[SECURITY]: Announcing 1 Critical, 2 High and 1 Moderate advisories

[jamietanna]

We're announcing 4 GitHub Security Advisories (GHSAs) that affect the Renovate CLI.

There are 1 Critical, 2 High and 1 Moderate advisories.

It is recommended that you upgrade to a minimum of Renovate 44.79.0.

There are no planned backports of these fixes to previous major versions of Renovate.

CVE IDs have been requested for each of these.

Shared presets could bypass allowedEnv and allowedHeaders

• Critical (9.9): GHSA-6873-xr44-22vm: Environment variable allowlist (allowedEnv) could be bypassed by using a shared preset
  • Fixed in 44.60.1
• High (7.1): GHSA-6j6f-fh7w-vvjr: HTTP header allowlist (allowedHeaders) could be bypassed by using a shared preset
  • Fixed in 44.60.1

Server-Side Request Forgery via HTTP preset URLs in extends array or customDatasources

• High (8.5): GHSA-8rqp-w6vc-pf27: Server-Side Request Forgery via HTTP preset URLs in extends array or customDatasources
  • Fixed in 44.79.0

minimumReleaseAge could be bypassed when requesting a PR is rebased

• Moderate (4.7): GHSA-2frq-pm48-6j4h: A user's request to rebase a PR can bypass strict minimumReleaseAge internal checks
  • Fixed in 44.61.3