Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Upgrade axios to address CVE-2023-45857 #7713

Merged
merged 3 commits into from
Dec 19, 2023
Merged

fix: Upgrade axios to address CVE-2023-45857 #7713

merged 3 commits into from
Dec 19, 2023

Conversation

netroy
Copy link
Member

@netroy netroy commented Nov 14, 2023

@n8n-assistant n8n-assistant bot added core Enhancement outside /nodes-base and /editor-ui n8n team Authored by the n8n team ui Enhancement in /editor-ui or /design-system labels Nov 14, 2023
@cypress Cypress
Copy link

cypress bot commented Nov 14, 2023 •
edited

2 flaky tests on run #3413 ↗︎

0 306 5 0 Flakiness 2

Details:

🌳 🖥️ browsers:node18.12.0-chrome107 🤖 netroy 🗃️ e2e/*
Project: n8n Commit: c8d8d2283b
Status: Passed Duration: 06:53 💡
Started: Dec 19, 2023 3:03 PM Ended: Dec 19, 2023 3:10 PM
Flakiness  17-sharing.cy.ts • 1 flaky test

View Output Video

Test Artifacts
Sharing > should work for admin role on credentials created by others (also can share it with themselves) Screenshots Video
Flakiness  24-ndv-paired-item.cy.ts • 1 flaky test

View Output Video

Test Artifacts
NDV > resolves expression with default item when input node is not parent, while still pairing items Screenshots Video

Review all test suite changes for PR #7713 ↗︎

@levpachmanov

This comment was marked as spam.

Sign in to view
@netroy netroy force-pushed the upgrade-axios branch 2 times, most recently from 6a6f658 to 89edbcc Compare December 12, 2023 22:29
@netroy netroy marked this pull request as ready for review December 12, 2023 22:30
@github-actions GitHub Actions
Copy link
Contributor

✅ All Cypress E2E specs passed

@netroy netroy merged commit 64eb9bb into master Dec 19, 2023
19 checks passed
@netroy netroy deleted the upgrade-axios branch December 19, 2023 15:17
MiloradFilipovic added a commit that referenced this pull request Dec 21, 2023
@MiloradFilipovic
Merge branch 'master' into ADO-1537-save-templateId-with-workflow
c5747ed 
* master: (22 commits)
  fix(editor): Make keyboard shortcuts more strict; don't accept extra Ctrl/Alt/Shift keys (#8024)
  fix(core):  Downgrade Rudderstack SDK (no-changelog) (#8107)
  fix(editor): Move versions check to init function and refactor store (no-changelog) (#8067)
  refactor(editor): Add telemetry for SSO/SAML (no-changelog) (#8102)
  fix(editor): Ensure execution data overrides pinned data when copying in executions view (#8009)
  fix(editor): Fix copy/paste issue when switch node is in workflow (#8103)
  feat(editor): Upgrade frontend tooling to address a few vulnerabilities (#8100)
  feat(editor): De-duplicate frontend devDependencies (no-changelog) (#8094)
  refactor(core): Improve test-webhooks (no-changelog) (#8069)
  refactor: Add telemetry for RBAC (no-changelog) (#8056)
  feat(core): Upgrade Rudderstack SDK (no-changelog) (#8090)
  fix: Upgrade axios to address CVE-2023-45857 (#7713)
  fix(core): Do not display error when stopping jobless execution in queue mode (#8007)
  feat(editor): Gracefully ignore invalid payloads in postMessage handler (#8096)
  feat(editor): Add lead enrichment suggestions to workflow list (#8042)
  refactor(Discord Node): Stop reporting to Sentry inaccessible guild error (no-changelog) (#8095)
  feat: Add opt-in enterprise license trial checkbox (no-changelog) (#7826)
  ci: Remove unnecessary async/await, enable await-thenable linting rule (no-changelog) (#8076)
  refactor(editor): Add telemetry for log streaming (no-changelog) (#8075)
  fix(core): Use relative imports for dynamic imports in SecurityAuditService (#8086)
  ...
@github-actions github-actions bot mentioned this pull request Dec 21, 2023
Merged
ivov added a commit that referenced this pull request Dec 21, 2023
@github-actions @ivov
🚀 Release 1.22.0 (#8115)
b67b5ae 
#
[1.22.0](https://github.com/n8n-io/n8n/compare/n8n@1.21.0...n8n@1.22.0)
(2023-12-21)


### Bug Fixes

* **core:** Close db connection gracefully when exiting
([#8045](#8045))
([e69707e](e69707e))
* **core:** Consider timeout in shutdown an error
([#8050](#8050))
([4cae976](4cae976))
* **core:** Do not display error when stopping jobless execution in
queue mode ([#8007](#8007))
([8e6b951](8e6b951))
* **core:** Fix shutdown if terminating before hooks are initialized
([#8047](#8047))
([6ae2f5e](6ae2f5e))
* **core:** Handle multiple termination signals correctly
([#8046](#8046))
([67bd8ad](67bd8ad))
* **core:** Initialize queue once in queue mode
([#8025](#8025))
([53c0b49](53c0b49))
* **core:** Prevent axios from force setting a form-urlencoded
content-type ([#8117](#8117))
([bba9576](bba9576))
* **core:** Remove circular references before serializing executions in
public API ([#8043](#8043))
([989888d](989888d))
* **core:** Restore workflow ID during execution creation
([#8031](#8031))
([c5e6ba8](c5e6ba8))
* **core:** Use relative imports for dynamic imports in
SecurityAuditService ([#8086](#8086))
([785bf99](785bf99))
* **core:** Stop binary data restoration from preventing execution from
finishing ([#8082](#8082))
([5ffff1b](5ffff1b))
* **editor:** Add back credential `use` permission
([#8023](#8023))
([329e5bf](329e5bf))
* **editor:** Cleanup Executions page component
([#8053](#8053))
([2689c37](2689c37))
* **editor:** Disable auto scroll and list size check when clicking on
executions ([#7983](#7983))
([fcb8b91](fcb8b91))
* **editor:** Ensure execution data overrides pinned data when copying
in executions view ([#8009](#8009))
([1d1cb0d](1d1cb0d))
* **editor:** Fix copy/paste issue when switch node is in workflow
([#8103](#8103))
([4b86926](4b86926))
* **editor:** Make keyboard shortcuts more strict; don't accept extra
Ctrl/Alt/Shift keys ([#8024](#8024))
([8df49e1](8df49e1))
* **editor:** Show credential share info only to appropriate users
([#8020](#8020))
([b29b4d4](b29b4d4))
* **editor:** Turn off executions list auto-refresh after leaving the
page ([#8005](#8005))
([e3c363d](e3c363d))
* **editor:** Update image sizes in template description not to be full
width always ([#8037](#8037))
([63a6e7e](63a6e7e))
* **ActiveCampaign Node:** Fix pagination issue when loading tags
([#8017](#8017))
([1943857](1943857))
* **HTTP Request Node:** Do not create circular references in HTTP
request node output ([#8030](#8030))
([5b7ea16](5b7ea16))
* Upgrade axios to address CVE-2023-45857
([#7713](#7713))
([64eb9bb](64eb9bb))


### Features

* Add option to `returnIntermediateSteps` for AI agents
([#8113](#8113))
([7806a65](7806a65))
* **core:** Add config option to prefer GET request over LIST when using
Hashicorp Vault ([#8049](#8049))
([439a22d](439a22d))
* **core:** Add N8N_GRACEFUL_SHUTDOWN_TIMEOUT env var
([#8068](#8068))
([614f488](614f488))
* **editor:** Add lead enrichment suggestions to workflow list
([#8042](#8042))
([36a923c](36a923c))
* **editor:** Finalize workers view
([#8052](#8052))
([edfa784](edfa784))
* **editor:** Gracefully ignore invalid payloads in postMessage handler
([#8096](#8096))
([9d22c7a](9d22c7a))
* **editor:** Upgrade frontend tooling to address a few vulnerabilities
([#8100](#8100))
([19b7f1f](19b7f1f))
* **Filter Node:** Overhaul UI by adding the new filter component
([#8016](#8016))
([3d53052](3d53052))
* **Respond to Webhook Node:** Overhaul with improvements like returning
all items ([#8093](#8093))
([32d397e](32d397e))


### Performance Improvements

* **editor:** Improve canvas rendering performance
([#8022](#8022))
([b780436](b780436))

Co-authored-by: ivov <ivov@users.noreply.github.com>
@janober
Copy link
Member

janober commented Dec 21, 2023

Got released with n8n@1.22.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@krynble krynble krynble approved these changes

Assignees
No one assigned
Labels
core Enhancement outside /nodes-base and /editor-ui n8n team Authored by the n8n team Released ui Enhancement in /editor-ui or /design-system
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@netroy @levpachmanov @janober @krynble