Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update make-fetch-happen to 11.0.3 #2796

Merged
merged 1 commit into from
Apr 22, 2023
Merged

update make-fetch-happen to 11.0.3 #2796

merged 1 commit into from
Apr 22, 2023

Conversation

ravindraP20
Copy link
Contributor

@ravindraP20 ravindraP20 commented Feb 10, 2023 •
edited by cclauss

Closes #2795
Blocked by #2770

http-cache-semantics 4.1.0 is vulnerable

https://www.cve.org/CVERecord?id=CVE-2022-25881

Checklist
  • npm install && npm test passes
  • tests are included
  • documentation is changed or added
  • commit message follows commit guidelines
Description of change

http-cache-semantics 4.1.0 is vulnerable

https://www.cve.org/CVERecord?id=CVE-2022-25881

npm/make-fetch-happen#210

@ravindraP20 ravindraP20 mentioned this pull request Feb 10, 2023
Closed
@cclauss
Copy link
Contributor

cclauss commented Feb 10, 2023

@wraithgar @nlf Your reviews, please.

@wraithgar
Copy link
Contributor

The engines declaration for this version of make-fetch-happen is incompatible with the current one of node-gyp. This PR is blocked by #2770

@n10000k
Copy link

n10000k commented Mar 23, 2023

This is causing 1 high severity vulnerability from http-cache-semantics within make-fetch-happen.

Do we have an eta on this?

@mayurborkar27
Copy link

http-cache-semantics 4.1.0 is high vulnerability issue. need to update make-fetch-happen to 11.0.3
Details: https://www.cve.org/CVERecord?id=CVE-2022-25881
When can we expect the update on this or any ETA?

@cclauss
Copy link
Contributor

cclauss commented Mar 27, 2023 •
edited

When you want a pull request to be merged, please give it a positive review as @fengmk2 has done at the top right of this page. Every checkmark ✔️ that project maintainers see there gives them confidence that the proposed changes have been looked at and have been deemed both useful and safe to merge into the codebase. Lots of "what is the ETA?" comments are easier for maintainers to ignore than ✔️✔️✔️✔️✔️ from several different reviewers.

Anyone can review a pull request on GitHub. To do so here:

  1. Scroll to the top of this page.
  2. Click the Files changed tab.
  3. Click the Review changes button.
  4. Click Approve (or one of the other options) and make comments only if they have not already been stated in the PR.
  5. Click Submit review so that your ✔️ can be added to the list.

@cclauss
Copy link
Contributor

cclauss commented Mar 27, 2023 •
edited

Also, the comment above that this PR is blocked by #2770 means that interested parties should review that one as well.

@amorscher amorscher mentioned this pull request Mar 29, 2023
Closed
@KoenDG KoenDG mentioned this pull request Apr 2, 2023
Merged
2 tasks
@benjaminpjones benjaminpjones mentioned this pull request Apr 8, 2023
Closed
4 tasks
@benjaminpjones
Copy link

benjaminpjones commented Apr 8, 2023 •
edited

If I understand @wraithgar's comment correctly, the dependency is only on the engines upgrade, and not on the whole of #2770. Since the length of #2770 was cited as a blocker for review, I've broken out the one-line "engines" commit into a separate PR for convenience (#2827), and would appreciate your reviews!

@n10000k
Copy link

n10000k commented Apr 8, 2023

@cclauss 100%, however the original PR blocker is just going to become stale at this point, it's now 4 months old :(

@cclauss cclauss merged commit 02480f6 into nodejs:main Apr 22, 2023
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 7, 2023
@dsanders11
Revert "update make-fetch-happen to 11.0.3 (nodejs#2796)"
700b7f7 
This reverts commit 02480f6.
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 8, 2023
@dsanders11
Revert "update make-fetch-happen to 11.0.3 (nodejs#2796)"
c446a48 
This reverts commit 02480f6.
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 9, 2023
@dsanders11
Revert "update make-fetch-happen to 11.0.3 (nodejs#2796)"
c907292 
This reverts commit 02480f6.
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 9, 2023
@dsanders11
Revert "update make-fetch-happen to 11.0.3 (nodejs#2796)"
f4de58e 
This reverts commit 02480f6.
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 9, 2023
@dsanders11
Revert "update make-fetch-happen to 11.0.3 (nodejs#2796)"
fe69b8c 
This reverts commit 02480f6.
dsanders11 added a commit to dsanders11/node-gyp that referenced this pull request May 10, 2023
@dsanders11
Revert "update make-fetch-happen to 11.0.3 (nodejs#2796)"
6bb7cd6 
This reverts commit 02480f6.
@legobeat
Copy link

legobeat commented May 16, 2023 •
edited

@cclauss Tests are now breaking on main on node 14~18: https://github.com/nodejs/node-gyp/actions/runs/4811204563/jobs/8564880967

Not sure why #2827 was closed (make-fetch-happen@11 and the new transitive cacache, minipass-fetch, and ssri^10 do end support for node 12)?

#2770 still looks relevant and is now rebased and updated by author.

@legobeat
Copy link

legobeat commented May 17, 2023 •
edited

FWIW this change (updating make-fetch-happen) is/was breaking - package managers like yarn will refuse to install if on node 12.

Just opened npm/make-fetch-happen#243. Seems like it would make the situation more straight-forward on this side (assuming a node-gyp@9.x release with a yet-to-be-released make-fetch-happen@10.x is feasible)

@legobeat legobeat mentioned this pull request May 17, 2023
Closed
legobeat added a commit to legobeat/node-gyp that referenced this pull request May 17, 2023
@legobeat
Revert "update make-fetch-happen to 11.0.3 (nodejs#2796)"
9712b7d 
This reverts commit 02480f6.
legobeat added a commit to legobeat/node-gyp that referenced this pull request May 17, 2023
@legobeat
fix: Revert "update make-fetch-happen to 11.0.3 (nodejs#2796)"
dc1d443 
This reverts commit 02480f6, thereby
rolling back dependency make-fetch-happen from ^11.0.3 to ^10.0.3.

The upgrade is breaking for node-fetch users as it has transitive
dependencies with syntax incompatible with supported Node.js versions.

Related:
- nodejs#2770
- nodejs#2837
- nodejs#2816
- nodejs#2848
- nodejs#2827
- nodejs#2796
@legobeat legobeat mentioned this pull request May 17, 2023
Closed
4 tasks
@benjaminpjones
Copy link

benjaminpjones commented May 18, 2023 •
edited

Not sure why #2827 was closed

I closed #2827 because this PR had already been merged. Happy to re-open, but it seems we can accomplish the same through #2770 directly.

legobeat added a commit to legobeat/node-gyp that referenced this pull request Jun 26, 2023
@legobeat
fix: Revert "update make-fetch-happen to 11.0.3 (nodejs#2796)"
dd50c2c 
This reverts commit 02480f6, thereby
rolling back dependency make-fetch-happen from ^11.0.3 to ^10.0.3.

The upgrade is breaking for node-fetch users as it has transitive
dependencies with syntax incompatible with supported Node.js versions.

Related:
- nodejs#2770
- nodejs#2837
- nodejs#2816
- nodejs#2848
- nodejs#2827
- nodejs#2796
@legobeat legobeat mentioned this pull request Jul 5, 2023
Closed
lukekarrys added a commit that referenced this pull request Oct 27, 2023
@lukekarrys
Revert "update make-fetch-happen to 11.0.3 (#2796)"
54f3ebb 
This reverts commit 02480f6.
lukekarrys added a commit that referenced this pull request Oct 27, 2023
@lukekarrys
fix: Revert "update make-fetch-happen to 11.0.3 (#2796)"
48fb923 
This reverts commit 02480f6.
lukekarrys added a commit that referenced this pull request Oct 27, 2023
@lukekarrys
fix: Revert "update make-fetch-happen to 11.0.3 (#2796)"
ff71ed8 
This reverts commit 02480f6.
lukekarrys added a commit that referenced this pull request Oct 27, 2023
@lukekarrys
fix: Revert "update make-fetch-happen to 11.0.3 (#2796)"
82c2d64 
This reverts commit 02480f6.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fengmk2 fengmk2 fengmk2 approved these changes

@cclauss cclauss cclauss approved these changes

@benjaminpjones benjaminpjones benjaminpjones approved these changes

@n10000k n10000k n10000k approved these changes

@mayurborkar27 mayurborkar27 mayurborkar27 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

update make-fetch-happen to 11.0.3
8 participants
@ravindraP20 @cclauss @wraithgar @n10000k @mayurborkar27 @benjaminpjones @legobeat @fengmk2