New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(deps): update dependency gatsby to v4 [security] #51881
Conversation
d07f623
to
ad31366
Compare
As far as I can tell, this does not pose a risk for us, because it only affects the development environment, and we have no public instances of the development environment. @ojeytonwilliams Remind me the pain to migrate to |
I can't remember, honestly. I'll try again and let you know. |
|
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠ Warning: custom changes will be lost. |
A brilliant |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
This PR contains the following updates:
3.15.0
->4.25.7
GitHub Vulnerability Alerts
CVE-2023-34238
Impact
The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the
__file-code-frame
and__original-stack-frame
paths, exposed when running the Gatsby develop server (gatsby develop
).The following steps can be used to reproduce the vulnerability:
It should be noted that by default
gatsby develop
is only accessible via the localhost127.0.0.1
, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as--host 0.0.0.0
,-H 0.0.0.0
, or theGATSBY_HOST=0.0.0.0
environment variable.Patches
A patch has been introduced in
gatsby@5.9.1
andgatsby@4.25.7
which mitigates the issue.Workarounds
As stated above, by default
gatsby develop
is only exposed to the localhost127.0.0.1
. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.
Credits
We would like to thank Maxwell Garrett of Assetnote for bringing the
__file-code-frame
issue to our attention.For more information
Email us at security@gatsbyjs.com.
Release Notes
gatsbyjs/gatsby (gatsby)
v4.25.7
Compare Source
v4.25.6
Compare Source
v4.25.5
Compare Source
v4.25.4
Compare Source
v4.25.3
Compare Source
v4.25.2
Compare Source
v4.25.1
Compare Source
v4.25.0
Compare Source
v4.24.8
Compare Source
v4.24.7
Compare Source
v4.24.6
Compare Source
v4.24.5
Compare Source
v4.24.4
Compare Source
v4.24.3
Compare Source
v4.24.2
Compare Source
v4.24.1
Compare Source
v4.24.0
: v4.24Compare Source
Welcome to
gatsby@4.24.0
release (September 2022 #2)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.23.1
Compare Source
v4.23.0
: v4.23Compare Source
Welcome to
gatsby@4.23.0
release (September 2022 #1)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.22.1
Compare Source
v4.22.0
: v4.22Compare Source
Welcome to
gatsby@4.22.0
release (August 2022 #3)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.21.1
Compare Source
v4.21.0
: v4.21Compare Source
Welcome to
gatsby@4.21.0
release (August 2022 #2)Key highlights of this release:
gatsby-plugin-mdx
v4Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.20.0
: v4.20Compare Source
Welcome to
gatsby@4.20.0
release (August 2022 #1)Key highlights of this release:
sort
and aggregation fields in Gatsby GraphQL SchemaBleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.19.2
Compare Source
v4.19.1
Compare Source
v4.19.0
: v4.19Compare Source
Welcome to
gatsby@4.19.0
release (July 2022 #2)Key highlights of this release:
react-helmet
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.18.2
Compare Source
v4.18.1
Compare Source
v4.18.0
: v4.18Compare Source
Welcome to
gatsby@4.18.0
release (July 2022 #1)Key highlights of this release:
typesOutputPath
option for GraphQL Typegen - Configure the location of the generated TypeScript typesgatsby develop
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.17.2
Compare Source
v4.17.1
Compare Source
v4.17.0
: v4.17Compare Source
Welcome to
gatsby@4.17.0
release (June 2022 #2)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.16.0
: v4.16Compare Source
Welcome to
gatsby@4.16.0
release (June 2022 #1)Key highlights of this release:
useContentfulImage
hookAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.15.2
Compare Source
v4.15.1
Compare Source
v4.15.0
: v4.15Compare Source
Welcome to
gatsby@4.15.0
release (May 2022 #2)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
[Full changelog][full-changelog]
v4.14.1
Compare Source
v4.14.0
: v4.14Compare Source
Welcome to
gatsby@4.14.0
release (May 2022 #1)Key highlights of this release:
gatsby-source-drupal
: Image CDN SupportAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.13.1
Compare Source
v4.13.0
: v4.13Compare Source
Welcome to
gatsby@4.13.0
release (April 2022 #2)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.12.1
Compare Source
v4.12.0
: v4.12Compare Source
Welcome to
gatsby@4.12.0
release (April 2022 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.11.3
Compare Source
v4.11.2
Compare Source
v4.11.1
Compare Source
v4.11.0
: v4.11Compare Source
Welcome to
gatsby@4.11.0
release (March 2022 #3)Key highlights of this release:
gatsby-source-shopify
v7Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.10.3
Compare Source
v4.10.2
Compare Source
v4.10.1
Compare Source
v4.10.0
: v4.10Compare Source
Welcome to
gatsby@4.10.0
release (March 2022 #2)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.9.3
Compare Source
v4.9.2
Compare Source
v4.9.1
Compare Source
v4.9.0
: v4.9Compare Source
Welcome to
gatsby@4.9.0
release (March 2022 #1)Key highlights of this release:
gatsby-config
andgatsby-node
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.8.2
Compare Source
v4.8.1
Compare Source
v4.8.0
: v4.8Compare Source
Welcome to
gatsby@4.8.0
release (February 2022 #2)Key highlights of this release:
gatsby-browser
andgatsby-ssr
gatsby-core-utils
andgatsby-plugin-utils
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.7.2
Compare Source
v4.7.1
Compare Source
v4.7.0
: v4.7Compare Source
Welcome to
gatsby@4.7.0
release (February 2022 #1)Key highlights of this release:
trailingSlash
Option - Now built into the Framework itselfcreatePages
- Speed improvements of at least 30%Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.6.2
Compare Source
v4.6.1
Compare Source
v4.6.0
: v4.6Compare Source
Welcome to
gatsby@4.6.0
release (January 2022 #2)Key highlights of this release:
gatsby-plugin-utils
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.5.5
Compare Source
v4.5.4
Compare Source
v4.5.3
Compare Source
v4.5.2
Compare Source
v4.5.1
Compare Source
v4.5.0
: v4.5Compare Source
Welcome to
gatsby@4.5.0
release (January 2022 #1)Key highlights of this release:
getServerData
gatsby-recipes
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.4.0
: v4.4Compare Source
Welcome to
gatsby@4.4.0
release (December 2021 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.3.0
: v4.3Compare Source
Welcome to
gatsby@4.3.0
release (November 2021 #3)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.2.0
: v4.2Compare Source
Welcome to
gatsby@4.2.0
release (November 2021 #2).Key highlights of this release:
gatsby-source-contentful
v7getServerData
improvementsAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
v4.1.1
Compare Source
v4.1.0
: v4.1Compare Source
Welcome to
gatsby@4.1.0
release (November 2021 #1).Key highlights of this release:
gatsby-config.js
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.0.2
Compare Source
v4.0.1
Compare Source
v4.0.0
: v4.0.0Compare Source
Welcome to
gatsby@4.0.0
release (October 2021 #1).We've released Gatsby 3 in March 2021 and now have a lot of exciting new features for Gatsby 4!
We’ve tried to make migration smooth. Please refer to the migration guide
and let us know if you encounter any issues when migrating.
Key highlights of this release:
Also check out notable bugfixes and improvements.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes for 3.14
Full changelog
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.