New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): update dependency gatsby to v4 [security] #248
Open
renovate
wants to merge
1
commit into
main
Choose a base branch
from
renovate/npm-gatsby-vulnerability
base: main
Could not load branches
Branch not found: {{ refName }}
Could not load tags
Nothing to show
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
June 19, 2023 05:12
c1ee5e1
to
e4bb13d
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
July 3, 2023 05:00
e4bb13d
to
d80d0bd
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
July 17, 2023 03:15
d80d0bd
to
971d0ed
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
July 24, 2023 04:42
971d0ed
to
9c7d665
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
2 times, most recently
from
August 15, 2023 07:29
85f1df3
to
56d6707
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
August 22, 2023 06:15
56d6707
to
218ca25
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
August 29, 2023 06:44
218ca25
to
0b2e22e
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
2 times, most recently
from
September 12, 2023 07:24
0fe2861
to
ec719a3
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
September 19, 2023 07:09
ec719a3
to
e5a765b
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
September 26, 2023 08:31
e5a765b
to
47d78fc
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
October 17, 2023 06:10
47d78fc
to
78b2143
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
October 24, 2023 06:30
78b2143
to
ca24ef0
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
2 times, most recently
from
November 7, 2023 07:02
0b97184
to
eb7e051
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
2 times, most recently
from
November 21, 2023 06:55
cfaf050
to
9e138e3
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
2 times, most recently
from
December 5, 2023 06:29
991637d
to
0486779
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
December 12, 2023 06:11
0486779
to
deec19e
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
December 19, 2023 06:55
deec19e
to
fc9c0a0
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
2 times, most recently
from
January 2, 2024 06:31
fe21640
to
20350c0
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
3 times, most recently
from
January 9, 2024 06:57
2c98b84
to
ee93125
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
2 times, most recently
from
January 23, 2024 06:34
abc1256
to
ba6261c
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
February 6, 2024 06:05
ba6261c
to
8233320
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
2 times, most recently
from
February 20, 2024 04:40
3a722d2
to
84dd4e8
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-vulnerability
branch
from
February 27, 2024 06:07
84dd4e8
to
0f0762f
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.5.0
->4.25.7
GitHub Vulnerability Alerts
CVE-2023-34238
Impact
The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the
__file-code-frame
and__original-stack-frame
paths, exposed when running the Gatsby develop server (gatsby develop
).The following steps can be used to reproduce the vulnerability:
It should be noted that by default
gatsby develop
is only accessible via the localhost127.0.0.1
, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as--host 0.0.0.0
,-H 0.0.0.0
, or theGATSBY_HOST=0.0.0.0
environment variable.Patches
A patch has been introduced in
gatsby@5.9.1
andgatsby@4.25.7
which mitigates the issue.Workarounds
As stated above, by default
gatsby develop
is only exposed to the localhost127.0.0.1
. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.
Credits
We would like to thank Maxwell Garrett of Assetnote for bringing the
__file-code-frame
issue to our attention.For more information
Email us at security@gatsbyjs.com.
Release Notes
gatsbyjs/gatsby (gatsby)
v4.25.7
Compare Source
v4.25.6
Compare Source
v4.25.5
Compare Source
v4.25.4
Compare Source
v4.25.3
Compare Source
v4.25.2
Compare Source
v4.25.1
Compare Source
v4.25.0
Compare Source
v4.24.8
Compare Source
v4.24.7
Compare Source
v4.24.6
Compare Source
v4.24.5
Compare Source
v4.24.4
Compare Source
v4.24.3
Compare Source
v4.24.2
Compare Source
v4.24.1
Compare Source
v4.24.0
: v4.24Compare Source
Welcome to
gatsby@4.24.0
release (September 2022 #2)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.23.1
Compare Source
v4.23.0
: v4.23Compare Source
Welcome to
gatsby@4.23.0
release (September 2022 #1)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.22.1
Compare Source
v4.22.0
: v4.22Compare Source
Welcome to
gatsby@4.22.0
release (August 2022 #3)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.21.1
Compare Source
v4.21.0
: v4.21Compare Source
Welcome to
gatsby@4.21.0
release (August 2022 #2)Key highlights of this release:
gatsby-plugin-mdx
v4Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.20.0
: v4.20Compare Source
Welcome to
gatsby@4.20.0
release (August 2022 #1)Key highlights of this release:
sort
and aggregation fields in Gatsby GraphQL SchemaBleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.19.2
Compare Source
v4.19.1
Compare Source
v4.19.0
: v4.19Compare Source
Welcome to
gatsby@4.19.0
release (July 2022 #2)Key highlights of this release:
react-helmet
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.18.2
Compare Source
v4.18.1
Compare Source
v4.18.0
: v4.18Compare Source
Welcome to
gatsby@4.18.0
release (July 2022 #1)Key highlights of this release:
typesOutputPath
option for GraphQL Typegen - Configure the location of the generated TypeScript typesgatsby develop
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.17.2
Compare Source
v4.17.1
Compare Source
v4.17.0
: v4.17Compare Source
Welcome to
gatsby@4.17.0
release (June 2022 #2)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.16.0
: v4.16Compare Source
Welcome to
gatsby@4.16.0
release (June 2022 #1)Key highlights of this release:
useContentfulImage
hookAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.15.2
Compare Source
v4.15.1
Compare Source
v4.15.0
: v4.15Compare Source
Welcome to
gatsby@4.15.0
release (May 2022 #2)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
[Full changelog][full-changelog]
v4.14.1
Compare Source
v4.14.0
: v4.14Compare Source
Welcome to
gatsby@4.14.0
release (May 2022 #1)Key highlights of this release:
gatsby-source-drupal
: Image CDN SupportAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.13.1
Compare Source
v4.13.0
: v4.13Compare Source
Welcome to
gatsby@4.13.0
release (April 2022 #2)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.12.1
Compare Source
v4.12.0
: v4.12Compare Source
Welcome to
gatsby@4.12.0
release (April 2022 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.11.3
Compare Source
v4.11.2
Compare Source
v4.11.1
Compare Source
v4.11.0
: v4.11Compare Source
Welcome to
gatsby@4.11.0
release (March 2022 #3)Key highlights of this release:
gatsby-source-shopify
v7Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.10.3
Compare Source
v4.10.2
Compare Source
v4.10.1
Compare Source
v4.10.0
: v4.10Compare Source
Welcome to
gatsby@4.10.0
release (March 2022 #2)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.9.3
Compare Source
v4.9.2
Compare Source
v4.9.1
Compare Source
v4.9.0
: v4.9Compare Source
Welcome to
gatsby@4.9.0
release (March 2022 #1)Key highlights of this release:
gatsby-config
andgatsby-node
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.8.2
Compare Source
v4.8.1
Compare Source
v4.8.0
: v4.8Compare Source
Welcome to
gatsby@4.8.0
release (February 2022 #2)Key highlights of this release:
gatsby-browser
andgatsby-ssr
gatsby-core-utils
andgatsby-plugin-utils
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.7.2
Compare Source
v4.7.1
Compare Source
v4.7.0
: v4.7Compare Source
Welcome to
gatsby@4.7.0
release (February 2022 #1)Key highlights of this release:
trailingSlash
Option - Now built into the Framework itselfcreatePages
- Speed improvements of at least 30%Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.6.2
Compare Source
v4.6.1
Compare Source
v4.6.0
: v4.6Compare Source
Welcome to
gatsby@4.6.0
release (January 2022 #2)Key highlights of this release:
gatsby-plugin-utils
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.5.5
Compare Source
v4.5.4
Compare Source
v4.5.3
Compare Source
v4.5.2
Compare Source
v4.5.1
Compare Source
v4.5.0
: v4.5Compare Source
Welcome to
gatsby@4.5.0
release (January 2022 #1)Key highlights of this release:
getServerData
gatsby-recipes
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.4.0
: v4.4Compare Source
Welcome to
gatsby@4.4.0
release (December 2021 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.3.0
: v4.3Compare Source
Welcome to
gatsby@4.3.0
release (November 2021 #3)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.2.0
: v4.2Compare Source
Welcome to
gatsby@4.2.0
release (November 2021 #2).Key highlights of this release:
gatsby-source-contentful
v7getServerData
improvementsAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
v4.1.1
Compare Source
v4.1.0
: v4.1Compare Source
Welcome to
gatsby@4.1.0
release (November 2021 #1).Key highlights of this release:
gatsby-config.js
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.0.2
Compare Source
v4.0.1
Compare Source
v4.0.0
: v4.0.0Compare Source
Welcome to
gatsby@4.0.0
release (October 2021 #1).We've released Gatsby 3 in March 2021 and now have a lot of exciting new features for Gatsby 4!
We’ve tried to make migration smooth. Please refer to the migration guide
and let us know if you encounter any issues when migrating.
Key highlights of this release:
Also check out notable bugfixes and improvements.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes for 3.14
Full changelog
v3.15.0
Compare Source
v3.14.6
Compare Source
v3.14.5
Compare Source
v3.14.4
Compare Source
v3.14.3
Compare Source
v3.14.2
Compare Source
v3.14.1
Compare Source
v3.14.0
: v3.14 (September 2021 #1)Compare Source
Welcome to
gatsby@3.14.0
release (September 2021 #1)Key highlights of this release:
createPages
snippet in GraphiQL and new GraphQL capabilitygatsby-source-drupal
gatsby-plugin-netlify
Also, check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.13.1
Compare Source
v3.13.0
: v3.13 (August 2021 #3)Compare Source
Welcome to
gatsby@3.13.0
release (August 2021 #3)Key highlights of this release:
sharp
v0.29 - Reduced install size, improved encoding time, and improved AVIF image qualitygatsby-source-drupal
- Speed up fetching data by around 4xAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.12.1
Compare Source
v3.12.0
: v3.12 (August 2021 #2)Compare Source
Welcome to
gatsby@3.12.0
release (August 2021 #2)Key highlights of this release:
webpack
dev server caching - opt-in 20% of usersgatsby-source-shopify
- Add compat for breaking change in Shopify's APIgatsby-source-wordpress
- Support for generating WebP images in HTML fieldsAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.11.1
Compare Source
v3.11.0
: v3.11 (August 2021 #1)Compare Source
Welcome to
gatsby@3.11.0
release (August 2021 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.10.2
Compare Source
v3.10.1
Compare Source
v3.10.0
: v3.10 (July 2021 #2)Compare Source
Welcome to
gatsby@3.10.0
release (July 2021 #2)Key highlights of this release:
gatsby develop
- significantly speed up start of webpack serverAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.9.1
Compare Source
v3.9.0
: v3.9 (July 2021 #1)Compare Source
Welcome to
gatsby@3.9.0
release (July 2021 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.8.1
Compare Source
v3.8.0
: v3.8 (June 2021 #2)Compare Source
Welcome to
gatsby@3.8.0
release (June 2021 #2)Key highlights of this release:
gatsby-source-shopify
v5Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.