 Bug Fixes
TypeScript —
AxiosInstanceReturn Types: Fixes return types inAxiosInstancemethods to correctly resolve toPromise<R>(matchingAxiosPromise<T>semantics), and corrects the generic call signature so TypeScript properly enforces the response data type. TypeScript-only changes; no runtime impact. (#6253, #7328)Performance: Fixes a performance regression in
isEmptyObject()that caused excessive computation when the argument was a large string. (#6484)🔧 Maintenance & Chores
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog
v0.30.3: Release notes - v0.30.3Compare Source
This is a critical security maintenance release for the v0.x branch. It addresses a high-priority vulnerability involving prototype pollution that could lead to a Denial of Service (DoS).
Recommendation: All users currently on the 0.x release line should upgrade to this version immediately to ensure environment stability.
🛡️ Security Fixes
⚙️ Maintenance & CI
Configuration Merging Behavior:
As part of the security fix, Axios now restricts the merging of the proto key within configuration objects. If your codebase relies on unconventional deep-merging patterns that target the object prototype via Axios config, those operations will now be blocked. This is a necessary change to prevent prototype pollution.
Full Changelog: v0.30.2...v0.30.3
v0.30.2Compare Source
What's Changed
maxContentLengthvulnerability fix to v0.x by @FeBe95 in #7034New Contributors
Full Changelog: axios/axios@v0.30.1...v0.30.2
v0.30.1Compare Source
Release notes:
Bug Fixes
Contributors to this release
Full Changelog: axios/axios@v0.30.0...v0.30.1
v0.30.0Compare Source
Release notes:
Bug Fixes
Contributors to this release
Full Changelog: axios/axios@v0.29.0...v0.30.0
v0.29.0Compare Source
Release notes:
Bug Fixes
Contributors to this release
v0.28.1Compare Source
Release notes:
Release notes:
Bug Fixes
reqis not defined (#6307)v0.28.0Compare Source
Release notes:
Bug Fixes
withXSRFTokenoption to v0.x (#6091)Backports from v1.x:
axios.formToJSONmethod (#4735)url-encoded-formserializer to respect theformSerializerconfig (#4721)string[]toAxiosRequestHeaderstype (#4322)AxiosErrorstack capturing; (#4718)AxiosErrorstatus code type; (#4717)blobto the list of protocols supported by the browser (#4678)chaijs/chai (chai)
v4.5.0Compare Source
1a36d35What's Changed
Full Changelog: chaijs/chai@v4.4.1...v4.5.0
v4.4.1Compare Source
What's Changed
??for node compat by @43081j in #1574Full Changelog: chaijs/chai@v4.4.0...v4.4.1
v4.4.0Compare Source
What's Changed
Full Changelog: chaijs/chai@v4.3.10...v4.4.0
v4.3.10Compare Source
This release simply bumps all dependencies to their latest non-breaking versions.
What's Changed
Full Changelog: chaijs/chai@v4.3.9...v4.3.10
v4.3.9Compare Source
Upgrade dependencies.
This release upgrades dependencies to address CVE-2023-43646 where a large function name can cause "catastrophic backtracking" (aka ReDOS attack) which can cause the test suite to hang.
Full Changelog: chaijs/chai@v4.3.8...v4.3.9
v4.3.8Compare Source
What's Changed
New Contributors
Full Changelog: chaijs/chai@v4.3.7...v4.3.8
v4.3.7Compare Source
What's Changed
Full Changelog: chaijs/chai@v4.3.6...v4.3.7
v4.3.6Compare Source
Update loupe to 2.3.1
zloirock/core-js (core-js)
v3.49.0Compare Source
Iterator.rangeupdated following the actual spec versionRangeErroronNaNstart/end/stepnullasoptionOrStepMath.{ asinh, atanh }polyfills with big and small valuesNumber.prototype.toExponentialpolyfills with big and small valuesatob,btoa,Uint8Array.fromHex,Uint8Array.prototype.setFromHex, andUint8Array.prototype.toHex, #1503, #1464, #1510, thanks @johnzhou721Mapupsert proposalMapupsert proposal from the pure version made generic to make it work with polyfilled and native collectionsSymbol.forinSymbol.prototype.descriptionpolyfill for correct handling of empty string descriptionsArray.prototype.includeswith sparse arrays andfromIndexIterator.prototype.take) of a V8 ~ Chromium < 126 bugIterator.{ concat, zip, zipKeyed }in the pure version for ensuring proper wrappedIteratorinstances as the result.return()on exhausted iterator from some methods of iterator helpers polyfill to the underlying iterator.return()calling in case of throwing error in this method in the internaliteratehelper that affected some polyfillsIteratorValueerrors in the internaliteratehelper that affected some polyfillsArray.frompolyfill on failure to create array propertyArray.fromAsyncpolyfillMAX_SAFE_INTEGERinArray.fromAsyncpolyfillArray.prototype.flatpolyfillIterator.{ zip, zipKeyed }polyfillsIterator.{ zip, zipKeyed }polyfills.next()results an objects inIterator.{ zip, zipKeyed }polyfillsIterator.concatpolyfill on primitive as an iteratorIterator.prototype.windowspolyfillSet.prototype.{ isDisjointFrom, isSupersetOf }polyfillSet.prototype.differencepolyfill with updatingthisDataView.prototype.setFloat16polyfill in (0, 1) rangeString.prototype.{ padStart, padEnd }polyfillsString.prototype.{ startsWith, endsWith }polyfillsInfinityhandling inString.prototype.substrpolyfillString.prototype.repeatpolyfill with a counter exceeding 2 ** 32escapepolyfillRegExpNCG polyfillRegExpNCG polyfill in combination with other types of groupsRegExpNCG polyfill in combination withdotAllString.prototype.replacewithstickypolyfill, #810, #1514RegExpstickypolyfill with alternationmultiline+stickymode inRegExppolyfill.inputslicing on result object withRegExpstickymode polyfillglobalandunicodemodes in polyfillsURLSearchParam.prototype.deletepolyfill with duplicate key-value pairsURLSearchParam.prototype.deletepolyfill with second argumentURLpolyfillURLpolyfillURLpolyfill''andnullhost handling in theURLpolyfillhostname = host:portin theURLpolyfillURLpolyfillURLpolyfillURLSearchParamspolyfillURLpolyfill (/.prefix for non-special URLs withnullhost and path starting with empty segment)URLpolyfill.origingetter withblobschemeURLSearchParams.prototype.setpolyfill on calling only with 1 argumentURLSearchParamspolyfillURLSearchParamspolyfillURLpolyfillToPropertyKeycalling inReflect.{ get, set, deleteProperty }polyfillsReflect.setpolyfill with some descriptors casesReflect.setpolyfill with some non-extensible receiver casesReflect.constructpolyfill arguments validation (observable only in the error message)Reflect.definePropertypolyfill with malformed descriptorJSON.parsepolyfill on unterminated object and array literalsJSON.parsepolyfill on numbers with., but without a fraction part\u{}inString.dedentpolyfillString.dedentpolyfill%AsyncFromSyncIteratorPrototype%to make it a little stricterAsyncIteratormethodsAsyncIterator.prototype.flatMappolyfillAsyncIterator.prototype.mappolyfill on error in underlying iterator.next()AsyncIterator.prototype.takepolyfill withreturn: null.return()result as object inAsyncIterator.prototype.takepolyfillstructuredClonepolyfill on attempt to transfer multiple objects, some of which are non-transferableArrayBuffertransferring wherenewByteLengthexceeds the originalmaxByteLengthObject.definePropertyinSymbolpolyfillObject.definePropertyinSymbolpolyfill in Android ~ 2%TypedArray%.fromarguments validationArrayBufferand a negative length to the%TypedArray%andDataViewconstructors polyfills@@​toStringTagon%TypedArray%polyfillToUint8ClampconversionNaNhandling inDate.prototype.setYearpolyfillWeakMapvalidation in the pure version{ Map, Set }.prototype.forEachmoments in the pure versionArray.isTemplateObjectpolyfill on frozen arrayObservable.fromwith multiple subscriptions of the obsolete ECMAScriptObservableproposal polyfillNumber.fromStringpolyfillesmodules: intersectoption ofcore-js-compatreactnativealias incore-js-compattypescore-js-builderblacklistoption ofcore-js-builder- it should be removed only in the next major releaseString.prototype.{ match, matchAll, replace, split }in modern engines, adds,dandvflag support to polyfills of those methodsNumber.fromStringproposalsiOSdetectionMath.sumPrecisemarked as shipped in V8 ~ Chrome 147Iterator.concatmarked as shipped in V8 ~ Chrome 146Iterator.concatmarked as shipped in Safari 26.4Array.prototype.includesmarked as not supported in modern SafariparseIntandparseFloatv3.48.0Compare Source
Mapupsert proposal:Map.prototype.getOrInsertMap.prototype.getOrInsertComputedWeakMap.prototype.getOrInsertWeakMap.prototype.getOrInsertComputedes.namespace modules,/es/and/stable/namespaces entriesCreateDataProperty/CreateDataPropertyOrThrowin some missed cases, #1497RegExpconstructor (NCG anddotAll) polyfill.lengthIterator.prototype.flatMapthrows on iterator withoutreturnmethodUint8Array.prototype.setFromHexthrows an error on length-tracking views over ResizableArrayBufferMapupsert proposal features marked as shipped in V8 ~ Chrome 145Iterator.concatmarked as shipped in Bun 1.3.7Iterator.prototype.flatMapmarked as supported from Safari 26.2 and Bun 1.2.21 because of a bug: throws on iterator withoutreturnmethodUint8Array.prototype.setFromHexmarked as supported from V8 ~ Chromium 144 because of a bug: throws an error on length-tracking views over ResizableArrayBufferv3.47.0Compare Source
JSON.parsesource text access proposal :JSON.isRawJSONJSON.parseJSON.rawJSONJSON.stringifyes.namespace modules,/es/and/stable/namespaces entriesJSON.stringifyinternalsIteratorsequencing proposal:Iterator.concates.namespace modules,/es/and/stable/namespaces entriesIterator.zipIterator.zipKeyed/actual/namespace entries, unconditional forced replacement changed to feature detection.sizeinURLSearchParams.prototype.appendpolyfill in IE8-Iterator.concatmarked as shipped in FF147Mapupsert proposal features marked as shipped in Safari 26.2Math.sumPrecisemarked as shipped in Safari 26.2Uint8Array.{ fromBase64, prototype.setFromBase64 }marked as fixed in Safari 26.2v3.46.0Compare Source
Mapupsert stage 3 proposal:WeakMap.prototype.getOrInsertComputedbug with callback calling before validation a keyIteratorchunking proposal:Iterator.prototype.chunksIterator.prototype.windowsIterator.prototype.slidingmethod replaced with an extra parameter ofIterator.prototype.windowsmethod, tc39/proposal-iterator-chunking/#24, tc39/proposal-iterator-chunking/#26Iterator.zipandIterator.zipKeyedbehavior withmode: 'longest'option, #1469, thanks @lionel-roweObject.groupByandIterator.zipKeyedtogether withSymbolpolyfill - some cases of symbol keys on resultnull-prototype object were able to leak out tofor-inMapupsert proposal features marked as shipped from FF144v3.45.1Compare Source
Mapupsert proposal with polyfilled methods in the pure versionbugsfields topackage.jsonof all packagesMapupsert proposal features marked as shipped from Bun 1.2.20v3.45.0Compare Source
Uint8Arrayto / from base64 and hex proposal:Uint8Array.fromBase64Uint8Array.fromHexUint8Array.prototype.setFromBase64Uint8Array.prototype.setFromHexUint8Array.prototype.toBase64Uint8Array.prototype.toHexes.namespace modules,/es/and/stable/namespaces entriesUint8ArrayfromBase64 / setFromBase64 does not throw an error on incorrect length of base64 stringMath.sumPreciseproposal:Math.sumPrecisees.namespace module,/es/and/stable/namespaces entriesIteratorsequencing proposal:Iterator.concatConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.